dcrat | fab9726534078808667e3e330bf24152919f74893067ec8cc40f21b0d025fbb8

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/09/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2fb35c4ae7f69057974364351375bfb9.exe
Size 750KB
Sample260927-eelw4ayble
SHA256 fab9726534078808667e3e330bf24152919f74893067ec8cc40f21b0d025fbb8
MD5 2fb35c4ae7f69057974364351375bfb9
SHA1 a06345f53795736da97151d45fee3cb402f61ec0
SHA512 cfe55d90b259c9f54841c7cef04a75c225f15ea91bb27f0b1c4c4164a63a5ea6c82b196f41cd172c25b8a0c953cec47a39cb34a7fcabecb8b018487c37be0364
SSDEEP 12288:hpoIY///1UFyp4JfHkKR4amAY/ehKTXERL3L4/8pUs5QcEtov6N:kIY//yJDSamL7TX+Lm83+W
TLSH
T11BF423235C9E54F3ED9844FB3C5A1B763B6E02C92E442FB6497C7C491B919B238709AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x001000000001b30b-13.dat	dcrat
behavioral2/files/0x000e00000001c52c-30.dat	dcrat
behavioral2/memory/1220-32-0x0000000000480000-0x0000000000576000-memory.dmp	dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5588	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	248	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5316	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6116	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5404	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	3004	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	3004	schtasks.exe	96

Disables Task Manager via registry modification
defense_evasion

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\Desktop\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 8 IoCs

pid	Process
3348	builds_store.json.cmd
1220	driverPerf.exe
4100	WUDFHost.exe
5100	sihost.exe
1140	RuntimeBroker.exe
4948	driverPerf.exe
3124	RuntimeBroker.exe
720	driverPerf.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1240	WScript.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\9e8d7a4ca61bd9	driverPerf.exe
File created	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\RuntimeBroker.exe	driverPerf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4896	cmd.exe
5776	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	driverPerf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	driverPerf.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builds_store.json.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	builds_store.json.cmd
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	driverPerf.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	2fb35c4ae7f69057974364351375bfb9.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1468	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5316	schtasks.exe
6116	schtasks.exe
1996	schtasks.exe
3732	schtasks.exe
1216	schtasks.exe
1748	schtasks.exe
4796	schtasks.exe
3200	schtasks.exe
2832	schtasks.exe
5588	schtasks.exe
1268	schtasks.exe
5404	schtasks.exe
4340	schtasks.exe
4924	schtasks.exe
248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1220	driverPerf.exe
1220	driverPerf.exe
1220	driverPerf.exe
1220	driverPerf.exe
1220	driverPerf.exe
1220	driverPerf.exe
1220	driverPerf.exe
1220	driverPerf.exe
1220	driverPerf.exe
1220	driverPerf.exe
1220	driverPerf.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	driverPerf.exe
Token: SeDebugPrivilege	4100	WUDFHost.exe
Token: SeDebugPrivilege	5100	sihost.exe
Token: SeDebugPrivilege	4948	driverPerf.exe
Token: SeDebugPrivilege	1140	RuntimeBroker.exe
Token: SeDebugPrivilege	3124	RuntimeBroker.exe
Token: SeDebugPrivilege	720	driverPerf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3820	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 3348	5564	2fb35c4ae7f69057974364351375bfb9.exe	91
PID 3348 wrote to memory of 1240	3348	builds_store.json.cmd	92
PID 1240 wrote to memory of 4896	1240	WScript.exe	93
PID 4896 wrote to memory of 1220	4896	cmd.exe	95
PID 1220 wrote to memory of 5776	1220	driverPerf.exe	116
PID 4896 wrote to memory of 1468	4896	cmd.exe	118
PID 5776 wrote to memory of 2776	5776	cmd.exe	119
PID 5776 wrote to memory of 720	5776	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2fb35c4ae7f69057974364351375bfb9.exe
"C:\Users\Admin\AppData\Local\Temp\2fb35c4ae7f69057974364351375bfb9.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Users\Admin\AppData\Local\Temp\builds_store.json.cmd
  "C:\Users\Admin\AppData\Local\Temp\builds_store.json.cmd"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\fontwin\XfnlBm.vbe"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\fontwin\pWv5P.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Users\Admin\AppData\Roaming\fontwin\driverPerf.exe
        
        "C:\Users\Admin\AppData\Roaming\fontwin\driverPerf.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Reads the TCP/IP host and domain name from the registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1220
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pQuxQFPn08.bat"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2776
        
        C:\Recovery\WindowsRE\driverPerf.exe
        
        "C:\Recovery\WindowsRE\driverPerf.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:720
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Users\All Users\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "driverPerfd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\driverPerf.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "driverPerf" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\driverPerf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "driverPerfd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\driverPerf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Desktop\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Users\All Users\WUDFHost.exe
"C:\Users\All Users\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Recovery\WindowsRE\sihost.exe
"C:\Recovery\WindowsRE\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Users\Admin\Desktop\RuntimeBroker.exe
"C:\Users\Admin\Desktop\RuntimeBroker.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Recovery\WindowsRE\driverPerf.exe
"C:\Recovery\WindowsRE\driverPerf.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\RuntimeBroker.exe
"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

builds_store.json.cmd

Path C:\Users\Admin\AppData\Local\Temp\builds_store.json.cmd
Size 1.2MB
SHA256 3292329c64143a3021cd35cbdd57ab9b1eaf0a36113deae7cd0c0a4731be76ca
MD5 70f951d8d3d4538db88ad11d6a2727c7
SHA1 62f0bd0f65e880062928797d6eed6ff9efc48636
SHA512 41d7ed6d8cfe4d7d612f260d5425f8004ea19ff05bc61f4acbfc36274703f2fea19c63173f7e00959a15403fd93c46aa71e6e655e684a6430eb951da7aa747b9
SSDEEP 24576:U2G/nvxW3Ww0tXSDwwwp6HKya3iX/tA/UhXZDXOEDs:UbA30CDwAKFAFASXOEg
TLSH
T1DE556A027F44DA21F0191233C2FF490447B4AC50AAA6E72B7EB9376E55223977C5DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pQuxQFPn08.bat

Path C:\Users\Admin\AppData\Local\Temp\pQuxQFPn08.bat
Size 201B
SHA256 fdcf50e4292f091f5418e2744d82830a19b44e842b9c8134412a3cc296772f7f
MD5 a28753f26dbcd94e69a3b7dfbbc8af87
SHA1 2ff0a264837ef8dd6d9594beb85a86d78fb364b4
SHA512 af67ace081411f8aa5d645e6baee225ef9250a8e71c63f8118a9bd4b1c8d4905e4fa7f8c126f79c3d73d9be0030d21b6344d8efa5b94454695eb32c11229e956
TLSH
T12ED022439002CE5A48A24913884F168CB22728ABF6C575600BA604A46A8B4BFB1AA5C1
MD5 SHA1 SHA512 TLSH

Submit Download

start_web_rat.py

Path C:\Users\Admin\AppData\Local\Temp\start_web_rat.py
Size 80KB
SHA256 15f38b73a349a20e8b1082795258554c28df505b5bc8285d9ec2e0e1b59f8e43
MD5 406f5ef92320e4d2020ba42fca852946
SHA1 24b2373a30ab73392c176398a99a7fb6f72b1f58
SHA512 ac617947ef4f6d139c8fef6d111cc0e57b379b69f690208cf4790ab9ebfb7cf8b1019681d2b185bc6ef95a2de14201bdb7aeec0931d4056d411de99bbc42875c
SSDEEP 1536:5h+t5GeD8uCKeyn+uZeMT0oXczWXKMIlF9:58kX/yIlF9
TLSH
T1D183E632AC16292342F3C60D9C66DA47F71A4313152115577EAC93AC2FB9D2A86F1EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XfnlBm.vbe

Path C:\Users\Admin\AppData\Roaming\fontwin\XfnlBm.vbe
Size 196B
SHA256 b06bedcf846a9d231e329014e0aa4fd38800666977270a99aaebe8c419ce5f2f
MD5 3853e56f7a2d261c7abef31ed9d67b89
SHA1 e0f14bc6031f1dc530e108e09aa067ccb06270d0
SHA512 cc94f65872c6bd4fd11c7d3f23477044b9126f878002a5e84e1419d3e4cda10a33388573f893b556156f2a24027e3187f38e32c60a151d8fc6316198d0f611f1
TLSH
T191D02388515FB3948D184886D384C42C5D95EF5487404695845C9541200457B3C1C355
MD5 SHA1 SHA512 TLSH

Submit Download

driverPerf.exe

Path C:\Users\Admin\AppData\Roaming\fontwin\driverPerf.exe
Size 952KB
SHA256 bdc36e540db68e53969b5d277acce0464ffcaa3e2bf3e9bc96d1f54573c085ae
MD5 5943e3387fcf59fb8dfde219b9b1a316
SHA1 4341e082d681c6b1140ad30d34040c5e6c8ab15b
SHA512 8291a5f3990c83c25f038782c4754bd083bbf8f4f0bc39287eb46bf76fb9a846c491c7ae5c633f7943b00db1b17eae80df536661dd75b82a5889c8c817d27262
SSDEEP 12288:YSQiwwwpQY2HKyaLrVst17blHA+YjUhzoIFZDtws5Q2Er+v0G:YSDwwwp6HKya3iX/tA/UhXZDXOED
TLSH
T1FF2507027F489E11F0091233C2EF494847B49D51AAA6E72B7DBA376E15123AB7C4D9CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pWv5P.bat

Path C:\Users\Admin\AppData\Roaming\fontwin\pWv5P.bat
Size 146B
SHA256 928fcfe2245e4cc3b2556d8cf50871e35d8ab36bcaea69382a5add7546494148
MD5 97eea595ee9aab410c0274c9fa06189b
SHA1 722f5bfcc5f6b232473cd50dbb05c472462e9682
SHA512 78f94fffafe71f8641ee1289b2e8b9f749b094eade2dffd0c517573cf0c9bc8846d6606db38b70bd819f2bc4ee40268033911edff7d591467798bd8703bc4c92
TLSH
T184C08C30201698A2E5A0AA24288FAD02972B124B6050A2540D9A102F814A48DC17C6C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1220-32-0x0000000000480000-0x0000000000576000-memory.dmp

Download

memory/1220-35-0x00000000028E0000-0x00000000028EC000-memory.dmp

Download

memory/1220-34-0x0000000002610000-0x0000000002618000-memory.dmp

Download

memory/1220-33-0x0000000002600000-0x000000000260E000-memory.dmp

Download

memory/5564-4-0x00007FF921310000-0x00007FF921CB4000-memory.dmp

Download

memory/5564-16-0x00007FF921310000-0x00007FF921CB4000-memory.dmp

Download

memory/5564-0-0x00007FF92149F000-0x00007FF9214A0000-memory.dmp

Download

memory/5564-2-0x00007FF921310000-0x00007FF921CB4000-memory.dmp

Download

memory/5564-1-0x0000000000480000-0x0000000000542000-memory.dmp

Download