dcrat | f19bfa53dd35f17d71e2c3771b2160a2799216c8e7b6a5b5bc1253c4d12a37e7

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

613c8540d116ee2b43a99067e04fa79a.exe
Size

2.9MB
MD5

613c8540d116ee2b43a99067e04fa79a
SHA1

9cb122624c4e81615e1e7c7b1210a2d6d0dc6840
SHA256

f19bfa53dd35f17d71e2c3771b2160a2799216c8e7b6a5b5bc1253c4d12a37e7
SHA512

0a53ef3bbeccdea1382dc461307da17905861977ab7d6faa6b7339d64464b4fccb36c1d418f52d7453c84d4fcf98aab7e85d3eeea4b0dd00a4ec153d7da3a3c1
SSDEEP

49152:MQ00xeGLcCrbIF1T1TcRPKlQp4z8mlraJafgtHOpaAl+mx0flF640Sya:MQ0FCrbG9VcRilQpkFrpxaAl+m4Asy

Score

10^/10

dcrat evasion infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\taskhost.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsass.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\taskhost.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsass.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsm.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\taskhost.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsass.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsm.exe\", \"C:\\Users\\Default\\My Documents\\sppsvc.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\taskhost.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsass.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsm.exe\", \"C:\\Users\\Default\\My Documents\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\services.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\taskhost.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsass.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsm.exe\", \"C:\\Users\\Default\\My Documents\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\services.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\taskhost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\", \"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\", \"C:\\Users\\Admin\\lsass.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\taskhost.exe\", \"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsass.exe\""	613c8540d116ee2b43a99067e04fa79a.exe

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1784	schtasks.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	1784	schtasks.exe	26

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	613c8540d116ee2b43a99067e04fa79a.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1184-54-0x0000000000890000-0x0000000000B80000-memory.dmp	dcrat
behavioral1/files/0x0008000000005c50-115.dat	dcrat
behavioral1/files/0x0008000000005c50-117.dat	dcrat
behavioral1/memory/2220-118-0x00000000013C0000-0x00000000016B0000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2220	wininit.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\explorer.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\winlogon.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\explorer.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsass.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\My Documents\\sppsvc.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\taskhost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\spoolsv.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\taskhost.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\My Documents\\sppsvc.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\services.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsm.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsm.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\services.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Microsoft Games\\SpiderSolitaire\\System.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\csrss.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\explorer.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\services.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\services.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\wininit.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\lsass.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\lsass.exe\""	613c8540d116ee2b43a99067e04fa79a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\d6223342-1a8a-11ed-b209-a59dca5554ed\\lsass.exe\""	613c8540d116ee2b43a99067e04fa79a.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ipinfo.io
7	ipinfo.io

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\services.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\c5b4cb5e9653cc	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCX6F6A.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\RCX7B4E.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\it-IT\services.exe	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\56085415360792	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\System.exe	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\RCX77D3.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\it-IT\RCX616.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\RCX1575.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\services.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\27d1bcfc3c54e0	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\System.exe	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCX9306.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\it-IT\RCX9A0.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\886983d96e3d3e	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\services.exe	613c8540d116ee2b43a99067e04fa79a.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\c5b4cb5e9653cc	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCX6BEF.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCX8F8C.tmp	613c8540d116ee2b43a99067e04fa79a.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\RCX11FB.tmp	613c8540d116ee2b43a99067e04fa79a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1108	schtasks.exe
1740	schtasks.exe
1528	schtasks.exe
1496	schtasks.exe
1148	schtasks.exe
544	schtasks.exe
2000	schtasks.exe
920	schtasks.exe
1956	schtasks.exe
2004	schtasks.exe
1996	schtasks.exe
1648	schtasks.exe
1064	schtasks.exe
2028	schtasks.exe
1712	schtasks.exe
1968	schtasks.exe
1628	schtasks.exe
1608	schtasks.exe
1060	schtasks.exe
1144	schtasks.exe
860	schtasks.exe
1292	schtasks.exe
268	schtasks.exe
308	schtasks.exe
1068	schtasks.exe
1196	schtasks.exe
524	schtasks.exe
900	schtasks.exe
1680	schtasks.exe
2008	schtasks.exe
2024	schtasks.exe
1352	schtasks.exe
2028	schtasks.exe
592	schtasks.exe
1252	schtasks.exe
1988	schtasks.exe
1464	schtasks.exe
900	schtasks.exe
864	schtasks.exe
2008	schtasks.exe
1744	schtasks.exe
1488	schtasks.exe
1148	schtasks.exe
1740	schtasks.exe
524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1184	613c8540d116ee2b43a99067e04fa79a.exe
1184	613c8540d116ee2b43a99067e04fa79a.exe
1184	613c8540d116ee2b43a99067e04fa79a.exe
2220	wininit.exe
1996	powershell.exe
612	powershell.exe
1292	powershell.exe
1352	powershell.exe
2016	powershell.exe
1216	powershell.exe
1684	powershell.exe
1112	powershell.exe
692	powershell.exe
1572	powershell.exe
1796	powershell.exe
2220	wininit.exe
1992	powershell.exe
2220	wininit.exe
2220	wininit.exe
2220	wininit.exe
2220	wininit.exe
2220	wininit.exe
2220	wininit.exe
2220	wininit.exe
2220	wininit.exe
2220	wininit.exe
2220	wininit.exe
2220	wininit.exe
2220	wininit.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	613c8540d116ee2b43a99067e04fa79a.exe
Token: SeDebugPrivilege	2220	wininit.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeBackupPrivilege	928	vssvc.exe
Token: SeRestorePrivilege	928	vssvc.exe
Token: SeAuditPrivilege	928	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2220	wininit.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1216	1184	613c8540d116ee2b43a99067e04fa79a.exe	72
PID 1184 wrote to memory of 1216	1184	613c8540d116ee2b43a99067e04fa79a.exe	72
PID 1184 wrote to memory of 1216	1184	613c8540d116ee2b43a99067e04fa79a.exe	72
PID 1184 wrote to memory of 1796	1184	613c8540d116ee2b43a99067e04fa79a.exe	73
PID 1184 wrote to memory of 1796	1184	613c8540d116ee2b43a99067e04fa79a.exe	73
PID 1184 wrote to memory of 1796	1184	613c8540d116ee2b43a99067e04fa79a.exe	73
PID 1184 wrote to memory of 1992	1184	613c8540d116ee2b43a99067e04fa79a.exe	76
PID 1184 wrote to memory of 1992	1184	613c8540d116ee2b43a99067e04fa79a.exe	76
PID 1184 wrote to memory of 1992	1184	613c8540d116ee2b43a99067e04fa79a.exe	76
PID 1184 wrote to memory of 2016	1184	613c8540d116ee2b43a99067e04fa79a.exe	77
PID 1184 wrote to memory of 2016	1184	613c8540d116ee2b43a99067e04fa79a.exe	77
PID 1184 wrote to memory of 2016	1184	613c8540d116ee2b43a99067e04fa79a.exe	77
PID 1184 wrote to memory of 1996	1184	613c8540d116ee2b43a99067e04fa79a.exe	79
PID 1184 wrote to memory of 1996	1184	613c8540d116ee2b43a99067e04fa79a.exe	79
PID 1184 wrote to memory of 1996	1184	613c8540d116ee2b43a99067e04fa79a.exe	79
PID 1184 wrote to memory of 612	1184	613c8540d116ee2b43a99067e04fa79a.exe	81
PID 1184 wrote to memory of 612	1184	613c8540d116ee2b43a99067e04fa79a.exe	81
PID 1184 wrote to memory of 612	1184	613c8540d116ee2b43a99067e04fa79a.exe	81
PID 1184 wrote to memory of 1352	1184	613c8540d116ee2b43a99067e04fa79a.exe	83
PID 1184 wrote to memory of 1352	1184	613c8540d116ee2b43a99067e04fa79a.exe	83
PID 1184 wrote to memory of 1352	1184	613c8540d116ee2b43a99067e04fa79a.exe	83
PID 1184 wrote to memory of 1684	1184	613c8540d116ee2b43a99067e04fa79a.exe	85
PID 1184 wrote to memory of 1684	1184	613c8540d116ee2b43a99067e04fa79a.exe	85
PID 1184 wrote to memory of 1684	1184	613c8540d116ee2b43a99067e04fa79a.exe	85
PID 1184 wrote to memory of 692	1184	613c8540d116ee2b43a99067e04fa79a.exe	86
PID 1184 wrote to memory of 692	1184	613c8540d116ee2b43a99067e04fa79a.exe	86
PID 1184 wrote to memory of 692	1184	613c8540d116ee2b43a99067e04fa79a.exe	86
PID 1184 wrote to memory of 1112	1184	613c8540d116ee2b43a99067e04fa79a.exe	88
PID 1184 wrote to memory of 1112	1184	613c8540d116ee2b43a99067e04fa79a.exe	88
PID 1184 wrote to memory of 1112	1184	613c8540d116ee2b43a99067e04fa79a.exe	88
PID 1184 wrote to memory of 1292	1184	613c8540d116ee2b43a99067e04fa79a.exe	90
PID 1184 wrote to memory of 1292	1184	613c8540d116ee2b43a99067e04fa79a.exe	90
PID 1184 wrote to memory of 1292	1184	613c8540d116ee2b43a99067e04fa79a.exe	90
PID 1184 wrote to memory of 1572	1184	613c8540d116ee2b43a99067e04fa79a.exe	92
PID 1184 wrote to memory of 1572	1184	613c8540d116ee2b43a99067e04fa79a.exe	92
PID 1184 wrote to memory of 1572	1184	613c8540d116ee2b43a99067e04fa79a.exe	92
PID 1184 wrote to memory of 2140	1184	613c8540d116ee2b43a99067e04fa79a.exe	96
PID 1184 wrote to memory of 2140	1184	613c8540d116ee2b43a99067e04fa79a.exe	96
PID 1184 wrote to memory of 2140	1184	613c8540d116ee2b43a99067e04fa79a.exe	96
PID 2140 wrote to memory of 2180	2140	cmd.exe	98
PID 2140 wrote to memory of 2180	2140	cmd.exe	98
PID 2140 wrote to memory of 2180	2140	cmd.exe	98
PID 2140 wrote to memory of 2220	2140	cmd.exe	99
PID 2140 wrote to memory of 2220	2140	cmd.exe	99
PID 2140 wrote to memory of 2220	2140	cmd.exe	99
PID 2220 wrote to memory of 2924	2220	wininit.exe	100
PID 2220 wrote to memory of 2924	2220	wininit.exe	100
PID 2220 wrote to memory of 2924	2220	wininit.exe	100
PID 2220 wrote to memory of 2980	2220	wininit.exe	101
PID 2220 wrote to memory of 2980	2220	wininit.exe	101
PID 2220 wrote to memory of 2980	2220	wininit.exe	101

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	613c8540d116ee2b43a99067e04fa79a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	613c8540d116ee2b43a99067e04fa79a.exe

C:\Users\Admin\AppData\Local\Temp\613c8540d116ee2b43a99067e04fa79a.exe
"C:\Users\Admin\AppData\Local\Temp\613c8540d116ee2b43a99067e04fa79a.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JUCZMD8jrG.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2180
- - C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2220
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0944b749-af75-464e-a8f2-411b33512fdf.vbs"
      4⤵
      PID:2924
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3845205b-45d3-4c87-99d1-8e1e00b83c17.vbs"
      4⤵
      PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Games\SpiderSolitaire\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Default\My Documents\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\My Documents\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Default\My Documents\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe

Filesize
2.9MB

MD5
5b3a6d2cc35af159c38df5dd2975e369

SHA1
65fa9ac787a948c606cb298b9b8f0a174fd337c3

SHA256
8180208a7a154aa068d05eff33fd9b32dd87a6f6ae8b8ff4424a15c8e3d05f6f

SHA512
4b4b0e232454f4547d4b8ecb60eb3d945ff3a400c57ae1078630f08aa58400ed2172c8b4e83558a7820e25105846958271e76724c9becf48db71ea395a6ea532

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe

Filesize
2.9MB

MD5
5b3a6d2cc35af159c38df5dd2975e369

SHA1
65fa9ac787a948c606cb298b9b8f0a174fd337c3

SHA256
8180208a7a154aa068d05eff33fd9b32dd87a6f6ae8b8ff4424a15c8e3d05f6f

SHA512
4b4b0e232454f4547d4b8ecb60eb3d945ff3a400c57ae1078630f08aa58400ed2172c8b4e83558a7820e25105846958271e76724c9becf48db71ea395a6ea532

Download Submit
C:\Users\Admin\AppData\Local\Temp\0944b749-af75-464e-a8f2-411b33512fdf.vbs

Filesize
731B

MD5
4e0230e4cc2aee66c3e4d0c1a8e2e021

SHA1
c89be3eb9a7db8746c88930a76699fa111c9e150

SHA256
bd6d47a1d8597ee6cad01492edcdbc11402cf192cc8551170282b2a717f26cb5

SHA512
354c28e7e4c8dbefdf30e701e596723f7ea76cb02ecfd6ce81870523e2fb9b2647b64cf62bf0f60503b194fee5a502d875d58f8358f9af58b22f7e604a9bd9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3845205b-45d3-4c87-99d1-8e1e00b83c17.vbs

Filesize
507B

MD5
f52956829513ac8c3b5ead04b3e021e1

SHA1
1e3d5962e26c99e418641396e8d5b400065f03ab

SHA256
0e89c81b781e30bf64c6b842dc14414a12a6a87ca148795497fecfb017f2ae96

SHA512
b6a93377b7bd498c698a4ee6038f9135e0798cfe14efedaf434aba7310463f53f46d4760f4f9a54b040b61b38f2e90102065681f55665961dd4bf71a74581483

Download Submit
C:\Users\Admin\AppData\Local\Temp\JUCZMD8jrG.bat

Filesize
220B

MD5
89dc30ee3e64d92480bfabbae97ead33

SHA1
58482fab6c3de0bfa7f71b4dbad0fc6c8c690057

SHA256
60c1d6eaa9fd0de767055307a16477bba8bf7c864faa4af1aab7b8e4aeae2805

SHA512
38d935cd30567cfad513732fdafa6c9133765abd2451cae9a25e9cb40768e9e77f57d33368f837d9ab9a2b32fbda1f6e0bf9dd0442163bc13c4bd3f12cdc9869

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp01599.tmp

Filesize
1KB

MD5
edc2400a729fd24de59adc3f30316d23

SHA1
d488e59137596e26c2672abe2a2d3507212b2d60

SHA256
052ef7825d69502e423177a815a1a9a53ca41e9e9ef00ef1fdedc6f49521d340

SHA512
b7bc88e6cb813360347aa683e1a76231b7d95920d5f1a45cbc46e8edd1d475dee4947803c1aa0dacc6604da3408b1d825ebadb4cf20a31eadd64be77aedc1511

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1b14e3aa99b3cad488c235660b47cef0

SHA1
4e9d6ada0dfda789311b01c018067c53ab0d29c1

SHA256
ca0e6386e9788b4889e04fdca4430bee19e62c0ba1f63f1f2e48f653e666f707

SHA512
2df69ce96421e927863551e2e7151cdc17698f4e9458c1e0e84f0eb845d68a0047ac659adac58933aa5e5a66dbbcdf737eba43c8c2833a153cd7ff25f6812287

Download Submit
memory/612-113-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/612-130-0x00000000027B4000-0x00000000027B7000-memory.dmp

Filesize
12KB

Download
memory/612-172-0x00000000027B4000-0x00000000027B7000-memory.dmp

Filesize
12KB

Download
memory/612-174-0x00000000027BB000-0x00000000027DA000-memory.dmp

Filesize
124KB

Download
memory/612-127-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/612-151-0x000000001B8A0000-0x000000001BB9F000-memory.dmp

Filesize
3.0MB

Download
memory/612-157-0x00000000027B4000-0x00000000027B7000-memory.dmp

Filesize
12KB

Download
memory/692-136-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/692-184-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/692-183-0x00000000029AB000-0x00000000029CA000-memory.dmp

Filesize
124KB

Download
memory/692-119-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/692-168-0x000000001B810000-0x000000001BB0F000-memory.dmp

Filesize
3.0MB

Download
memory/692-147-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/692-163-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/1112-133-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/1112-171-0x000000001B850000-0x000000001BB4F000-memory.dmp

Filesize
3.0MB

Download
memory/1112-188-0x000000000264B000-0x000000000266A000-memory.dmp

Filesize
124KB

Download
memory/1112-160-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/1112-124-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/1112-148-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/1184-72-0x000000001A790000-0x000000001A79E000-memory.dmp

Filesize
56KB

Download
memory/1184-67-0x0000000002110000-0x0000000002122000-memory.dmp

Filesize
72KB

Download
memory/1184-54-0x0000000000890000-0x0000000000B80000-memory.dmp

Filesize
2.9MB

Download
memory/1184-63-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download
memory/1184-71-0x00000000021F0000-0x00000000021F8000-memory.dmp

Filesize
32KB

Download
memory/1184-57-0x00000000002E0000-0x00000000002FC000-memory.dmp

Filesize
112KB

Download
memory/1184-69-0x00000000021D0000-0x00000000021DA000-memory.dmp

Filesize
40KB

Download
memory/1184-70-0x00000000021E0000-0x00000000021EE000-memory.dmp

Filesize
56KB

Download
memory/1184-68-0x0000000002140000-0x0000000002148000-memory.dmp

Filesize
32KB

Download
memory/1184-65-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/1184-62-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/1184-66-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/1184-56-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download
memory/1184-73-0x000000001A7A0000-0x000000001A7AC000-memory.dmp

Filesize
48KB

Download
memory/1184-55-0x0000000000240000-0x000000000024E000-memory.dmp

Filesize
56KB

Download
memory/1184-58-0x0000000000300000-0x0000000000308000-memory.dmp

Filesize
32KB

Download
memory/1184-59-0x0000000000310000-0x0000000000320000-memory.dmp

Filesize
64KB

Download
memory/1184-64-0x0000000000840000-0x0000000000896000-memory.dmp

Filesize
344KB

Download
memory/1184-60-0x00000000005C0000-0x00000000005D6000-memory.dmp

Filesize
88KB

Download
memory/1184-61-0x00000000003A0000-0x00000000003B2000-memory.dmp

Filesize
72KB

Download
memory/1216-145-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/1216-91-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/1216-167-0x000000001B840000-0x000000001BB3F000-memory.dmp

Filesize
3.0MB

Download
memory/1216-132-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/1216-159-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/1216-190-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/1292-120-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/1292-153-0x000000001B790000-0x000000001BA8F000-memory.dmp

Filesize
3.0MB

Download
memory/1292-166-0x0000000002424000-0x0000000002427000-memory.dmp

Filesize
12KB

Download
memory/1292-177-0x0000000002424000-0x0000000002427000-memory.dmp

Filesize
12KB

Download
memory/1292-129-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/1292-178-0x000000000242B000-0x000000000244A000-memory.dmp

Filesize
124KB

Download
memory/1292-142-0x0000000002424000-0x0000000002427000-memory.dmp

Filesize
12KB

Download
memory/1352-143-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/1352-125-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/1352-131-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/1352-158-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/1352-176-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/1352-175-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/1572-138-0x0000000002524000-0x0000000002527000-memory.dmp

Filesize
12KB

Download
memory/1572-150-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/1572-165-0x0000000002524000-0x0000000002527000-memory.dmp

Filesize
12KB

Download
memory/1572-185-0x000000000252B000-0x000000000254A000-memory.dmp

Filesize
124KB

Download
memory/1572-187-0x0000000002524000-0x0000000002527000-memory.dmp

Filesize
12KB

Download
memory/1572-170-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/1572-123-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/1684-135-0x0000000002974000-0x0000000002977000-memory.dmp

Filesize
12KB

Download
memory/1684-173-0x000000001B780000-0x000000001BA7F000-memory.dmp

Filesize
3.0MB

Download
memory/1684-162-0x0000000002974000-0x0000000002977000-memory.dmp

Filesize
12KB

Download
memory/1684-186-0x000000000297B000-0x000000000299A000-memory.dmp

Filesize
124KB

Download
memory/1684-189-0x0000000002974000-0x0000000002977000-memory.dmp

Filesize
12KB

Download
memory/1684-146-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/1684-121-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/1796-87-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/1796-161-0x0000000001DD0000-0x0000000001E50000-memory.dmp

Filesize
512KB

Download
memory/1796-80-0x000007FEFB7D1000-0x000007FEFB7D3000-memory.dmp

Filesize
8KB

Download
memory/1796-149-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/1796-134-0x0000000001DD0000-0x0000000001E50000-memory.dmp

Filesize
512KB

Download
memory/1992-199-0x000007FEE9790000-0x000007FEEA2ED000-memory.dmp

Filesize
11.4MB

Download
memory/1992-198-0x000007FEEA2F0000-0x000007FEEAD13000-memory.dmp

Filesize
10.1MB

Download
memory/1996-156-0x0000000002924000-0x0000000002927000-memory.dmp

Filesize
12KB

Download
memory/1996-182-0x0000000002924000-0x0000000002927000-memory.dmp

Filesize
12KB

Download
memory/1996-179-0x000000000292B000-0x000000000294A000-memory.dmp

Filesize
124KB

Download
memory/1996-152-0x000000001B880000-0x000000001BB7F000-memory.dmp

Filesize
3.0MB

Download
memory/1996-128-0x0000000002924000-0x0000000002927000-memory.dmp

Filesize
12KB

Download
memory/1996-114-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/1996-126-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/2016-181-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/2016-155-0x000000001B870000-0x000000001BB6F000-memory.dmp

Filesize
3.0MB

Download
memory/2016-180-0x00000000029AB000-0x00000000029CA000-memory.dmp

Filesize
124KB

Download
memory/2016-164-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/2016-137-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/2016-122-0x000007FEEA270000-0x000007FEEAC93000-memory.dmp

Filesize
10.1MB

Download
memory/2016-144-0x000007FEE9710000-0x000007FEEA26D000-memory.dmp

Filesize
11.4MB

Download
memory/2220-139-0x0000000000970000-0x0000000000982000-memory.dmp

Filesize
72KB

Download
memory/2220-118-0x00000000013C0000-0x00000000016B0000-memory.dmp

Filesize
2.9MB

Download
memory/2220-140-0x0000000000A50000-0x0000000000AA6000-memory.dmp

Filesize
344KB

Download
memory/2220-141-0x00000000009C0000-0x00000000009D2000-memory.dmp

Filesize
72KB

Download