dcrat | 51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2022 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exe
Size

2.0MB
MD5

fc9ea28a3c3659c4200e442d20198458
SHA1

79ede873cd08d5941e54524dd85b5add0a79bd7c
SHA256

51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0
SHA512

c2357a0eb6fd31929af57c544be2de14b0daee2a731ec09e586b0ac748b7368ae5a022d0d8dae0ccece0fa860799a0da02405f60d86a963e177508b5e4220a17
SSDEEP

49152:ubA3jVKbYcU6bWUfj4a7syRO2tzK/RNS/2t:ubjJXj4a4IKJYet

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	4376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	4376	schtasks.exe

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\agentBrowsersavesRefBroker\SurrogateDll.exe	dcrat
C:\agentBrowsersavesRefBroker\SurrogateDll.exe	dcrat
behavioral1/memory/3768-139-0x0000000000300000-0x00000000004C0000-memory.dmp	dcrat
C:\Program Files\Uninstall Information\lsass.exe	dcrat
C:\Program Files\Uninstall Information\lsass.exe	dcrat
behavioral1/memory/5928-219-0x0000000000DA0000-0x0000000000F60000-memory.dmp	dcrat

Drops file in Drivers directory 1 IoCs

Processes:

SurrogateDll.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts SurrogateDll.exe
Executes dropped EXE 2 IoCs

Processes:

SurrogateDll.exelsass.exe

pid process

3768 SurrogateDll.exe
5928 lsass.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	SurrogateDll.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exeWScript.exeSurrogateDll.exelsass.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	SurrogateDll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	lsass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 25 IoCs

Processes:

SurrogateDll.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office 15\ClientX64\services.exe	SurrogateDll.exe
File created	C:\Program Files (x86)\Windows Mail\ebf1f9fa8afd6d	SurrogateDll.exe
File created	C:\Program Files\Windows Mail\cmd.exe	SurrogateDll.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\services.exe	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\cmd.exe	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Mail\RCXCAEA.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Mail\cmd.exe	SurrogateDll.exe
File created	C:\Program Files\Uninstall Information\lsass.exe	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXBC4B.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Mail\RCXCB78.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXB503.tmp	SurrogateDll.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\c5b4cb5e9653cc	SurrogateDll.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\StartMenuExperienceHost.exe	SurrogateDll.exe
File created	C:\Program Files\Windows Mail\ebf1f9fa8afd6d	SurrogateDll.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXB196.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXB271.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Uninstall Information\lsass.exe	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCXBEDC.tmp	SurrogateDll.exe
File created	C:\Program Files\Uninstall Information\6203df4a6bafc7	SurrogateDll.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\55b276f4edf653	SurrogateDll.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXB590.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXBBAE.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCXBF5A.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\StartMenuExperienceHost.exe	SurrogateDll.exe
File created	C:\Program Files (x86)\Windows Mail\cmd.exe	SurrogateDll.exe

Drops file in Windows directory 10 IoCs

Processes:

SurrogateDll.exe

description	ioc	process
File created	C:\Windows\PolicyDefinitions\de-DE\c5b4cb5e9653cc	SurrogateDll.exe
File created	C:\Windows\Branding\shellbrd\5b884080fd4f94	SurrogateDll.exe
File opened for modification	C:\Windows\PolicyDefinitions\de-DE\services.exe	SurrogateDll.exe
File opened for modification	C:\Windows\Branding\shellbrd\RCXDDC2.tmp	SurrogateDll.exe
File created	C:\Windows\PolicyDefinitions\de-DE\services.exe	SurrogateDll.exe
File created	C:\Windows\Branding\shellbrd\fontdrvhost.exe	SurrogateDll.exe
File opened for modification	C:\Windows\PolicyDefinitions\de-DE\RCXDA15.tmp	SurrogateDll.exe
File opened for modification	C:\Windows\PolicyDefinitions\de-DE\RCXDAA3.tmp	SurrogateDll.exe
File opened for modification	C:\Windows\Branding\shellbrd\RCXDD34.tmp	SurrogateDll.exe
File opened for modification	C:\Windows\Branding\shellbrd\fontdrvhost.exe	SurrogateDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
3980	schtasks.exe
4084	schtasks.exe
3968	schtasks.exe
5036	schtasks.exe
4512	schtasks.exe
3292	schtasks.exe
2912	schtasks.exe
2132	schtasks.exe
1292	schtasks.exe
3884	schtasks.exe
3464	schtasks.exe
4920	schtasks.exe
1564	schtasks.exe
3436	schtasks.exe
4516	schtasks.exe
736	schtasks.exe
3828	schtasks.exe
2824	schtasks.exe
1640	schtasks.exe
2964	schtasks.exe
5076	schtasks.exe
3200	schtasks.exe
3944	schtasks.exe
1468	schtasks.exe
4148	schtasks.exe
2860	schtasks.exe
4848	schtasks.exe
2140	schtasks.exe
3552	schtasks.exe
4764	schtasks.exe
1244	schtasks.exe
3392	schtasks.exe
3484	schtasks.exe
1996	schtasks.exe
4888	schtasks.exe
3136	schtasks.exe
2988	schtasks.exe
1692	schtasks.exe
4676	schtasks.exe
4880	schtasks.exe
1976	schtasks.exe
1296	schtasks.exe
4756	schtasks.exe
3992	schtasks.exe
5048	schtasks.exe
440	schtasks.exe
1376	schtasks.exe
2832	schtasks.exe

Modifies registry class 3 IoCs

Processes:

51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exeSurrogateDll.exelsass.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	SurrogateDll.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	lsass.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

SurrogateDll.exe

pid	process
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe
3768	SurrogateDll.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

SurrogateDll.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exelsass.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3768	SurrogateDll.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	5928	lsass.exe
Token: SeBackupPrivilege	5036	vssvc.exe
Token: SeRestorePrivilege	5036	vssvc.exe
Token: SeAuditPrivilege	5036	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

lsass.exe

pid process

5928 lsass.exe

pid	process
5928	lsass.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exeWScript.execmd.exeSurrogateDll.execmd.exelsass.exe

description	pid	process	target process
PID 432 wrote to memory of 3196	432	51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exe	WScript.exe
PID 432 wrote to memory of 3196	432	51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exe	WScript.exe
PID 432 wrote to memory of 3196	432	51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exe	WScript.exe
PID 3196 wrote to memory of 1408	3196	WScript.exe	cmd.exe
PID 3196 wrote to memory of 1408	3196	WScript.exe	cmd.exe
PID 3196 wrote to memory of 1408	3196	WScript.exe	cmd.exe
PID 1408 wrote to memory of 3768	1408	cmd.exe	SurrogateDll.exe
PID 1408 wrote to memory of 3768	1408	cmd.exe	SurrogateDll.exe
PID 3768 wrote to memory of 4188	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 4188	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 2780	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 2780	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 2200	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 2200	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 1552	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 1552	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 1380	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 1380	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 3928	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 3928	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 4992	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 4992	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 1276	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 1276	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 3580	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 3580	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 2140	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 2140	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 4512	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 4512	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 3224	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 3224	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 1376	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 1376	3768	SurrogateDll.exe	powershell.exe
PID 3768 wrote to memory of 4636	3768	SurrogateDll.exe	cmd.exe
PID 3768 wrote to memory of 4636	3768	SurrogateDll.exe	cmd.exe
PID 4636 wrote to memory of 5480	4636	cmd.exe	w32tm.exe
PID 4636 wrote to memory of 5480	4636	cmd.exe	w32tm.exe
PID 4636 wrote to memory of 5928	4636	cmd.exe	lsass.exe
PID 4636 wrote to memory of 5928	4636	cmd.exe	lsass.exe
PID 5928 wrote to memory of 4520	5928	lsass.exe	WScript.exe
PID 5928 wrote to memory of 4520	5928	lsass.exe	WScript.exe
PID 5928 wrote to memory of 2236	5928	lsass.exe	WScript.exe
PID 5928 wrote to memory of 2236	5928	lsass.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exe
"C:\Users\Admin\AppData\Local\Temp\51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentBrowsersavesRefBroker\metokn3Gpa5i.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\agentBrowsersavesRefBroker\DYj6G9.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\agentBrowsersavesRefBroker\SurrogateDll.exe
      "C:\agentBrowsersavesRefBroker\SurrogateDll.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F4ETv4icGp.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4636
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5480
      - C:\Program Files\Uninstall Information\lsass.exe
        
        "C:\Program Files\Uninstall Information\lsass.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75ef714f-f92a-4fdf-a5d9-58232268182b.vbs"
        7⤵
        
        PID:4520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\902a2dc3-c1fc-449a-b6d5-60cfb1f13c7b.vbs"
        7⤵
        
        PID:2236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/agentBrowsersavesRefBroker/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\odt\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\odt\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\odt\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\agentBrowsersavesRefBroker\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\agentBrowsersavesRefBroker\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\agentBrowsersavesRefBroker\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\agentBrowsersavesRefBroker\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\agentBrowsersavesRefBroker\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\agentBrowsersavesRefBroker\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\PolicyDefinitions\de-DE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Windows\PolicyDefinitions\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\Branding\shellbrd\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Branding\shellbrd\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\Branding\shellbrd\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Uninstall Information\lsass.exe

Filesize
1.7MB

MD5
95d14b398ccb82f07b4906258806b615

SHA1
7f630424172e61a6f1a2ccecf7d38a18436adc1c

SHA256
d5cba1490b45fc102231fb1ff32dbf07d83ae7b0a1fe302a915f7c03ba8e8a1e

SHA512
08e26f47edc0af1ec27ea51b8ed1bcc612ce4e1cbff24874bac5ea1ffadbe92c8282f0e1d37cfbdd6e065e2063add09eb8c47fd476e817a20d0a24f1c19a0bdd

Download Submit
C:\Program Files\Uninstall Information\lsass.exe

Filesize
1.7MB

MD5
95d14b398ccb82f07b4906258806b615

SHA1
7f630424172e61a6f1a2ccecf7d38a18436adc1c

SHA256
d5cba1490b45fc102231fb1ff32dbf07d83ae7b0a1fe302a915f7c03ba8e8a1e

SHA512
08e26f47edc0af1ec27ea51b8ed1bcc612ce4e1cbff24874bac5ea1ffadbe92c8282f0e1d37cfbdd6e065e2063add09eb8c47fd476e817a20d0a24f1c19a0bdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
101c3b86ef1c02c62b7d862c2a47363b

SHA1
3c5e8d309610e5ba41b6b9788bfb826e45864b46

SHA256
9174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c

SHA512
d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\75ef714f-f92a-4fdf-a5d9-58232268182b.vbs

Filesize
724B

MD5
87248b2ded4fd367245e5b8a4d84a4b5

SHA1
ac2ad7d654c3652881a5fa60ac74249afbdf8f5a

SHA256
a96d1e7bfc78f83d6b354fd20ca7b3327a60ff1de89e01e4fa01fb6914f77bd9

SHA512
8ec88b977cc4a999743f4c3ccaf654e98d9968a3dcc598dd81ef4f81d1c835dd778aa0712406efa673a2ef1795b64269b4778d1dc9b8e8447746f9c0d5a7c32f

Download Submit
C:\Users\Admin\AppData\Local\Temp\902a2dc3-c1fc-449a-b6d5-60cfb1f13c7b.vbs

Filesize
500B

MD5
e76a552ba37678787d07a777942e1bb0

SHA1
39f43dedd6063a9da9b609fa82f300ad4f10a5af

SHA256
3d4265aecaf49db3ccb02d1d652ebc686ba5b5ef73004b3388d03f2c2ace7790

SHA512
22545e4dad97cb0a9d6b18f9ce55a0c50231943f103353a36c4899a1c97205b54e9b359fd5516b8a86afc07378125f6a387b27647749ddeeaec583313482c73b

Download Submit
C:\Users\Admin\AppData\Local\Temp\F4ETv4icGp.bat

Filesize
213B

MD5
bf227968243c743f34e80813fb300782

SHA1
439719ff74d476a7bae12643800913ffe527825e

SHA256
6b7c240945f877de773f12d4418769f7fbc7a7c9086961d1dbc5cb9622c32192

SHA512
3bfcaee0d2ebef78d259e84aa4bd4729060761a2e4043e6b0351f5247a964e1bc439590ee90f91c6a2e47b3f43135b8fb6396f849c15e558c9a6ba39b44a4df5

Download Submit
C:\agentBrowsersavesRefBroker\DYj6G9.bat

Filesize
48B

MD5
5bb1a4946c35c47dd502dfbcd6d3a3d7

SHA1
1e1e42c5996031e92e8314c45201ccbf1fa23607

SHA256
30921e7d9a89121e8d56de5182e7e487f8e02293e82e82c2c04a6a537150ef06

SHA512
87a63b9f407a21db0cc2d80e3b639833e5e9f790790a9fc69a65788b193af80e19717ac4dc449190cc69817b161aabaf4a9c338e8936c6907adf5c432f7156e1

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\agentBrowsersavesRefBroker\metokn3Gpa5i.vbe

Filesize
209B

MD5
22bdc192d231db2480148ba60871353b

SHA1
511712d83287343407b489ffbba56f1543062496

SHA256
442844f37559614e588adbd17a56c93e76687efdc6757a8aa0510e87b5a9fd22

SHA512
b7f044b2e707f474d7b5cba6fd4dd484debd04a7f7a80b81d81a1a9b49c8f85746804f5382770b338bdaf2471b09734deb5b0fdf30daa82e610435418866e444

Download Submit
memory/1276-160-0x0000000000000000-mapping.dmp

Download
memory/1276-183-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/1276-209-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/1376-188-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/1376-165-0x0000000000000000-mapping.dmp

Download
memory/1376-190-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/1380-179-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/1380-205-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/1380-157-0x0000000000000000-mapping.dmp

Download
memory/1408-135-0x0000000000000000-mapping.dmp

Download
memory/1552-169-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/1552-156-0x0000000000000000-mapping.dmp

Download
memory/1552-202-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/2140-185-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/2140-206-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/2140-162-0x0000000000000000-mapping.dmp

Download
memory/2200-204-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-155-0x0000000000000000-mapping.dmp

Download
memory/2200-174-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/2236-222-0x0000000000000000-mapping.dmp

Download
memory/2780-178-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/2780-207-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/2780-154-0x0000000000000000-mapping.dmp

Download
memory/3196-132-0x0000000000000000-mapping.dmp

Download
memory/3224-212-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-164-0x0000000000000000-mapping.dmp

Download
memory/3224-186-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/3580-184-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/3580-215-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/3580-161-0x0000000000000000-mapping.dmp

Download
memory/3768-147-0x000000001B269000-0x000000001B26F000-memory.dmp

Filesize
24KB

Download
memory/3768-143-0x000000001B269000-0x000000001B26F000-memory.dmp

Filesize
24KB

Download
memory/3768-136-0x0000000000000000-mapping.dmp

Download
memory/3768-171-0x000000001B269000-0x000000001B26F000-memory.dmp

Filesize
24KB

Download
memory/3768-139-0x0000000000300000-0x00000000004C0000-memory.dmp

Filesize
1.8MB

Download
memory/3768-140-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/3768-141-0x000000001C4F0000-0x000000001C540000-memory.dmp

Filesize
320KB

Download
memory/3768-142-0x000000001CA70000-0x000000001CF98000-memory.dmp

Filesize
5.2MB

Download
memory/3768-170-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/3768-144-0x000000001D6A0000-0x000000001D6A4000-memory.dmp

Filesize
16KB

Download
memory/3768-145-0x000000001D6A4000-0x000000001D6B5000-memory.dmp

Filesize
68KB

Download
memory/3768-146-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/3768-172-0x000000001D6A0000-0x000000001D6A4000-memory.dmp

Filesize
16KB

Download
memory/3768-176-0x000000001D6B5000-0x000000001D6B8000-memory.dmp

Filesize
12KB

Download
memory/3768-148-0x000000001D6B5000-0x000000001D6B8000-memory.dmp

Filesize
12KB

Download
memory/3768-149-0x000000001D6B8000-0x000000001D6BD000-memory.dmp

Filesize
20KB

Download
memory/3768-152-0x000000001B265000-0x000000001B26E000-memory.dmp

Filesize
36KB

Download
memory/3768-175-0x000000001D6B8000-0x000000001D6BD000-memory.dmp

Filesize
20KB

Download
memory/3768-151-0x000000001D6A4000-0x000000001D6B5000-memory.dmp

Filesize
68KB

Download
memory/3768-177-0x000000001B265000-0x000000001B26E000-memory.dmp

Filesize
36KB

Download
memory/3768-173-0x000000001D6A4000-0x000000001D6B5000-memory.dmp

Filesize
68KB

Download
memory/3768-150-0x000000001D6A0000-0x000000001D6A4000-memory.dmp

Filesize
16KB

Download
memory/3928-200-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/3928-158-0x0000000000000000-mapping.dmp

Download
memory/3928-180-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/4188-168-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/4188-153-0x0000000000000000-mapping.dmp

Download
memory/4188-193-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/4188-166-0x00000231A9190000-0x00000231A91B2000-memory.dmp

Filesize
136KB

Download
memory/4512-189-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/4512-163-0x0000000000000000-mapping.dmp

Download
memory/4512-214-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/4520-221-0x0000000000000000-mapping.dmp

Download
memory/4636-167-0x0000000000000000-mapping.dmp

Download
memory/4992-159-0x0000000000000000-mapping.dmp

Download
memory/4992-201-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/4992-181-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/5480-187-0x0000000000000000-mapping.dmp

Download
memory/5928-216-0x0000000000000000-mapping.dmp

Download
memory/5928-219-0x0000000000DA0000-0x0000000000F60000-memory.dmp

Filesize
1.8MB

Download
memory/5928-220-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download
memory/5928-225-0x00007FFA11AE0000-0x00007FFA125A1000-memory.dmp

Filesize
10.8MB

Download