dcrat | 567e51d04882051f17bd3731d594f8b4170034d07fb1e86bc9efb2f3c6c4fcae

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/12/2022, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83.exe
Size

2.0MB
MD5

8468c0223b7665174d19866d33ae9731
SHA1

b261b25063f61b7194310d62912596df732ebbb7
SHA256

915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83
SHA512

77397cc18ba208256e9fc4ebd182a197f6fc2f71e17ae737b0ab3bfa8c09d3da6a3ae30076a1bfaea9bd4889402f5e897f3b751cf86e8e12fd59f85f48613eb6
SSDEEP

49152:ubA3j3+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKvK:ubdTHUxUoh1IF9gl2x

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	336	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	1636	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1636	schtasks.exe	30

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000014294-61.dat	dcrat
behavioral1/files/0x0006000000014294-64.dat	dcrat
behavioral1/files/0x0006000000014294-62.dat	dcrat
behavioral1/files/0x0006000000014294-60.dat	dcrat
behavioral1/memory/2004-65-0x0000000000C00000-0x0000000000DC0000-memory.dmp	dcrat
behavioral1/memory/3024-124-0x0000000000070000-0x0000000000230000-memory.dmp	dcrat
behavioral1/files/0x000700000001450c-123.dat	dcrat
behavioral1/files/0x000700000001450c-122.dat	dcrat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	SurrogateDll.exe

Executes dropped EXE 2 IoCs

pid	Process
2004	SurrogateDll.exe
3024	Idle.exe

Loads dropped DLL 2 IoCs

pid	Process
1116	cmd.exe
1116	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\en-US\101b941d020240	SurrogateDll.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe	SurrogateDll.exe
File created	C:\Program Files\Windows Mail\en-US\lsm.exe	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\services.exe	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Mail\en-US\RCXE4D.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\RCX319B.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe	SurrogateDll.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\services.exe	SurrogateDll.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\886983d96e3d3e	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\RCXD22E.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX297.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX602.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Idle.exe	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\RCX3506.tmp	SurrogateDll.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\c5b4cb5e9653cc	SurrogateDll.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Idle.exe	SurrogateDll.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\6ccacd8608530f	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\RCXCEC3.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Mail\en-US\RCX11B7.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Mail\en-US\lsm.exe	SurrogateDll.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DigitalLocker\es-ES\winlogon.exe	SurrogateDll.exe
File created	C:\Windows\DigitalLocker\es-ES\winlogon.exe	SurrogateDll.exe
File created	C:\Windows\DigitalLocker\es-ES\cc11b995f2a76d	SurrogateDll.exe
File opened for modification	C:\Windows\DigitalLocker\es-ES\RCXDA78.tmp	SurrogateDll.exe
File opened for modification	C:\Windows\DigitalLocker\es-ES\RCXDDE3.tmp	SurrogateDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1928	schtasks.exe
1676	schtasks.exe
2036	schtasks.exe
900	schtasks.exe
2244	schtasks.exe
1660	schtasks.exe
2028	schtasks.exe
1668	schtasks.exe
2056	schtasks.exe
2224	schtasks.exe
1808	schtasks.exe
1796	schtasks.exe
336	schtasks.exe
1492	schtasks.exe
1168	schtasks.exe
1364	schtasks.exe
628	schtasks.exe
1876	schtasks.exe
976	schtasks.exe
1756	schtasks.exe
456	schtasks.exe
1568	schtasks.exe
752	schtasks.exe
752	schtasks.exe
1468	schtasks.exe
1728	schtasks.exe
2144	schtasks.exe
1544	schtasks.exe
2080	schtasks.exe
2264	schtasks.exe
1232	schtasks.exe
384	schtasks.exe
1704	schtasks.exe
1620	schtasks.exe
1192	schtasks.exe
1200	schtasks.exe
828	schtasks.exe
1060	schtasks.exe
1748	schtasks.exe
2012	schtasks.exe
1320	schtasks.exe
2096	schtasks.exe
1876	schtasks.exe
1972	schtasks.exe
1816	schtasks.exe
2124	schtasks.exe
2172	schtasks.exe
2196	schtasks.exe
1940	schtasks.exe
1320	schtasks.exe
1452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe
2004	SurrogateDll.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	SurrogateDll.exe
Token: SeDebugPrivilege	3024	Idle.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeBackupPrivilege	904	vssvc.exe
Token: SeRestorePrivilege	904	vssvc.exe
Token: SeAuditPrivilege	904	vssvc.exe
Token: SeDebugPrivilege	2516	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3024	Idle.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1144	1712	915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83.exe	26
PID 1712 wrote to memory of 1144	1712	915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83.exe	26
PID 1712 wrote to memory of 1144	1712	915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83.exe	26
PID 1712 wrote to memory of 1144	1712	915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83.exe	26
PID 1144 wrote to memory of 1116	1144	WScript.exe	27
PID 1144 wrote to memory of 1116	1144	WScript.exe	27
PID 1144 wrote to memory of 1116	1144	WScript.exe	27
PID 1144 wrote to memory of 1116	1144	WScript.exe	27
PID 1116 wrote to memory of 2004	1116	cmd.exe	29
PID 1116 wrote to memory of 2004	1116	cmd.exe	29
PID 1116 wrote to memory of 2004	1116	cmd.exe	29
PID 1116 wrote to memory of 2004	1116	cmd.exe	29
PID 2004 wrote to memory of 2296	2004	SurrogateDll.exe	82
PID 2004 wrote to memory of 2296	2004	SurrogateDll.exe	82
PID 2004 wrote to memory of 2296	2004	SurrogateDll.exe	82
PID 2004 wrote to memory of 2308	2004	SurrogateDll.exe	84
PID 2004 wrote to memory of 2308	2004	SurrogateDll.exe	84
PID 2004 wrote to memory of 2308	2004	SurrogateDll.exe	84
PID 2004 wrote to memory of 2328	2004	SurrogateDll.exe	85
PID 2004 wrote to memory of 2328	2004	SurrogateDll.exe	85
PID 2004 wrote to memory of 2328	2004	SurrogateDll.exe	85
PID 2004 wrote to memory of 2352	2004	SurrogateDll.exe	86
PID 2004 wrote to memory of 2352	2004	SurrogateDll.exe	86
PID 2004 wrote to memory of 2352	2004	SurrogateDll.exe	86
PID 2004 wrote to memory of 2372	2004	SurrogateDll.exe	89
PID 2004 wrote to memory of 2372	2004	SurrogateDll.exe	89
PID 2004 wrote to memory of 2372	2004	SurrogateDll.exe	89
PID 2004 wrote to memory of 2396	2004	SurrogateDll.exe	90
PID 2004 wrote to memory of 2396	2004	SurrogateDll.exe	90
PID 2004 wrote to memory of 2396	2004	SurrogateDll.exe	90
PID 2004 wrote to memory of 2420	2004	SurrogateDll.exe	92
PID 2004 wrote to memory of 2420	2004	SurrogateDll.exe	92
PID 2004 wrote to memory of 2420	2004	SurrogateDll.exe	92
PID 2004 wrote to memory of 2444	2004	SurrogateDll.exe	94
PID 2004 wrote to memory of 2444	2004	SurrogateDll.exe	94
PID 2004 wrote to memory of 2444	2004	SurrogateDll.exe	94
PID 2004 wrote to memory of 2468	2004	SurrogateDll.exe	96
PID 2004 wrote to memory of 2468	2004	SurrogateDll.exe	96
PID 2004 wrote to memory of 2468	2004	SurrogateDll.exe	96
PID 2004 wrote to memory of 2492	2004	SurrogateDll.exe	98
PID 2004 wrote to memory of 2492	2004	SurrogateDll.exe	98
PID 2004 wrote to memory of 2492	2004	SurrogateDll.exe	98
PID 2004 wrote to memory of 2516	2004	SurrogateDll.exe	100
PID 2004 wrote to memory of 2516	2004	SurrogateDll.exe	100
PID 2004 wrote to memory of 2516	2004	SurrogateDll.exe	100
PID 2004 wrote to memory of 2608	2004	SurrogateDll.exe	103
PID 2004 wrote to memory of 2608	2004	SurrogateDll.exe	103
PID 2004 wrote to memory of 2608	2004	SurrogateDll.exe	103
PID 2004 wrote to memory of 2704	2004	SurrogateDll.exe	105
PID 2004 wrote to memory of 2704	2004	SurrogateDll.exe	105
PID 2004 wrote to memory of 2704	2004	SurrogateDll.exe	105
PID 2004 wrote to memory of 3024	2004	SurrogateDll.exe	108
PID 2004 wrote to memory of 3024	2004	SurrogateDll.exe	108
PID 2004 wrote to memory of 3024	2004	SurrogateDll.exe	108
PID 3024 wrote to memory of 1188	3024	Idle.exe	109
PID 3024 wrote to memory of 1188	3024	Idle.exe	109
PID 3024 wrote to memory of 1188	3024	Idle.exe	109
PID 3024 wrote to memory of 2188	3024	Idle.exe	110
PID 3024 wrote to memory of 2188	3024	Idle.exe	110
PID 3024 wrote to memory of 2188	3024	Idle.exe	110

C:\Users\Admin\AppData\Local\Temp\915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83.exe
"C:\Users\Admin\AppData\Local\Temp\915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentBrowsersavesRefBroker\uC6xwKvnImSiiPHU7zpWHQ8u.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\agentBrowsersavesRefBroker\r205Pw8aNtR7tAq13alM.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\agentBrowsersavesRefBroker\SurrogateDll.exe
      "C:\agentBrowsersavesRefBroker\SurrogateDll.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/agentBrowsersavesRefBroker/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
    - - C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\Idle.exe
        
        "C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\Idle.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3024
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e6d9622-9fff-482a-9a46-7b92edec9387.vbs"
        6⤵
        
        PID:1188
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac29d1c2-1a8d-4f80-bf18-1be784471839.vbs"
        6⤵
        
        PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\agentBrowsersavesRefBroker\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\agentBrowsersavesRefBroker\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Templates\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Templates\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Templates\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\agentBrowsersavesRefBroker\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\agentBrowsersavesRefBroker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\DigitalLocker\es-ES\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\DigitalLocker\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\agentBrowsersavesRefBroker\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\agentBrowsersavesRefBroker\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\Temp\Crashpad\reports\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\reports\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\Temp\Crashpad\reports\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\agentBrowsersavesRefBroker\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\agentBrowsersavesRefBroker\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\en-US\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\en-US\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\en-US\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\agentBrowsersavesRefBroker\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\agentBrowsersavesRefBroker\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\agentBrowsersavesRefBroker\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\Idle.exe

Filesize
1.7MB

MD5
17fd782f84e9122375d5ac58c2d4006d

SHA1
4041fa874ef7e9dc68b5b1536b59691637b7754c

SHA256
c69eee2aed550400cc0860da4c03a86b9ff909efb70a70cd1adc7a4523715542

SHA512
236de9c8686db1286748a438c1435346e90f7fa378c7a326a7a8f3cec37dcc330be8097965b52b9938770e99e2191ef539f27f38a262348f420e5b98ac513932

Download Submit
C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\Idle.exe

Filesize
1.7MB

MD5
17fd782f84e9122375d5ac58c2d4006d

SHA1
4041fa874ef7e9dc68b5b1536b59691637b7754c

SHA256
c69eee2aed550400cc0860da4c03a86b9ff909efb70a70cd1adc7a4523715542

SHA512
236de9c8686db1286748a438c1435346e90f7fa378c7a326a7a8f3cec37dcc330be8097965b52b9938770e99e2191ef539f27f38a262348f420e5b98ac513932

Download Submit
C:\Users\Admin\AppData\Local\Temp\2e6d9622-9fff-482a-9a46-7b92edec9387.vbs

Filesize
733B

MD5
89c1ed5a044c595ec043321f6a5a56fa

SHA1
82fb352fc73fda1d83cb68b4db54bb9a43fc6710

SHA256
3ad2d9568446a7e05d04e215f85127c211342473ff4743ea0813fd376213a367

SHA512
41c97f8570612a9458de84214f4380f6e59e4186f797804ff2fe039caaa16190772aa9d5b4c8828f11aa2d94c2b3ff03d411c0840941ea5d2100ab19662c0af5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac29d1c2-1a8d-4f80-bf18-1be784471839.vbs

Filesize
509B

MD5
174a61518972d2c197326beeb82098b9

SHA1
05255b58c0fa2dcbe0844138b4d122bfce355c04

SHA256
0fa3db2fd1cdbca5ca8e2c982837b8936e5860034167ce235cb073c55367d4ac

SHA512
e16fe6b51f2062a92c67f0518399b2632d95b7d8baaf4715491a6dbc04083ff708cea42db27ab6adbf0980e476d8b11e1d4419110cb4ef10fb530d64c64acfad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6df163a7c860d56812eca27e820e25d7

SHA1
0427c1ba349622a4fa66c026015b57cc76e0d74c

SHA256
d95f6e584ccb1b93f364501eb5be45060d25470ba694d32394df82637ce84dab

SHA512
81137e56e23aa338332b8cfc60f7dcbf02218458eef6ee386b02ce55fe08e481c33f67b76772b53c1591bb6e09b3154fd9752695384a29e697c2fb3716c2aceb

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
fa982bede3552e226a6950a59fa9862b

SHA1
f0c2ca51c5c5a82028fff8757690594bde320ab7

SHA256
f4adc7f379298f2480544b0baae139e98fd93da4b0a8e12b47d35ef101671b72

SHA512
7c8afa2e1bbdcd36eaf2239ddce8dc46cd695a99b0c9b0b69030f6bc83d3b5a1133e609df4e7d19965b2543ed7ffd1ce29b11af1cb25b3e4b87520f82534c34d

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
fa982bede3552e226a6950a59fa9862b

SHA1
f0c2ca51c5c5a82028fff8757690594bde320ab7

SHA256
f4adc7f379298f2480544b0baae139e98fd93da4b0a8e12b47d35ef101671b72

SHA512
7c8afa2e1bbdcd36eaf2239ddce8dc46cd695a99b0c9b0b69030f6bc83d3b5a1133e609df4e7d19965b2543ed7ffd1ce29b11af1cb25b3e4b87520f82534c34d

Download Submit
C:\agentBrowsersavesRefBroker\r205Pw8aNtR7tAq13alM.bat

Filesize
48B

MD5
5bb1a4946c35c47dd502dfbcd6d3a3d7

SHA1
1e1e42c5996031e92e8314c45201ccbf1fa23607

SHA256
30921e7d9a89121e8d56de5182e7e487f8e02293e82e82c2c04a6a537150ef06

SHA512
87a63b9f407a21db0cc2d80e3b639833e5e9f790790a9fc69a65788b193af80e19717ac4dc449190cc69817b161aabaf4a9c338e8936c6907adf5c432f7156e1

Download Submit
C:\agentBrowsersavesRefBroker\uC6xwKvnImSiiPHU7zpWHQ8u.vbe

Filesize
223B

MD5
9403175bdfbadf333200b08d0f9a97e4

SHA1
c3383de367a292b0b2d12659468b7aa53985171d

SHA256
3185c369451bdae7ed017894d541c6957d5b583b4a31a8efd288cfe4ff457f87

SHA512
65ca9bdc7f0c2d9ddae0c2f6253386587f5e41fd0a1353a11c43c7352d6b218ad3b87160b536839f10bd2a6cd78d89053e77e3686284a5e66d7dd3ffd2176002

Download Submit
\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
fa982bede3552e226a6950a59fa9862b

SHA1
f0c2ca51c5c5a82028fff8757690594bde320ab7

SHA256
f4adc7f379298f2480544b0baae139e98fd93da4b0a8e12b47d35ef101671b72

SHA512
7c8afa2e1bbdcd36eaf2239ddce8dc46cd695a99b0c9b0b69030f6bc83d3b5a1133e609df4e7d19965b2543ed7ffd1ce29b11af1cb25b3e4b87520f82534c34d

Download Submit
\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
fa982bede3552e226a6950a59fa9862b

SHA1
f0c2ca51c5c5a82028fff8757690594bde320ab7

SHA256
f4adc7f379298f2480544b0baae139e98fd93da4b0a8e12b47d35ef101671b72

SHA512
7c8afa2e1bbdcd36eaf2239ddce8dc46cd695a99b0c9b0b69030f6bc83d3b5a1133e609df4e7d19965b2543ed7ffd1ce29b11af1cb25b3e4b87520f82534c34d

Download Submit
memory/1712-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/2004-81-0x000000001B096000-0x000000001B0B5000-memory.dmp

Filesize
124KB

Download
memory/2004-125-0x000000001B096000-0x000000001B0B5000-memory.dmp

Filesize
124KB

Download
memory/2004-65-0x0000000000C00000-0x0000000000DC0000-memory.dmp

Filesize
1.8MB

Download
memory/2004-66-0x0000000000160000-0x000000000017C000-memory.dmp

Filesize
112KB

Download
memory/2004-67-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/2004-68-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2004-79-0x0000000000A80000-0x0000000000A8C000-memory.dmp

Filesize
48KB

Download
memory/2004-78-0x0000000000A70000-0x0000000000A7C000-memory.dmp

Filesize
48KB

Download
memory/2004-69-0x0000000000190000-0x00000000001A6000-memory.dmp

Filesize
88KB

Download
memory/2004-77-0x0000000000A60000-0x0000000000A68000-memory.dmp

Filesize
32KB

Download
memory/2004-76-0x0000000000620000-0x000000000062E000-memory.dmp

Filesize
56KB

Download
memory/2004-75-0x0000000000610000-0x000000000061A000-memory.dmp

Filesize
40KB

Download
memory/2004-70-0x00000000003B0000-0x00000000003C0000-memory.dmp

Filesize
64KB

Download
memory/2004-80-0x000000001B096000-0x000000001B0B5000-memory.dmp

Filesize
124KB

Download
memory/2004-74-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/2004-73-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/2004-72-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/2004-71-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/2296-110-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2296-140-0x0000000002774000-0x0000000002777000-memory.dmp

Filesize
12KB

Download
memory/2296-153-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2296-166-0x000000000277B000-0x000000000279A000-memory.dmp

Filesize
124KB

Download
memory/2296-169-0x0000000002774000-0x0000000002777000-memory.dmp

Filesize
12KB

Download
memory/2296-170-0x000000000277B000-0x000000000279A000-memory.dmp

Filesize
124KB

Download
memory/2308-206-0x0000000002774000-0x0000000002777000-memory.dmp

Filesize
12KB

Download
memory/2308-134-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2308-141-0x0000000002774000-0x0000000002777000-memory.dmp

Filesize
12KB

Download
memory/2308-205-0x000000000277B000-0x000000000279A000-memory.dmp

Filesize
124KB

Download
memory/2308-179-0x000000001B9E0000-0x000000001BCDF000-memory.dmp

Filesize
3.0MB

Download
memory/2308-152-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2308-93-0x000007FEFC161000-0x000007FEFC163000-memory.dmp

Filesize
8KB

Download
memory/2328-199-0x00000000022F4000-0x00000000022F7000-memory.dmp

Filesize
12KB

Download
memory/2328-139-0x00000000022F4000-0x00000000022F7000-memory.dmp

Filesize
12KB

Download
memory/2328-99-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2328-183-0x000000001B760000-0x000000001BA5F000-memory.dmp

Filesize
3.0MB

Download
memory/2328-150-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2328-202-0x00000000022FB000-0x000000000231A000-memory.dmp

Filesize
124KB

Download
memory/2328-191-0x00000000022FB000-0x000000000231A000-memory.dmp

Filesize
124KB

Download
memory/2352-181-0x00000000022F4000-0x00000000022F7000-memory.dmp

Filesize
12KB

Download
memory/2352-186-0x00000000022FB000-0x000000000231A000-memory.dmp

Filesize
124KB

Download
memory/2352-157-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2352-133-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2352-148-0x00000000022F4000-0x00000000022F7000-memory.dmp

Filesize
12KB

Download
memory/2352-165-0x000000001B880000-0x000000001BB7F000-memory.dmp

Filesize
3.0MB

Download
memory/2352-172-0x00000000022FB000-0x000000000231A000-memory.dmp

Filesize
124KB

Download
memory/2372-159-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2372-195-0x000000000280B000-0x000000000282A000-memory.dmp

Filesize
124KB

Download
memory/2372-175-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

Filesize
3.0MB

Download
memory/2372-189-0x0000000002804000-0x0000000002807000-memory.dmp

Filesize
12KB

Download
memory/2372-146-0x0000000002804000-0x0000000002807000-memory.dmp

Filesize
12KB

Download
memory/2372-109-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2396-131-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2396-143-0x0000000002494000-0x0000000002497000-memory.dmp

Filesize
12KB

Download
memory/2396-177-0x000000001B750000-0x000000001BA4F000-memory.dmp

Filesize
3.0MB

Download
memory/2396-197-0x000000000249B000-0x00000000024BA000-memory.dmp

Filesize
124KB

Download
memory/2396-194-0x0000000002494000-0x0000000002497000-memory.dmp

Filesize
12KB

Download
memory/2396-160-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2420-161-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2420-145-0x0000000002814000-0x0000000002817000-memory.dmp

Filesize
12KB

Download
memory/2420-200-0x000000000281B000-0x000000000283A000-memory.dmp

Filesize
124KB

Download
memory/2420-203-0x0000000002814000-0x0000000002817000-memory.dmp

Filesize
12KB

Download
memory/2420-128-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2420-196-0x000000000281B000-0x000000000283A000-memory.dmp

Filesize
124KB

Download
memory/2444-137-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2444-147-0x0000000002934000-0x0000000002937000-memory.dmp

Filesize
12KB

Download
memory/2444-198-0x000000000293B000-0x000000000295A000-memory.dmp

Filesize
124KB

Download
memory/2444-155-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2444-201-0x000000000293B000-0x000000000295A000-memory.dmp

Filesize
124KB

Download
memory/2444-184-0x000000001B9A0000-0x000000001BC9F000-memory.dmp

Filesize
3.0MB

Download
memory/2444-204-0x0000000002934000-0x0000000002937000-memory.dmp

Filesize
12KB

Download
memory/2468-182-0x00000000027E4000-0x00000000027E7000-memory.dmp

Filesize
12KB

Download
memory/2468-144-0x00000000027E4000-0x00000000027E7000-memory.dmp

Filesize
12KB

Download
memory/2468-176-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/2468-190-0x00000000027EB000-0x000000000280A000-memory.dmp

Filesize
124KB

Download
memory/2468-130-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2468-164-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2492-154-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2492-193-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/2492-138-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2492-188-0x000000000253B000-0x000000000255A000-memory.dmp

Filesize
124KB

Download
memory/2492-149-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/2516-208-0x000007FEEC270000-0x000007FEECC93000-memory.dmp

Filesize
10.1MB

Download
memory/2516-209-0x000007FEEB710000-0x000007FEEC26D000-memory.dmp

Filesize
11.4MB

Download
memory/2608-187-0x0000000002944000-0x0000000002947000-memory.dmp

Filesize
12KB

Download
memory/2608-142-0x0000000002944000-0x0000000002947000-memory.dmp

Filesize
12KB

Download
memory/2608-151-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2608-132-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2608-174-0x000000000294B000-0x000000000296A000-memory.dmp

Filesize
124KB

Download
memory/2608-192-0x000000000294B000-0x000000000296A000-memory.dmp

Filesize
124KB

Download
memory/2608-167-0x000000001B9D0000-0x000000001BCCF000-memory.dmp

Filesize
3.0MB

Download
memory/2704-127-0x000007FEEB460000-0x000007FEEBE83000-memory.dmp

Filesize
10.1MB

Download
memory/2704-135-0x000007FEED9C0000-0x000007FEEE51D000-memory.dmp

Filesize
11.4MB

Download
memory/2704-173-0x000000000276B000-0x000000000278A000-memory.dmp

Filesize
124KB

Download
memory/2704-180-0x0000000002764000-0x0000000002767000-memory.dmp

Filesize
12KB

Download
memory/2704-168-0x000000001B840000-0x000000001BB3F000-memory.dmp

Filesize
3.0MB

Download
memory/2704-136-0x0000000002764000-0x0000000002767000-memory.dmp

Filesize
12KB

Download
memory/2704-185-0x000000000276B000-0x000000000278A000-memory.dmp

Filesize
124KB

Download
memory/3024-129-0x000000001B086000-0x000000001B0A5000-memory.dmp

Filesize
124KB

Download
memory/3024-126-0x000000001B086000-0x000000001B0A5000-memory.dmp

Filesize
124KB

Download
memory/3024-124-0x0000000000070000-0x0000000000230000-memory.dmp

Filesize
1.8MB

Download