dcrat | bfe4b2b5b1b9c2e8253848be27b277f1daf99314ff0ac964dc595bdef841a6c3

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2023 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ou6mS40OHrkbwQiM7ccaR.exe
Size

2.4MB
MD5

4ceeb0d068653ada01e702ba61dfdb7f
SHA1

0e09a416c381e657f39af975f259d09da0324300
SHA256

bfe4b2b5b1b9c2e8253848be27b277f1daf99314ff0ac964dc595bdef841a6c3
SHA512

798904e3ef1ef5f898185577c2dc15dd8872f4e70f638f8f94f90846ac11eecbad72d843406512863d58a882df8ad40c02ad2d9daa6289f3c46fff724f5f1b73
SSDEEP

24576:1RNpngHRc5DYZYLUsZ9p48N41XMFBDeQzC/tqELdO0U7TBd1X/SQOvjASm:PPDvx94V0eQuPdmJdV/J

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	3836	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	3836	schtasks.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Ou6mS40OHrkbwQiM7ccaR.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/4812-132-0x0000000000E70000-0x00000000010DA000-memory.dmp	dcrat
C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe	dcrat
C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe	dcrat
behavioral2/memory/1840-185-0x0000000000450000-0x00000000006BA000-memory.dmp	dcrat
C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\15c9dfd8ccab6e2cb03ae40d43789cc77d2bdbb3.exe	dcrat
C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\15c9dfd8ccab6e2cb03ae40d43789cc77d2bdbb3.exe	dcrat

Executes dropped EXE 3 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe

pid process

1840 winlogon.exe
4192 winlogon.exe
1096 winlogon.exe

pid	process
1840	winlogon.exe
4192	winlogon.exe
1096	winlogon.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Ou6mS40OHrkbwQiM7ccaR.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Ou6mS40OHrkbwQiM7ccaR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	winlogon.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Ou6mS40OHrkbwQiM7ccaR.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ou6mS40OHrkbwQiM7ccaR.exe

Drops file in Program Files directory 16 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\dllhost.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\69ddcba757bf72	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\7-Zip\Lang\5940a34987c991	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\RCXA74.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\cc11b995f2a76d	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\smss.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RCXD15.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RCX1237.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\cc11b995f2a76d	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCX7E2.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\dllhost.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\smss.exe	Ou6mS40OHrkbwQiM7ccaR.exe

Drops file in Windows directory 1 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.exe

description ioc process

File created C:\Windows\OCR\en-us\Registry.exe Ou6mS40OHrkbwQiM7ccaR.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\OCR\en-us\Registry.exe	Ou6mS40OHrkbwQiM7ccaR.exe

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
2988	schtasks.exe
5024	schtasks.exe
1764	schtasks.exe
1904	schtasks.exe
4648	schtasks.exe
4712	schtasks.exe
3720	schtasks.exe
3728	schtasks.exe
4012	schtasks.exe
4588	schtasks.exe
5068	schtasks.exe
5084	schtasks.exe
4776	schtasks.exe
216	schtasks.exe
64	schtasks.exe
2156	schtasks.exe
4560	schtasks.exe
1072	schtasks.exe
1356	schtasks.exe
368	schtasks.exe
5036	schtasks.exe
4524	schtasks.exe
1740	schtasks.exe
1824	schtasks.exe

Modifies registry class 4 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Ou6mS40OHrkbwQiM7ccaR.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinlogon.exe

pid	process
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
536	powershell.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
4812	Ou6mS40OHrkbwQiM7ccaR.exe
3876	powershell.exe
3876	powershell.exe
3992	powershell.exe
3992	powershell.exe
4732	powershell.exe
4732	powershell.exe
536	powershell.exe
536	powershell.exe
540	powershell.exe
540	powershell.exe
3236	powershell.exe
3236	powershell.exe
4260	powershell.exe
4260	powershell.exe
476	powershell.exe
476	powershell.exe
540	powershell.exe
4384	powershell.exe
4384	powershell.exe
3876	powershell.exe
3992	powershell.exe
4732	powershell.exe
3236	powershell.exe
4260	powershell.exe
476	powershell.exe
4384	powershell.exe
1840	winlogon.exe
1840	winlogon.exe
1840	winlogon.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinlogon.exewinlogon.exewinlogon.exe

description	pid	process
Token: SeDebugPrivilege	4812	Ou6mS40OHrkbwQiM7ccaR.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	3992	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	476	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	1840	winlogon.exe
Token: SeDebugPrivilege	4192	winlogon.exe
Token: SeDebugPrivilege	1096	winlogon.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.execmd.exewinlogon.exeWScript.exewinlogon.exeWScript.exewinlogon.exe

description	pid	process	target process
PID 4812 wrote to memory of 3876	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 3876	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 536	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 536	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 4732	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 4732	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 3992	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 3992	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 540	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 540	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 4260	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 4260	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 3236	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 3236	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 4384	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 4384	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 476	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 476	4812	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 4812 wrote to memory of 1976	4812	Ou6mS40OHrkbwQiM7ccaR.exe	cmd.exe
PID 4812 wrote to memory of 1976	4812	Ou6mS40OHrkbwQiM7ccaR.exe	cmd.exe
PID 1976 wrote to memory of 2116	1976	cmd.exe	w32tm.exe
PID 1976 wrote to memory of 2116	1976	cmd.exe	w32tm.exe
PID 1976 wrote to memory of 1840	1976	cmd.exe	winlogon.exe
PID 1976 wrote to memory of 1840	1976	cmd.exe	winlogon.exe
PID 1840 wrote to memory of 620	1840	winlogon.exe	WScript.exe
PID 1840 wrote to memory of 620	1840	winlogon.exe	WScript.exe
PID 1840 wrote to memory of 4860	1840	winlogon.exe	WScript.exe
PID 1840 wrote to memory of 4860	1840	winlogon.exe	WScript.exe
PID 620 wrote to memory of 4192	620	WScript.exe	winlogon.exe
PID 620 wrote to memory of 4192	620	WScript.exe	winlogon.exe
PID 4192 wrote to memory of 4752	4192	winlogon.exe	WScript.exe
PID 4192 wrote to memory of 4752	4192	winlogon.exe	WScript.exe
PID 4192 wrote to memory of 440	4192	winlogon.exe	WScript.exe
PID 4192 wrote to memory of 440	4192	winlogon.exe	WScript.exe
PID 4752 wrote to memory of 1096	4752	WScript.exe	winlogon.exe
PID 4752 wrote to memory of 1096	4752	WScript.exe	winlogon.exe
PID 1096 wrote to memory of 1664	1096	winlogon.exe	WScript.exe
PID 1096 wrote to memory of 1664	1096	winlogon.exe	WScript.exe
PID 1096 wrote to memory of 2156	1096	winlogon.exe	WScript.exe
PID 1096 wrote to memory of 2156	1096	winlogon.exe	WScript.exe

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

Processes:

winlogon.exewinlogon.exewinlogon.exeOu6mS40OHrkbwQiM7ccaR.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\Ou6mS40OHrkbwQiM7ccaR.exe
"C:\Users\Admin\AppData\Local\Temp\Ou6mS40OHrkbwQiM7ccaR.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ou6mS40OHrkbwQiM7ccaR.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\dllhost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\wininit.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\spoolsv.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\smss.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Ou6mS40OHrkbwQiM7ccaR.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:476

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YVE9kokZMl.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:2116

C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe
"C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1840

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f80b9efa-4b52-4553-b469-1f60c251602d.vbs"
4⤵
- Suspicious use of WriteProcessMemory
PID:620

C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe
"C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe"
5⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4192

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\492e4384-0f57-402b-bb73-ff1dd2a4e75e.vbs"
6⤵
- Suspicious use of WriteProcessMemory
PID:4752

C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe
"C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe"
7⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1096

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15e201f3-62cb-4993-b873-3ca0ff5b0bb1.vbs"
8⤵
PID:2156

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1179f5b3-4604-41e5-96f7-945a98e5e6d5.vbs"
8⤵
PID:1664

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4eae88c4-20ec-4f96-834e-ce0aca3f6a10.vbs"
6⤵
PID:440

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89bd1acc-1f2b-458e-b8b2-93adb5894a87.vbs"
4⤵
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\odt\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ou6mS40OHrkbwQiM7ccaRO" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Ou6mS40OHrkbwQiM7ccaR.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ou6mS40OHrkbwQiM7ccaR" /sc ONLOGON /tr "'C:\Users\Default User\Ou6mS40OHrkbwQiM7ccaR.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ou6mS40OHrkbwQiM7ccaRO" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Ou6mS40OHrkbwQiM7ccaR.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe
Filesize
2.4MB

MD5
bf9b02ce0248f4b3f2ae04e291002cdb

SHA1
95f39f73bbb291cd43e076dc2815db506e5f2702

SHA256
e6c57097e4c9ef5e46ba626c0257dc24b756bd8aed5fb16c1dba6bf9729d4a52

SHA512
b40ef6d0ca160be0688cac7b287f9f3626d52b86b1421fc5fd6dd3862abbf337f702290e984901e45597d41bf895ce863406d023d8605d3f27e24e0a6bfbd8c1

Download Submit
C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe
Filesize
2.4MB

MD5
bf9b02ce0248f4b3f2ae04e291002cdb

SHA1
95f39f73bbb291cd43e076dc2815db506e5f2702

SHA256
e6c57097e4c9ef5e46ba626c0257dc24b756bd8aed5fb16c1dba6bf9729d4a52

SHA512
b40ef6d0ca160be0688cac7b287f9f3626d52b86b1421fc5fd6dd3862abbf337f702290e984901e45597d41bf895ce863406d023d8605d3f27e24e0a6bfbd8c1

Download Submit
C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe
Filesize
2.4MB

MD5
bf9b02ce0248f4b3f2ae04e291002cdb

SHA1
95f39f73bbb291cd43e076dc2815db506e5f2702

SHA256
e6c57097e4c9ef5e46ba626c0257dc24b756bd8aed5fb16c1dba6bf9729d4a52

SHA512
b40ef6d0ca160be0688cac7b287f9f3626d52b86b1421fc5fd6dd3862abbf337f702290e984901e45597d41bf895ce863406d023d8605d3f27e24e0a6bfbd8c1

Download Submit
C:\Program Files\Windows NT\Accessories\en-US\winlogon.exe
Filesize
2.4MB

MD5
bf9b02ce0248f4b3f2ae04e291002cdb

SHA1
95f39f73bbb291cd43e076dc2815db506e5f2702

SHA256
e6c57097e4c9ef5e46ba626c0257dc24b756bd8aed5fb16c1dba6bf9729d4a52

SHA512
b40ef6d0ca160be0688cac7b287f9f3626d52b86b1421fc5fd6dd3862abbf337f702290e984901e45597d41bf895ce863406d023d8605d3f27e24e0a6bfbd8c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log
Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\1179f5b3-4604-41e5-96f7-945a98e5e6d5.vbs
Filesize
734B

MD5
d4808fd0eaee814ef7346547eacc339c

SHA1
ab1b8210c116330878ce53cc90149154d50f796a

SHA256
8390b9f53bbb7adaf2285b093a22edb278743daf90c7cc21060d6d9757268d87

SHA512
4522a87a4ae736833732e5752b49d3da812a763ef2e4ed943156abbdadc5dad35be26f9fe08506ab4924dbb8cb7680b19e263a353f786d944bf965e087ff5751

Download Submit
C:\Users\Admin\AppData\Local\Temp\15c9dfd8ccab6e2cb03ae40d43789cc77d2bdbb3.exe
Filesize
2.4MB

MD5
bf9b02ce0248f4b3f2ae04e291002cdb

SHA1
95f39f73bbb291cd43e076dc2815db506e5f2702

SHA256
e6c57097e4c9ef5e46ba626c0257dc24b756bd8aed5fb16c1dba6bf9729d4a52

SHA512
b40ef6d0ca160be0688cac7b287f9f3626d52b86b1421fc5fd6dd3862abbf337f702290e984901e45597d41bf895ce863406d023d8605d3f27e24e0a6bfbd8c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\15c9dfd8ccab6e2cb03ae40d43789cc77d2bdbb3.exe
Filesize
2.4MB

MD5
bf9b02ce0248f4b3f2ae04e291002cdb

SHA1
95f39f73bbb291cd43e076dc2815db506e5f2702

SHA256
e6c57097e4c9ef5e46ba626c0257dc24b756bd8aed5fb16c1dba6bf9729d4a52

SHA512
b40ef6d0ca160be0688cac7b287f9f3626d52b86b1421fc5fd6dd3862abbf337f702290e984901e45597d41bf895ce863406d023d8605d3f27e24e0a6bfbd8c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\15e201f3-62cb-4993-b873-3ca0ff5b0bb1.vbs
Filesize
510B

MD5
feba2dd4924f4a83e5c3b75ec2b6063d

SHA1
1400b2f5f5fe90a6be1c2e6705b68f092640d98c

SHA256
a0929718217e0a252eede4fa7e63dca01b552248fd28716b59a84708f462eaa2

SHA512
813b487063aa2061513fd0a879f9453db430b626015fa478c909180b1ecc269fc563d8d55b16db1ec39c41df22dc8d9eb136ee14445ed19fde997223c2b69a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\492e4384-0f57-402b-bb73-ff1dd2a4e75e.vbs
Filesize
734B

MD5
242b61df08c9ab61c5eaed52c2fdedd2

SHA1
84111a55b6562339e969cb7b66b1f50770766768

SHA256
772e9dc5a955049fa34a519efdb9156a5461d4cf051ee704d0b56ffebf728bd7

SHA512
48027ed15923d48f460de7caafd2d4a8142d2df90e97799f7359b83bf7b3b9ad4c9ce228333e90718af1db34b32548494a1a81cff78e1ccfb4ae07fdbb2d004a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4eae88c4-20ec-4f96-834e-ce0aca3f6a10.vbs
Filesize
510B

MD5
feba2dd4924f4a83e5c3b75ec2b6063d

SHA1
1400b2f5f5fe90a6be1c2e6705b68f092640d98c

SHA256
a0929718217e0a252eede4fa7e63dca01b552248fd28716b59a84708f462eaa2

SHA512
813b487063aa2061513fd0a879f9453db430b626015fa478c909180b1ecc269fc563d8d55b16db1ec39c41df22dc8d9eb136ee14445ed19fde997223c2b69a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\89bd1acc-1f2b-458e-b8b2-93adb5894a87.vbs
Filesize
510B

MD5
feba2dd4924f4a83e5c3b75ec2b6063d

SHA1
1400b2f5f5fe90a6be1c2e6705b68f092640d98c

SHA256
a0929718217e0a252eede4fa7e63dca01b552248fd28716b59a84708f462eaa2

SHA512
813b487063aa2061513fd0a879f9453db430b626015fa478c909180b1ecc269fc563d8d55b16db1ec39c41df22dc8d9eb136ee14445ed19fde997223c2b69a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\YVE9kokZMl.bat
Filesize
223B

MD5
a88f1b6197bccfdf0bd1b527af184c2e

SHA1
87d35277dd874f7b91bc15221285efe612c1b9cd

SHA256
7f5847be522f832db067c365f2356d8e14280b2377fe0129d0ffe642acd79668

SHA512
a26fcb5ddcb090e0664c689a26bf01c89e2e40656ad42ada281c0d2ceaa55ca9c759b1130d80f9cfd3e8071f8bc7fb4bdc855468c8375b020491741f4461f0c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\f80b9efa-4b52-4553-b469-1f60c251602d.vbs
Filesize
734B

MD5
5b92913908c1ee77b3834816814c845b

SHA1
9480fd9b4ccb525b6d8cdff90dc608cfaaae9c49

SHA256
3cd8fc32e222b634297b95dd4479e8cffe9048a60fb32acd203fc5d452688669

SHA512
855da21ac3b1aac0e45d771d545c9665a54cecc879da5cbf8ddb121bcebedeb95d0e2caa69efe796d7de84295ec3ffcaf3c54687c7adcdda411b284daceae1f1

Download Submit
memory/440-207-0x0000000000000000-mapping.dmp

Download
memory/476-146-0x0000000000000000-mapping.dmp

Download
memory/476-161-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/476-175-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/536-139-0x0000000000000000-mapping.dmp

Download
memory/536-167-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/536-154-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/536-147-0x0000019B94910000-0x0000019B94932000-memory.dmp

Filesize
136KB

Download
memory/540-157-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/540-142-0x0000000000000000-mapping.dmp

Download
memory/540-166-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/620-188-0x0000000000000000-mapping.dmp

Download
memory/1096-228-0x000000001CFF0000-0x000000001D518000-memory.dmp

Filesize
5.2MB

Download
memory/1096-219-0x0000000000000000-mapping.dmp

Download
memory/1096-229-0x000000001CFF0000-0x000000001D518000-memory.dmp

Filesize
5.2MB

Download
memory/1096-221-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/1096-224-0x000000001B319000-0x000000001B31F000-memory.dmp

Filesize
24KB

Download
memory/1096-230-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/1664-222-0x0000000000000000-mapping.dmp

Download
memory/1840-193-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/1840-194-0x000000001CE80000-0x000000001D3A8000-memory.dmp

Filesize
5.2MB

Download
memory/1840-198-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/1840-199-0x0000000002709000-0x000000000270F000-memory.dmp

Filesize
24KB

Download
memory/1840-187-0x0000000002709000-0x000000000270F000-memory.dmp

Filesize
24KB

Download
memory/1840-197-0x000000001CE80000-0x000000001D3A8000-memory.dmp

Filesize
5.2MB

Download
memory/1840-186-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/1840-192-0x000000001CE80000-0x000000001D3A8000-memory.dmp

Filesize
5.2MB

Download
memory/1840-195-0x0000000002709000-0x000000000270F000-memory.dmp

Filesize
24KB

Download
memory/1840-182-0x0000000000000000-mapping.dmp

Download
memory/1840-196-0x000000001CE80000-0x000000001D3A8000-memory.dmp

Filesize
5.2MB

Download
memory/1840-185-0x0000000000450000-0x00000000006BA000-memory.dmp

Filesize
2.4MB

Download
memory/1976-148-0x0000000000000000-mapping.dmp

Download
memory/2116-163-0x0000000000000000-mapping.dmp

Download
memory/2156-225-0x0000000000000000-mapping.dmp

Download
memory/3236-174-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/3236-158-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/3236-144-0x0000000000000000-mapping.dmp

Download
memory/3876-178-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/3876-150-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/3876-138-0x0000000000000000-mapping.dmp

Download
memory/3992-156-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/3992-141-0x0000000000000000-mapping.dmp

Download
memory/3992-171-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4192-212-0x00000000026D9000-0x00000000026DF000-memory.dmp

Filesize
24KB

Download
memory/4192-210-0x000000001CD40000-0x000000001D268000-memory.dmp

Filesize
5.2MB

Download
memory/4192-200-0x0000000000000000-mapping.dmp

Download
memory/4192-214-0x000000001CD40000-0x000000001D268000-memory.dmp

Filesize
5.2MB

Download
memory/4192-218-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4192-203-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4192-204-0x00000000026D9000-0x00000000026DF000-memory.dmp

Filesize
24KB

Download
memory/4192-215-0x000000001CD40000-0x000000001D268000-memory.dmp

Filesize
5.2MB

Download
memory/4192-217-0x000000001CD40000-0x000000001D268000-memory.dmp

Filesize
5.2MB

Download
memory/4192-211-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4192-213-0x000000001CD40000-0x000000001D268000-memory.dmp

Filesize
5.2MB

Download
memory/4192-216-0x000000001CD40000-0x000000001D268000-memory.dmp

Filesize
5.2MB

Download
memory/4260-143-0x0000000000000000-mapping.dmp

Download
memory/4260-179-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4260-159-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4384-145-0x0000000000000000-mapping.dmp

Download
memory/4384-181-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4384-162-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4732-155-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4732-172-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4732-140-0x0000000000000000-mapping.dmp

Download
memory/4752-205-0x0000000000000000-mapping.dmp

Download
memory/4812-151-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4812-149-0x000000001EB74000-0x000000001EB77000-memory.dmp

Filesize
12KB

Download
memory/4812-153-0x000000001EB70000-0x000000001EB74000-memory.dmp

Filesize
16KB

Download
memory/4812-152-0x0000000003349000-0x000000000334F000-memory.dmp

Filesize
24KB

Download
memory/4812-132-0x0000000000E70000-0x00000000010DA000-memory.dmp

Filesize
2.4MB

Download
memory/4812-137-0x000000001EB70000-0x000000001EB74000-memory.dmp

Filesize
16KB

Download
memory/4812-136-0x0000000003349000-0x000000000334F000-memory.dmp

Filesize
24KB

Download
memory/4812-135-0x000000001DDF0000-0x000000001E318000-memory.dmp

Filesize
5.2MB

Download
memory/4812-134-0x00000000032F0000-0x0000000003340000-memory.dmp

Filesize
320KB

Download
memory/4812-133-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4860-189-0x0000000000000000-mapping.dmp

Download