dcrat | c17ee50458ad78fb43b23fd8001002cd35bb8effac19ec33091ddadefbc7dcac

Analysis

max time kernel
68s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06-06-2023 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

1.6MB
MD5

373992db74a918562686a9e9144ecbbe
SHA1

953c7daaec55cdf106b371b555bc73f83a127b26
SHA256

c17ee50458ad78fb43b23fd8001002cd35bb8effac19ec33091ddadefbc7dcac
SHA512

ddf9af3d9b765708ce9e91f1ba7631f4111202016deae60f0da80026688fd465e9877fe55ec175be0296db153e300188a5aeadd5566b2e72fc8cf0e1bb8a80e4
SSDEEP

24576:U2G/nvxW3Ww0t1urfikuV13mFFkwIuKOaZDIpw6P/KlBrJ/GB+8xNEJnw:UbA30Wiku13qF1jtpwG/KR/YxNEJw

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	336	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	612	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	652	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	928	schtasks.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe	dcrat
\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe	dcrat
\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe	dcrat
C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe	dcrat
behavioral1/memory/1656-67-0x0000000000DB0000-0x0000000000F04000-memory.dmp	dcrat
C:\Windows\ModemLogs\System.exe	dcrat
C:\Users\Default User\csrss.exe	dcrat
C:\Users\Default\csrss.exe	dcrat
behavioral1/memory/2608-211-0x0000000000D60000-0x0000000000EB4000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

Processes:

componentMonitorcommon.execsrss.exe

pid process

1656 componentMonitorcommon.exe
2608 csrss.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1160 cmd.exe
1160 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ipinfo.io
7 ipinfo.io

pid	process
1160	cmd.exe
1160	cmd.exe

flow	ioc
6	ipinfo.io
7	ipinfo.io

Drops file in Program Files directory 2 IoCs

Processes:

componentMonitorcommon.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe	componentMonitorcommon.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\7a0fd90576e088	componentMonitorcommon.exe

Drops file in Windows directory 5 IoCs

Processes:

componentMonitorcommon.exe

description	ioc	process
File opened for modification	C:\Windows\L2Schemas\conhost.exe	componentMonitorcommon.exe
File created	C:\Windows\L2Schemas\088424020bedd6	componentMonitorcommon.exe
File created	C:\Windows\ModemLogs\System.exe	componentMonitorcommon.exe
File created	C:\Windows\ModemLogs\27d1bcfc3c54e0	componentMonitorcommon.exe
File created	C:\Windows\L2Schemas\conhost.exe	componentMonitorcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1240	schtasks.exe
604	schtasks.exe
1572	schtasks.exe
284	schtasks.exe
1800	schtasks.exe
2000	schtasks.exe
1584	schtasks.exe
1664	schtasks.exe
1592	schtasks.exe
1264	schtasks.exe
1676	schtasks.exe
852	schtasks.exe
1148	schtasks.exe
1784	schtasks.exe
1708	schtasks.exe
612	schtasks.exe
1784	schtasks.exe
852	schtasks.exe
1940	schtasks.exe
1744	schtasks.exe
1636	schtasks.exe
1748	schtasks.exe
336	schtasks.exe
1960	schtasks.exe
680	schtasks.exe
1700	schtasks.exe
816	schtasks.exe
920	schtasks.exe
1236	schtasks.exe
560	schtasks.exe
512	schtasks.exe
1240	schtasks.exe
652	schtasks.exe
616	schtasks.exe
1556	schtasks.exe
1764	schtasks.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

csrss.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	csrss.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

componentMonitorcommon.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exe

pid	process
1656	componentMonitorcommon.exe
2056	powershell.exe
1984	powershell.exe
920	powershell.exe
1096	powershell.exe
1236	powershell.exe
1480	powershell.exe
1460	powershell.exe
2064	powershell.exe
588	powershell.exe
2080	powershell.exe
1720	powershell.exe
604	powershell.exe
2072	powershell.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe
2608	csrss.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	1656	componentMonitorcommon.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	604	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	2608	csrss.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

tmp.exeWScript.execmd.execomponentMonitorcommon.execmd.exe

description	pid	process	target process
PID 1052 wrote to memory of 756	1052	tmp.exe	WScript.exe
PID 1052 wrote to memory of 756	1052	tmp.exe	WScript.exe
PID 1052 wrote to memory of 756	1052	tmp.exe	WScript.exe
PID 1052 wrote to memory of 756	1052	tmp.exe	WScript.exe
PID 756 wrote to memory of 1160	756	WScript.exe	cmd.exe
PID 756 wrote to memory of 1160	756	WScript.exe	cmd.exe
PID 756 wrote to memory of 1160	756	WScript.exe	cmd.exe
PID 756 wrote to memory of 1160	756	WScript.exe	cmd.exe
PID 1160 wrote to memory of 1656	1160	cmd.exe	componentMonitorcommon.exe
PID 1160 wrote to memory of 1656	1160	cmd.exe	componentMonitorcommon.exe
PID 1160 wrote to memory of 1656	1160	cmd.exe	componentMonitorcommon.exe
PID 1160 wrote to memory of 1656	1160	cmd.exe	componentMonitorcommon.exe
PID 1656 wrote to memory of 1460	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1460	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1460	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 604	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 604	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 604	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 588	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 588	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 588	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1480	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1480	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1480	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1984	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1984	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1984	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1236	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1236	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1236	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1720	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1720	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1720	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1096	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1096	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 1096	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 920	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 920	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 920	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2056	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2056	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2056	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2064	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2064	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2064	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2072	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2072	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2072	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2080	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2080	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2080	1656	componentMonitorcommon.exe	powershell.exe
PID 1656 wrote to memory of 2252	1656	componentMonitorcommon.exe	cmd.exe
PID 1656 wrote to memory of 2252	1656	componentMonitorcommon.exe	cmd.exe
PID 1656 wrote to memory of 2252	1656	componentMonitorcommon.exe	cmd.exe
PID 2252 wrote to memory of 2780	2252	cmd.exe	w32tm.exe
PID 2252 wrote to memory of 2780	2252	cmd.exe	w32tm.exe
PID 2252 wrote to memory of 2780	2252	cmd.exe	w32tm.exe
PID 2252 wrote to memory of 2608	2252	cmd.exe	csrss.exe
PID 2252 wrote to memory of 2608	2252	cmd.exe	csrss.exe
PID 2252 wrote to memory of 2608	2252	cmd.exe	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\vQ3VIYUYL2xofTcP0gCIzAw.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\mQTPECbUX38DuLpdMmoUBOwQ.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160

C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe
"C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\conhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\services.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\System.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\csrss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Templates\WMIADAP.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\lsm.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\taskhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\spoolsv.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\dwm.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\dwm.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mMBZzEy8nT.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:2780

C:\Users\Default User\csrss.exe
"C:\Users\Default User\csrss.exe"
6⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\L2Schemas\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Recent\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Recent\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Recent\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\ModemLogs\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\ModemLogs\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\ModemLogs\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Users\Public\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Public\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\Public\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Templates\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Admin\Templates\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Templates\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Recovery\3c215342-b1b4-11ed-8beb-cee1c2fbb193\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9936.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B8E.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\mMBZzEy8nT.bat
Filesize
196B

MD5
fbd775dfad3d7e8136ee201bac66e56f

SHA1
e5af0a32610be81a391cac4ad0846834f466c61c

SHA256
bf81e451317b2325bf251e1a41b4524a5a228f85fc4f932df7aa9496fb2f2908

SHA512
23ff0947c8f6524665d4fcb5a2ed133838113bccd10ea41ab70d84ee38969f49f3673fcfa685a84140d7f91017702e6b691277581a8c81804101a0c04c67b0db

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7b6de6420ba223fced0239339abab7d8

SHA1
283e124f416923b0fb8e68062c15a579727ce48f

SHA256
9377ed71393807db0938073bfc27a6b0d9795e123b1408a033c1fd23c74b82eb

SHA512
d9d7fa0ef9e9972d9d5075bed1ba60e2eef4a9b12bdacba326acf23f97c29b2c51a110d9b27f1ba947bc1a565e28266204310b7b495cadbf60b5972854ec5032

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7b6de6420ba223fced0239339abab7d8

SHA1
283e124f416923b0fb8e68062c15a579727ce48f

SHA256
9377ed71393807db0938073bfc27a6b0d9795e123b1408a033c1fd23c74b82eb

SHA512
d9d7fa0ef9e9972d9d5075bed1ba60e2eef4a9b12bdacba326acf23f97c29b2c51a110d9b27f1ba947bc1a565e28266204310b7b495cadbf60b5972854ec5032

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7b6de6420ba223fced0239339abab7d8

SHA1
283e124f416923b0fb8e68062c15a579727ce48f

SHA256
9377ed71393807db0938073bfc27a6b0d9795e123b1408a033c1fd23c74b82eb

SHA512
d9d7fa0ef9e9972d9d5075bed1ba60e2eef4a9b12bdacba326acf23f97c29b2c51a110d9b27f1ba947bc1a565e28266204310b7b495cadbf60b5972854ec5032

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7b6de6420ba223fced0239339abab7d8

SHA1
283e124f416923b0fb8e68062c15a579727ce48f

SHA256
9377ed71393807db0938073bfc27a6b0d9795e123b1408a033c1fd23c74b82eb

SHA512
d9d7fa0ef9e9972d9d5075bed1ba60e2eef4a9b12bdacba326acf23f97c29b2c51a110d9b27f1ba947bc1a565e28266204310b7b495cadbf60b5972854ec5032

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7b6de6420ba223fced0239339abab7d8

SHA1
283e124f416923b0fb8e68062c15a579727ce48f

SHA256
9377ed71393807db0938073bfc27a6b0d9795e123b1408a033c1fd23c74b82eb

SHA512
d9d7fa0ef9e9972d9d5075bed1ba60e2eef4a9b12bdacba326acf23f97c29b2c51a110d9b27f1ba947bc1a565e28266204310b7b495cadbf60b5972854ec5032

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7b6de6420ba223fced0239339abab7d8

SHA1
283e124f416923b0fb8e68062c15a579727ce48f

SHA256
9377ed71393807db0938073bfc27a6b0d9795e123b1408a033c1fd23c74b82eb

SHA512
d9d7fa0ef9e9972d9d5075bed1ba60e2eef4a9b12bdacba326acf23f97c29b2c51a110d9b27f1ba947bc1a565e28266204310b7b495cadbf60b5972854ec5032

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7b6de6420ba223fced0239339abab7d8

SHA1
283e124f416923b0fb8e68062c15a579727ce48f

SHA256
9377ed71393807db0938073bfc27a6b0d9795e123b1408a033c1fd23c74b82eb

SHA512
d9d7fa0ef9e9972d9d5075bed1ba60e2eef4a9b12bdacba326acf23f97c29b2c51a110d9b27f1ba947bc1a565e28266204310b7b495cadbf60b5972854ec5032

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7b6de6420ba223fced0239339abab7d8

SHA1
283e124f416923b0fb8e68062c15a579727ce48f

SHA256
9377ed71393807db0938073bfc27a6b0d9795e123b1408a033c1fd23c74b82eb

SHA512
d9d7fa0ef9e9972d9d5075bed1ba60e2eef4a9b12bdacba326acf23f97c29b2c51a110d9b27f1ba947bc1a565e28266204310b7b495cadbf60b5972854ec5032

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7b6de6420ba223fced0239339abab7d8

SHA1
283e124f416923b0fb8e68062c15a579727ce48f

SHA256
9377ed71393807db0938073bfc27a6b0d9795e123b1408a033c1fd23c74b82eb

SHA512
d9d7fa0ef9e9972d9d5075bed1ba60e2eef4a9b12bdacba326acf23f97c29b2c51a110d9b27f1ba947bc1a565e28266204310b7b495cadbf60b5972854ec5032

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZXDB3JNBOCZ6CDEAZE1U.temp
Filesize
7KB

MD5
7b6de6420ba223fced0239339abab7d8

SHA1
283e124f416923b0fb8e68062c15a579727ce48f

SHA256
9377ed71393807db0938073bfc27a6b0d9795e123b1408a033c1fd23c74b82eb

SHA512
d9d7fa0ef9e9972d9d5075bed1ba60e2eef4a9b12bdacba326acf23f97c29b2c51a110d9b27f1ba947bc1a565e28266204310b7b495cadbf60b5972854ec5032

Download Submit
C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe
Filesize
1.3MB

MD5
231efb7ab5b36cda91e06456480228c1

SHA1
11edb782a254ead91bef459fb4dac0ca393ffeaf

SHA256
5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d

SHA512
c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017

Download Submit
C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe
Filesize
1.3MB

MD5
231efb7ab5b36cda91e06456480228c1

SHA1
11edb782a254ead91bef459fb4dac0ca393ffeaf

SHA256
5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d

SHA512
c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017

Download Submit
C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\mQTPECbUX38DuLpdMmoUBOwQ.bat
Filesize
55B

MD5
4eca9a6bf6c52d04c26fa14ea74bf227

SHA1
ca0fea58051517e6295da2da5e3f249ad4ff3504

SHA256
96ca7d8a38fd1f411bf623f952bbd4b8e93243167c2158917eba0d68f00e85cc

SHA512
3d818f8e1ea332deb3a0aaff2284deb6380639a56dc30a7e675cfe76c253f0c626783e5b7652cd6dbad541022ccb6058376ec5d7f12d0674a4478cfefef9df18

Download Submit
C:\Users\Admin\AppData\Roaming\blockRuntimedhcp\vQ3VIYUYL2xofTcP0gCIzAw.vbe
Filesize
224B

MD5
7b5df8b8d4d8d1b95b3313ffaf3c420b

SHA1
70c9cb3ea22d5349044e03f7e6fa4d98e6bc208d

SHA256
1c307726e10a7546162838a9981c0d0565306998ed731ee73a047d664d72a3ea

SHA512
ddc870977887cd25ca709ff3b3be1311d7478e5c361936d3ff3dd845aa04633fcc081a27bc088e20001f1105862c88972d9325a3b40126157906400ccda65270

Download Submit
C:\Users\Default User\csrss.exe
Filesize
1.3MB

MD5
231efb7ab5b36cda91e06456480228c1

SHA1
11edb782a254ead91bef459fb4dac0ca393ffeaf

SHA256
5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d

SHA512
c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017

Download Submit
C:\Users\Default\csrss.exe
Filesize
1.3MB

MD5
231efb7ab5b36cda91e06456480228c1

SHA1
11edb782a254ead91bef459fb4dac0ca393ffeaf

SHA256
5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d

SHA512
c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017

Download Submit
C:\Windows\ModemLogs\System.exe
Filesize
1.3MB

MD5
231efb7ab5b36cda91e06456480228c1

SHA1
11edb782a254ead91bef459fb4dac0ca393ffeaf

SHA256
5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d

SHA512
c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017

Download Submit
\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe
Filesize
1.3MB

MD5
231efb7ab5b36cda91e06456480228c1

SHA1
11edb782a254ead91bef459fb4dac0ca393ffeaf

SHA256
5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d

SHA512
c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017

Download Submit
\Users\Admin\AppData\Roaming\blockRuntimedhcp\componentMonitorcommon.exe
Filesize
1.3MB

MD5
231efb7ab5b36cda91e06456480228c1

SHA1
11edb782a254ead91bef459fb4dac0ca393ffeaf

SHA256
5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d

SHA512
c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017

Download Submit
memory/588-186-0x0000000002860000-0x00000000028E0000-memory.dmp

Filesize
512KB

Download
memory/588-188-0x0000000002860000-0x00000000028E0000-memory.dmp

Filesize
512KB

Download
memory/588-189-0x0000000002860000-0x00000000028E0000-memory.dmp

Filesize
512KB

Download
memory/588-205-0x0000000002860000-0x00000000028E0000-memory.dmp

Filesize
512KB

Download
memory/604-185-0x00000000024D0000-0x0000000002550000-memory.dmp

Filesize
512KB

Download
memory/604-198-0x00000000024D0000-0x0000000002550000-memory.dmp

Filesize
512KB

Download
memory/604-184-0x00000000024D0000-0x0000000002550000-memory.dmp

Filesize
512KB

Download
memory/920-194-0x00000000029BB000-0x00000000029F2000-memory.dmp

Filesize
220KB

Download
memory/920-175-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/920-174-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/1096-119-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/1096-115-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/1096-138-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/1096-195-0x00000000028AB000-0x00000000028E2000-memory.dmp

Filesize
220KB

Download
memory/1096-176-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/1236-177-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/1236-178-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/1236-193-0x00000000025BB000-0x00000000025F2000-memory.dmp

Filesize
220KB

Download
memory/1460-197-0x000000000263B000-0x0000000002672000-memory.dmp

Filesize
220KB

Download
memory/1460-179-0x0000000002630000-0x00000000026B0000-memory.dmp

Filesize
512KB

Download
memory/1480-166-0x0000000002410000-0x0000000002490000-memory.dmp

Filesize
512KB

Download
memory/1480-167-0x0000000002410000-0x0000000002490000-memory.dmp

Filesize
512KB

Download
memory/1480-196-0x000000000241B000-0x0000000002452000-memory.dmp

Filesize
220KB

Download
memory/1656-69-0x0000000000600000-0x0000000000616000-memory.dmp

Filesize
88KB

Download
memory/1656-67-0x0000000000DB0000-0x0000000000F04000-memory.dmp

Filesize
1.3MB

Download
memory/1656-68-0x0000000000550000-0x000000000056C000-memory.dmp

Filesize
112KB

Download
memory/1656-70-0x00000000003C0000-0x00000000003CE000-memory.dmp

Filesize
56KB

Download
memory/1656-77-0x000000001B040000-0x000000001B0C0000-memory.dmp

Filesize
512KB

Download
memory/1656-72-0x00000000007C0000-0x00000000007CC000-memory.dmp

Filesize
48KB

Download
memory/1656-71-0x0000000000570000-0x000000000057E000-memory.dmp

Filesize
56KB

Download
memory/1720-180-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/1720-199-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/1720-200-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/1984-170-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1984-192-0x000000000290B000-0x0000000002942000-memory.dmp

Filesize
220KB

Download
memory/2056-168-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/2056-125-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/2056-165-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/2056-164-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/2056-206-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/2064-201-0x00000000025D0000-0x0000000002650000-memory.dmp

Filesize
512KB

Download
memory/2064-181-0x00000000025D0000-0x0000000002650000-memory.dmp

Filesize
512KB

Download
memory/2064-183-0x00000000025D0000-0x0000000002650000-memory.dmp

Filesize
512KB

Download
memory/2064-182-0x00000000025D0000-0x0000000002650000-memory.dmp

Filesize
512KB

Download
memory/2072-208-0x000000000243B000-0x0000000002472000-memory.dmp

Filesize
220KB

Download
memory/2072-207-0x0000000002430000-0x00000000024B0000-memory.dmp

Filesize
512KB

Download
memory/2072-204-0x0000000002430000-0x00000000024B0000-memory.dmp

Filesize
512KB

Download
memory/2072-203-0x0000000002430000-0x00000000024B0000-memory.dmp

Filesize
512KB

Download
memory/2080-202-0x0000000002340000-0x00000000023C0000-memory.dmp

Filesize
512KB

Download
memory/2080-190-0x0000000002340000-0x00000000023C0000-memory.dmp

Filesize
512KB

Download
memory/2080-191-0x0000000002340000-0x00000000023C0000-memory.dmp

Filesize
512KB

Download
memory/2080-187-0x0000000002340000-0x00000000023C0000-memory.dmp

Filesize
512KB

Download
memory/2608-211-0x0000000000D60000-0x0000000000EB4000-memory.dmp

Filesize
1.3MB

Download
memory/2608-212-0x000000001AFB0000-0x000000001B030000-memory.dmp

Filesize
512KB

Download
memory/2608-213-0x000000001AFB0000-0x000000001B030000-memory.dmp

Filesize
512KB

Download
memory/2608-305-0x000000001AFB0000-0x000000001B030000-memory.dmp

Filesize
512KB

Download