dcrat | 51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

devalt.exe
Size

2.0MB
MD5

fc9ea28a3c3659c4200e442d20198458
SHA1

79ede873cd08d5941e54524dd85b5add0a79bd7c
SHA256

51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0
SHA512

c2357a0eb6fd31929af57c544be2de14b0daee2a731ec09e586b0ac748b7368ae5a022d0d8dae0ccece0fa860799a0da02405f60d86a963e177508b5e4220a17
SSDEEP

49152:ubA3jVKbYcU6bWUfj4a7syRO2tzK/RNS/2t:ubjJXj4a4IKJYet

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	1136	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	1136	schtasks.exe	32

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000014c9c-63.dat	dcrat
behavioral1/files/0x0007000000014c9c-66.dat	dcrat
behavioral1/files/0x0007000000014c9c-65.dat	dcrat
behavioral1/files/0x0007000000014c9c-64.dat	dcrat
behavioral1/memory/1776-67-0x0000000000280000-0x0000000000440000-memory.dmp	dcrat
behavioral1/files/0x0006000000015617-89.dat	dcrat
behavioral1/files/0x00070000000155af-116.dat	dcrat
behavioral1/files/0x00080000000155af-133.dat	dcrat
behavioral1/files/0x0007000000014c9c-245.dat	dcrat
behavioral1/memory/2824-246-0x0000000000150000-0x0000000000310000-memory.dmp	dcrat
behavioral1/files/0x0008000000015db9-352.dat	dcrat
behavioral1/files/0x0008000000015db9-350.dat	dcrat
behavioral1/files/0x0008000000015db9-415.dat	dcrat
behavioral1/files/0x000c000000016054-424.dat	dcrat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	SurrogateDll.exe

Executes dropped EXE 4 IoCs

pid	Process
1776	SurrogateDll.exe
2824	SurrogateDll.exe
2528	winlogon.exe
2104	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
268	cmd.exe
268	cmd.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\de-DE\wininit.exe	SurrogateDll.exe
File created	C:\Program Files\Windows Media Player\es-ES\75a57c1bdf437c	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\WMIADAP.exe	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\RCX417B.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\DVD Maker\winlogon.exe	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\System.exe	SurrogateDll.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\56085415360792	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\wininit.exe	SurrogateDll.exe
File created	C:\Program Files\DVD Maker\cc11b995f2a76d	SurrogateDll.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\System.exe	SurrogateDll.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\27d1bcfc3c54e0	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\RCX3EAD.tmp	SurrogateDll.exe
File created	C:\Program Files\Windows Media Player\es-ES\WMIADAP.exe	SurrogateDll.exe
File created	C:\Program Files\DVD Maker\winlogon.exe	SurrogateDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1840	schtasks.exe
2156	schtasks.exe
1908	schtasks.exe
1348	schtasks.exe
1648	schtasks.exe
1984	schtasks.exe
1648	schtasks.exe
2004	schtasks.exe
2972	schtasks.exe
3000	schtasks.exe
2088	schtasks.exe
2324	schtasks.exe
3020	schtasks.exe
820	schtasks.exe
1048	schtasks.exe
912	schtasks.exe
1996	schtasks.exe
920	schtasks.exe
2952	schtasks.exe
1616	schtasks.exe
2932	schtasks.exe
3044	schtasks.exe
2216	schtasks.exe
2116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
596	powershell.exe
864	powershell.exe
1944	powershell.exe
1152	powershell.exe
1776	SurrogateDll.exe
928	powershell.exe
1204	powershell.exe
1732	powershell.exe
684	powershell.exe
1624	powershell.exe
1776	SurrogateDll.exe
1776	SurrogateDll.exe
1492	powershell.exe
1552	powershell.exe
1548	powershell.exe
364	powershell.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2444	powershell.exe
972	powershell.exe
2824	SurrogateDll.exe
2824	SurrogateDll.exe
2436	powershell.exe
1852	powershell.exe
1764	powershell.exe
2448	powershell.exe
1616	powershell.exe
1540	powershell.exe
1556	powershell.exe
1812	powershell.exe
2424	powershell.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	SurrogateDll.exe
Token: SeDebugPrivilege	596	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	364	powershell.exe
Token: SeDebugPrivilege	2824	SurrogateDll.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	2528	winlogon.exe
Token: SeDebugPrivilege	2104	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 376	1936	devalt.exe	28
PID 1936 wrote to memory of 376	1936	devalt.exe	28
PID 1936 wrote to memory of 376	1936	devalt.exe	28
PID 1936 wrote to memory of 376	1936	devalt.exe	28
PID 376 wrote to memory of 268	376	WScript.exe	29
PID 376 wrote to memory of 268	376	WScript.exe	29
PID 376 wrote to memory of 268	376	WScript.exe	29
PID 376 wrote to memory of 268	376	WScript.exe	29
PID 268 wrote to memory of 1776	268	cmd.exe	31
PID 268 wrote to memory of 1776	268	cmd.exe	31
PID 268 wrote to memory of 1776	268	cmd.exe	31
PID 268 wrote to memory of 1776	268	cmd.exe	31
PID 1776 wrote to memory of 864	1776	SurrogateDll.exe	42
PID 1776 wrote to memory of 864	1776	SurrogateDll.exe	42
PID 1776 wrote to memory of 864	1776	SurrogateDll.exe	42
PID 1776 wrote to memory of 1624	1776	SurrogateDll.exe	43
PID 1776 wrote to memory of 1624	1776	SurrogateDll.exe	43
PID 1776 wrote to memory of 1624	1776	SurrogateDll.exe	43
PID 1776 wrote to memory of 1492	1776	SurrogateDll.exe	48
PID 1776 wrote to memory of 1492	1776	SurrogateDll.exe	48
PID 1776 wrote to memory of 1492	1776	SurrogateDll.exe	48
PID 1776 wrote to memory of 596	1776	SurrogateDll.exe	47
PID 1776 wrote to memory of 596	1776	SurrogateDll.exe	47
PID 1776 wrote to memory of 596	1776	SurrogateDll.exe	47
PID 1776 wrote to memory of 684	1776	SurrogateDll.exe	46
PID 1776 wrote to memory of 684	1776	SurrogateDll.exe	46
PID 1776 wrote to memory of 684	1776	SurrogateDll.exe	46
PID 1776 wrote to memory of 1204	1776	SurrogateDll.exe	53
PID 1776 wrote to memory of 1204	1776	SurrogateDll.exe	53
PID 1776 wrote to memory of 1204	1776	SurrogateDll.exe	53
PID 1776 wrote to memory of 1552	1776	SurrogateDll.exe	51
PID 1776 wrote to memory of 1552	1776	SurrogateDll.exe	51
PID 1776 wrote to memory of 1552	1776	SurrogateDll.exe	51
PID 1776 wrote to memory of 928	1776	SurrogateDll.exe	49
PID 1776 wrote to memory of 928	1776	SurrogateDll.exe	49
PID 1776 wrote to memory of 928	1776	SurrogateDll.exe	49
PID 1776 wrote to memory of 364	1776	SurrogateDll.exe	54
PID 1776 wrote to memory of 364	1776	SurrogateDll.exe	54
PID 1776 wrote to memory of 364	1776	SurrogateDll.exe	54
PID 1776 wrote to memory of 1548	1776	SurrogateDll.exe	56
PID 1776 wrote to memory of 1548	1776	SurrogateDll.exe	56
PID 1776 wrote to memory of 1548	1776	SurrogateDll.exe	56
PID 1776 wrote to memory of 1152	1776	SurrogateDll.exe	58
PID 1776 wrote to memory of 1152	1776	SurrogateDll.exe	58
PID 1776 wrote to memory of 1152	1776	SurrogateDll.exe	58
PID 1776 wrote to memory of 1732	1776	SurrogateDll.exe	59
PID 1776 wrote to memory of 1732	1776	SurrogateDll.exe	59
PID 1776 wrote to memory of 1732	1776	SurrogateDll.exe	59
PID 1776 wrote to memory of 1944	1776	SurrogateDll.exe	61
PID 1776 wrote to memory of 1944	1776	SurrogateDll.exe	61
PID 1776 wrote to memory of 1944	1776	SurrogateDll.exe	61
PID 1776 wrote to memory of 1160	1776	SurrogateDll.exe	68
PID 1776 wrote to memory of 1160	1776	SurrogateDll.exe	68
PID 1776 wrote to memory of 1160	1776	SurrogateDll.exe	68
PID 1160 wrote to memory of 2460	1160	cmd.exe	70
PID 1160 wrote to memory of 2460	1160	cmd.exe	70
PID 1160 wrote to memory of 2460	1160	cmd.exe	70
PID 1160 wrote to memory of 2824	1160	cmd.exe	71
PID 1160 wrote to memory of 2824	1160	cmd.exe	71
PID 1160 wrote to memory of 2824	1160	cmd.exe	71
PID 2824 wrote to memory of 2444	2824	SurrogateDll.exe	87
PID 2824 wrote to memory of 2444	2824	SurrogateDll.exe	87
PID 2824 wrote to memory of 2444	2824	SurrogateDll.exe	87
PID 2824 wrote to memory of 2448	2824	SurrogateDll.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\devalt.exe
"C:\Users\Admin\AppData\Local\Temp\devalt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentBrowsersavesRefBroker\metokn3Gpa5i.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\agentBrowsersavesRefBroker\DYj6G9.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:268
  - - C:\agentBrowsersavesRefBroker\SurrogateDll.exe
      "C:\agentBrowsersavesRefBroker\SurrogateDll.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/agentBrowsersavesRefBroker/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f6WQhtp8o5.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1160
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2460
      - C:\agentBrowsersavesRefBroker\SurrogateDll.exe
        
        "C:\agentBrowsersavesRefBroker\SurrogateDll.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/agentBrowsersavesRefBroker/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
        
        C:\Program Files\DVD Maker\winlogon.exe
        
        "C:\Program Files\DVD Maker\winlogon.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\574592eb-247d-4203-9248-8d02cebc7b9c.vbs"
        8⤵
        
        PID:1220
        
        C:\Program Files\DVD Maker\winlogon.exe
        
        "C:\Program Files\DVD Maker\winlogon.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\981fc8a2-166a-47e9-b7e9-3029abc762e0.vbs"
        10⤵
        
        PID:1248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\313dbbad-7530-44df-ba3b-a10800eb4f32.vbs"
        10⤵
        
        PID:2288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\982414cc-90ec-4848-9e7c-2a6a9ff4e026.vbs"
        8⤵
        
        PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\911502a2-1052-11ee-91b8-fabf500b3286\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\911502a2-1052-11ee-91b8-fabf500b3286\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\911502a2-1052-11ee-91b8-fabf500b3286\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Documents\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\Documents\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Documents\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\es-ES\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\es-ES\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\es-ES\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\DVD Maker\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\DVD Maker\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Defender\de-DE\wininit.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\Program Files (x86)\Windows Defender\de-DE\wininit.exe

Filesize
1.7MB

MD5
2bdb7e05050e873a149eb12867f07286

SHA1
9803c6176b59c4e1469128c67c9528d34f85bdb1

SHA256
408fed40f3f37c9303954219ac2a191839a63dc4c418a1fe211f141b1628565e

SHA512
9e96e838372eb8f653b43c081a0ad691a5944a041944f91c59832945d1e86cf87dd46ca4d88627acb598cf11c027e4df651d8261dd6475d901a9d33fd740c7b3

Download Submit
C:\Program Files\DVD Maker\winlogon.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\Program Files\DVD Maker\winlogon.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\Program Files\DVD Maker\winlogon.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\Recovery\911502a2-1052-11ee-91b8-fabf500b3286\RCX3A68.tmp

Filesize
1.7MB

MD5
6ba0bd186059db276890eff3e2f8974d

SHA1
27924b8912c0986c45d2530a4bfc6c4b631d3736

SHA256
50db660bde9202a677b71df6a529b451bbb405ce2b788498912799cc85cf6b40

SHA512
eef3cb1fa546d252ef2c6aa21693a96f3b3216a01165415a024775af9b9ec8f991f9ce039994b04d4acb1d277db133ba419026a7ba7d3f2acbda43408b4f1a6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\313dbbad-7530-44df-ba3b-a10800eb4f32.vbs

Filesize
491B

MD5
578239c78c8aa662e63604432cf1500c

SHA1
feaa1b71c194652a974e05b7d2ad173a3f48f355

SHA256
74d6ae54b03a66002a2e3fa7c0dc17671b3ed3b9247f5c076e04556d6a674c1d

SHA512
64c3080ad4204987743f592c83a3244c0fe1f6f7403a6c4d04b9b2ec573633bb58e46316275ecef22a890e49f507c3257e706c4857c85c165a2152cec99df80b

Download Submit
C:\Users\Admin\AppData\Local\Temp\313dbbad-7530-44df-ba3b-a10800eb4f32.vbs

Filesize
491B

MD5
578239c78c8aa662e63604432cf1500c

SHA1
feaa1b71c194652a974e05b7d2ad173a3f48f355

SHA256
74d6ae54b03a66002a2e3fa7c0dc17671b3ed3b9247f5c076e04556d6a674c1d

SHA512
64c3080ad4204987743f592c83a3244c0fe1f6f7403a6c4d04b9b2ec573633bb58e46316275ecef22a890e49f507c3257e706c4857c85c165a2152cec99df80b

Download Submit
C:\Users\Admin\AppData\Local\Temp\574592eb-247d-4203-9248-8d02cebc7b9c.vbs

Filesize
715B

MD5
51a2800dc7d8c973fa6e0b9fc0297b57

SHA1
623f80ce712004a55719f152f81464557a9aee57

SHA256
28bf43c5829dce5dfd879434221a460d76da7407e57dd13ac360ab841871f879

SHA512
2926a9815765e9ca26f206c25502285f286d31b23e2eaa1ad6a909734167e31ceb1961e699c9c1c647b3aaf332aa867226551624df88324ec2e460f724bd455f

Download Submit
C:\Users\Admin\AppData\Local\Temp\981fc8a2-166a-47e9-b7e9-3029abc762e0.vbs

Filesize
715B

MD5
49c8a7d8ec67275908e5c111dd2812ca

SHA1
c89b6dfbd32c7f0837d07ae880ab2f457c385811

SHA256
151cd3388b341a20d0bb98da1dfb399c25b04d22be07f16ce5dd92289cfc2b20

SHA512
d10d4948126f27b058cc3f515f8b19c852ef296365c8610ba30b2230dcf9db426fbb3616069285fec0d48079a0c61bc311d427659f7f7145746b49179e7cf546

Download Submit
C:\Users\Admin\AppData\Local\Temp\982414cc-90ec-4848-9e7c-2a6a9ff4e026.vbs

Filesize
491B

MD5
578239c78c8aa662e63604432cf1500c

SHA1
feaa1b71c194652a974e05b7d2ad173a3f48f355

SHA256
74d6ae54b03a66002a2e3fa7c0dc17671b3ed3b9247f5c076e04556d6a674c1d

SHA512
64c3080ad4204987743f592c83a3244c0fe1f6f7403a6c4d04b9b2ec573633bb58e46316275ecef22a890e49f507c3257e706c4857c85c165a2152cec99df80b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a31811d289e78856a4387bd7fbd1f38070ca3768.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\f6WQhtp8o5.bat

Filesize
211B

MD5
a710adb59903cd06f765539c8855712f

SHA1
e8a82a52007e7162df20f050009e21b3b84947ea

SHA256
2ad729308fb586a4e96cd5d27ef796226fb6e00ee23090f8e924bbc107e1edc4

SHA512
3f3a9568eaa0f436efe97c674cc0c7a39af976447e6a6679ad9abbf29467d6c43b9dcc8441f15f3754e899e9377750abd3715db8ecf1e5f4ed7c8f344e229991

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1C8V4A6MXMZ6N7R28173.temp

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2283fd22c6f8d004a17f0f6e177444f0

SHA1
1514f204f5d785ecc3a2f162e9e2c5ffbaea71e0

SHA256
30351caa7140098476c79398f915a3776e1e11a48544838f6efd8c07e89d00a5

SHA512
87a3ea2f7ce18fcf69ee9bf5f37489eedcfec34ec79db34a887c423efdff2b5ccce1c91753ae44b9a1307643ca22102ac2c8929501b05ac688a720bfa619b94e

Download Submit
C:\agentBrowsersavesRefBroker\DYj6G9.bat

Filesize
48B

MD5
5bb1a4946c35c47dd502dfbcd6d3a3d7

SHA1
1e1e42c5996031e92e8314c45201ccbf1fa23607

SHA256
30921e7d9a89121e8d56de5182e7e487f8e02293e82e82c2c04a6a537150ef06

SHA512
87a63b9f407a21db0cc2d80e3b639833e5e9f790790a9fc69a65788b193af80e19717ac4dc449190cc69817b161aabaf4a9c338e8936c6907adf5c432f7156e1

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\agentBrowsersavesRefBroker\metokn3Gpa5i.vbe

Filesize
209B

MD5
22bdc192d231db2480148ba60871353b

SHA1
511712d83287343407b489ffbba56f1543062496

SHA256
442844f37559614e588adbd17a56c93e76687efdc6757a8aa0510e87b5a9fd22

SHA512
b7f044b2e707f474d7b5cba6fd4dd484debd04a7f7a80b81d81a1a9b49c8f85746804f5382770b338bdaf2471b09734deb5b0fdf30daa82e610435418866e444

Download Submit
\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
memory/364-243-0x00000000028CB000-0x0000000002902000-memory.dmp

Filesize
220KB

Download
memory/364-244-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/364-242-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/364-237-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/596-214-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/596-186-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/596-191-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/596-229-0x000000000281B000-0x0000000002852000-memory.dmp

Filesize
220KB

Download
memory/684-213-0x0000000002674000-0x0000000002677000-memory.dmp

Filesize
12KB

Download
memory/684-220-0x000000000267B000-0x00000000026B2000-memory.dmp

Filesize
220KB

Download
memory/864-210-0x0000000002740000-0x00000000027C0000-memory.dmp

Filesize
512KB

Download
memory/864-203-0x0000000002740000-0x00000000027C0000-memory.dmp

Filesize
512KB

Download
memory/864-218-0x0000000002740000-0x00000000027C0000-memory.dmp

Filesize
512KB

Download
memory/864-167-0x0000000002440000-0x0000000002448000-memory.dmp

Filesize
32KB

Download
memory/864-228-0x000000000274B000-0x0000000002782000-memory.dmp

Filesize
220KB

Download
memory/928-225-0x0000000002A9B000-0x0000000002AD2000-memory.dmp

Filesize
220KB

Download
memory/928-224-0x0000000002A94000-0x0000000002A97000-memory.dmp

Filesize
12KB

Download
memory/1152-216-0x00000000028CB000-0x0000000002902000-memory.dmp

Filesize
220KB

Download
memory/1152-211-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/1204-219-0x00000000028DB000-0x0000000002912000-memory.dmp

Filesize
220KB

Download
memory/1204-223-0x00000000028D4000-0x00000000028D7000-memory.dmp

Filesize
12KB

Download
memory/1204-222-0x00000000028D0000-0x0000000002950000-memory.dmp

Filesize
512KB

Download
memory/1492-230-0x00000000027AB000-0x00000000027E2000-memory.dmp

Filesize
220KB

Download
memory/1492-231-0x00000000027A0000-0x0000000002820000-memory.dmp

Filesize
512KB

Download
memory/1492-233-0x00000000027A4000-0x00000000027A7000-memory.dmp

Filesize
12KB

Download
memory/1548-236-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/1548-241-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/1548-239-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/1548-240-0x00000000024BB000-0x00000000024F2000-memory.dmp

Filesize
220KB

Download
memory/1552-235-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/1552-238-0x000000000257B000-0x00000000025B2000-memory.dmp

Filesize
220KB

Download
memory/1552-234-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/1624-169-0x000000001B1C0000-0x000000001B4A2000-memory.dmp

Filesize
2.9MB

Download
memory/1624-209-0x0000000002470000-0x00000000024F0000-memory.dmp

Filesize
512KB

Download
memory/1624-212-0x0000000002474000-0x0000000002477000-memory.dmp

Filesize
12KB

Download
memory/1624-217-0x000000000247B000-0x00000000024B2000-memory.dmp

Filesize
220KB

Download
memory/1732-232-0x000000000273B000-0x0000000002772000-memory.dmp

Filesize
220KB

Download
memory/1732-227-0x0000000002734000-0x0000000002737000-memory.dmp

Filesize
12KB

Download
memory/1732-226-0x0000000002730000-0x00000000027B0000-memory.dmp

Filesize
512KB

Download
memory/1776-80-0x0000000000850000-0x000000000085E000-memory.dmp

Filesize
56KB

Download
memory/1776-79-0x0000000000840000-0x000000000084A000-memory.dmp

Filesize
40KB

Download
memory/1776-67-0x0000000000280000-0x0000000000440000-memory.dmp

Filesize
1.8MB

Download
memory/1776-68-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/1776-69-0x0000000000240000-0x000000000025C000-memory.dmp

Filesize
112KB

Download
memory/1776-121-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/1776-120-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/1776-97-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/1776-86-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/1776-83-0x0000000000A30000-0x0000000000A3C000-memory.dmp

Filesize
48KB

Download
memory/1776-82-0x0000000000A20000-0x0000000000A2C000-memory.dmp

Filesize
48KB

Download
memory/1776-81-0x0000000000870000-0x0000000000878000-memory.dmp

Filesize
32KB

Download
memory/1776-70-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/1776-179-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/1776-78-0x0000000000830000-0x000000000083C000-memory.dmp

Filesize
48KB

Download
memory/1776-77-0x0000000000610000-0x0000000000622000-memory.dmp

Filesize
72KB

Download
memory/1776-75-0x0000000000600000-0x0000000000608000-memory.dmp

Filesize
32KB

Download
memory/1776-74-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/1776-73-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/1776-72-0x0000000000540000-0x0000000000556000-memory.dmp

Filesize
88KB

Download
memory/1776-71-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/1944-221-0x000000000292B000-0x0000000002962000-memory.dmp

Filesize
220KB

Download
memory/1944-215-0x0000000002924000-0x0000000002927000-memory.dmp

Filesize
12KB

Download
memory/2824-247-0x000000001B230000-0x000000001B2B0000-memory.dmp

Filesize
512KB

Download
memory/2824-246-0x0000000000150000-0x0000000000310000-memory.dmp

Filesize
1.8MB

Download