dcrat | 51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
01/07/2023, 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

devaltexe.exe
Size

2.0MB
MD5

fc9ea28a3c3659c4200e442d20198458
SHA1

79ede873cd08d5941e54524dd85b5add0a79bd7c
SHA256

51c3cebd8c8fe19e37b68c64218b4c4552aac4c804bd04ed372fd74d52668ff0
SHA512

c2357a0eb6fd31929af57c544be2de14b0daee2a731ec09e586b0ac748b7368ae5a022d0d8dae0ccece0fa860799a0da02405f60d86a963e177508b5e4220a17
SSDEEP

49152:ubA3jVKbYcU6bWUfj4a7syRO2tzK/RNS/2t:ubjJXj4a4IKJYet

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	296	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	1020	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	1020	schtasks.exe	32

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00090000000122e5-63.dat	dcrat
behavioral1/files/0x00090000000122e5-66.dat	dcrat
behavioral1/files/0x00090000000122e5-65.dat	dcrat
behavioral1/files/0x00090000000122e5-64.dat	dcrat
behavioral1/memory/560-67-0x0000000000AC0000-0x0000000000C80000-memory.dmp	dcrat
behavioral1/files/0x00080000000122ec-89.dat	dcrat
behavioral1/files/0x0007000000013496-122.dat	dcrat
behavioral1/files/0x000b0000000122e7-134.dat	dcrat
behavioral1/files/0x000a0000000122e9-157.dat	dcrat
behavioral1/memory/1932-230-0x0000000000B20000-0x0000000000CE0000-memory.dmp	dcrat
behavioral1/files/0x0007000000013496-225.dat	dcrat
behavioral1/files/0x0007000000013496-224.dat	dcrat
behavioral1/files/0x0007000000013496-363.dat	dcrat
behavioral1/files/0x000f000000012303-369.dat	dcrat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	SurrogateDll.exe

Executes dropped EXE 3 IoCs

pid	Process
560	SurrogateDll.exe
1932	wininit.exe
2428	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
1920	cmd.exe
1920	cmd.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\RCX508F.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\RCX50A0.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\wininit.exe	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe	SurrogateDll.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\56085415360792	SurrogateDll.exe
File created	C:\Program Files\Windows Defender\en-US\wininit.exe	SurrogateDll.exe
File created	C:\Program Files\Windows Defender\en-US\56085415360792	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCX2C70.tmp	SurrogateDll.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCX2F2F.tmp	SurrogateDll.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IME\ja-JP\RCX4759.tmp	SurrogateDll.exe
File opened for modification	C:\Windows\IME\ja-JP\System.exe	SurrogateDll.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\dwm.exe	SurrogateDll.exe
File created	C:\Windows\IME\ja-JP\27d1bcfc3c54e0	SurrogateDll.exe
File created	C:\Windows\Prefetch\ReadyBoot\dwm.exe	SurrogateDll.exe
File opened for modification	C:\Windows\IME\ja-JP\RCX4758.tmp	SurrogateDll.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCX5BFA.tmp	SurrogateDll.exe
File created	C:\Windows\IME\ja-JP\System.exe	SurrogateDll.exe
File created	C:\Windows\Prefetch\ReadyBoot\6cb0b6c459d5d3	SurrogateDll.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCX5BE9.tmp	SurrogateDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1180	schtasks.exe
528	schtasks.exe
1752	schtasks.exe
1508	schtasks.exe
1092	schtasks.exe
2028	schtasks.exe
296	schtasks.exe
1080	schtasks.exe
1328	schtasks.exe
1528	schtasks.exe
1764	schtasks.exe
1856	schtasks.exe
1152	schtasks.exe
984	schtasks.exe
1728	schtasks.exe
1600	schtasks.exe
556	schtasks.exe
924	schtasks.exe
1832	schtasks.exe
920	schtasks.exe
392	schtasks.exe
1476	schtasks.exe
324	schtasks.exe
1608	schtasks.exe
1868	schtasks.exe
1348	schtasks.exe
1732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
560	SurrogateDll.exe
1636	powershell.exe
1924	powershell.exe
1684	powershell.exe
864	powershell.exe
584	powershell.exe
1276	powershell.exe
1152	powershell.exe
944	powershell.exe
1348	powershell.exe
1752	powershell.exe
1536	powershell.exe
1512	powershell.exe
1584	powershell.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe
1932	wininit.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	SurrogateDll.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	584	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	944	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	1932	wininit.exe
Token: SeDebugPrivilege	2428	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 904	1432	devaltexe.exe	28
PID 1432 wrote to memory of 904	1432	devaltexe.exe	28
PID 1432 wrote to memory of 904	1432	devaltexe.exe	28
PID 1432 wrote to memory of 904	1432	devaltexe.exe	28
PID 904 wrote to memory of 1920	904	WScript.exe	29
PID 904 wrote to memory of 1920	904	WScript.exe	29
PID 904 wrote to memory of 1920	904	WScript.exe	29
PID 904 wrote to memory of 1920	904	WScript.exe	29
PID 1920 wrote to memory of 560	1920	cmd.exe	31
PID 1920 wrote to memory of 560	1920	cmd.exe	31
PID 1920 wrote to memory of 560	1920	cmd.exe	31
PID 1920 wrote to memory of 560	1920	cmd.exe	31
PID 560 wrote to memory of 1276	560	SurrogateDll.exe	60
PID 560 wrote to memory of 1276	560	SurrogateDll.exe	60
PID 560 wrote to memory of 1276	560	SurrogateDll.exe	60
PID 560 wrote to memory of 584	560	SurrogateDll.exe	61
PID 560 wrote to memory of 584	560	SurrogateDll.exe	61
PID 560 wrote to memory of 584	560	SurrogateDll.exe	61
PID 560 wrote to memory of 1512	560	SurrogateDll.exe	62
PID 560 wrote to memory of 1512	560	SurrogateDll.exe	62
PID 560 wrote to memory of 1512	560	SurrogateDll.exe	62
PID 560 wrote to memory of 1348	560	SurrogateDll.exe	64
PID 560 wrote to memory of 1348	560	SurrogateDll.exe	64
PID 560 wrote to memory of 1348	560	SurrogateDll.exe	64
PID 560 wrote to memory of 1924	560	SurrogateDll.exe	66
PID 560 wrote to memory of 1924	560	SurrogateDll.exe	66
PID 560 wrote to memory of 1924	560	SurrogateDll.exe	66
PID 560 wrote to memory of 1536	560	SurrogateDll.exe	65
PID 560 wrote to memory of 1536	560	SurrogateDll.exe	65
PID 560 wrote to memory of 1536	560	SurrogateDll.exe	65
PID 560 wrote to memory of 864	560	SurrogateDll.exe	84
PID 560 wrote to memory of 864	560	SurrogateDll.exe	84
PID 560 wrote to memory of 864	560	SurrogateDll.exe	84
PID 560 wrote to memory of 944	560	SurrogateDll.exe	67
PID 560 wrote to memory of 944	560	SurrogateDll.exe	67
PID 560 wrote to memory of 944	560	SurrogateDll.exe	67
PID 560 wrote to memory of 1152	560	SurrogateDll.exe	69
PID 560 wrote to memory of 1152	560	SurrogateDll.exe	69
PID 560 wrote to memory of 1152	560	SurrogateDll.exe	69
PID 560 wrote to memory of 1752	560	SurrogateDll.exe	80
PID 560 wrote to memory of 1752	560	SurrogateDll.exe	80
PID 560 wrote to memory of 1752	560	SurrogateDll.exe	80
PID 560 wrote to memory of 1584	560	SurrogateDll.exe	78
PID 560 wrote to memory of 1584	560	SurrogateDll.exe	78
PID 560 wrote to memory of 1584	560	SurrogateDll.exe	78
PID 560 wrote to memory of 1636	560	SurrogateDll.exe	77
PID 560 wrote to memory of 1636	560	SurrogateDll.exe	77
PID 560 wrote to memory of 1636	560	SurrogateDll.exe	77
PID 560 wrote to memory of 1684	560	SurrogateDll.exe	71
PID 560 wrote to memory of 1684	560	SurrogateDll.exe	71
PID 560 wrote to memory of 1684	560	SurrogateDll.exe	71
PID 560 wrote to memory of 1932	560	SurrogateDll.exe	86
PID 560 wrote to memory of 1932	560	SurrogateDll.exe	86
PID 560 wrote to memory of 1932	560	SurrogateDll.exe	86
PID 1932 wrote to memory of 3012	1932	wininit.exe	87
PID 1932 wrote to memory of 3012	1932	wininit.exe	87
PID 1932 wrote to memory of 3012	1932	wininit.exe	87
PID 1932 wrote to memory of 1632	1932	wininit.exe	88
PID 1932 wrote to memory of 1632	1932	wininit.exe	88
PID 1932 wrote to memory of 1632	1932	wininit.exe	88
PID 3012 wrote to memory of 2428	3012	WScript.exe	89
PID 3012 wrote to memory of 2428	3012	WScript.exe	89
PID 3012 wrote to memory of 2428	3012	WScript.exe	89
PID 2428 wrote to memory of 1712	2428	wininit.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\devaltexe.exe
"C:\Users\Admin\AppData\Local\Temp\devaltexe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentBrowsersavesRefBroker\metokn3Gpa5i.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\agentBrowsersavesRefBroker\DYj6G9.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\agentBrowsersavesRefBroker\SurrogateDll.exe
      "C:\agentBrowsersavesRefBroker\SurrogateDll.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/agentBrowsersavesRefBroker/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
    - - C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1932
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b294594f-c2ea-4b0c-aae9-f9b000d5b5ae.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6c7232d-d23c-4204-b800-5941824b20b8.vbs"
        8⤵
        
        PID:1712
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ca2380d-24cb-4d7b-94c2-d6313d4ec832.vbs"
        8⤵
        
        PID:1616
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d8acfc6-f4a8-477b-af69-8e497ce3084f.vbs"
        6⤵
        
        PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Saved Games\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Saved Games\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\IME\ja-JP\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\IME\ja-JP\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\ja-JP\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SurrogateDllS" /sc MINUTE /mo 13 /tr "'C:\Recovery\734fcb42-1063-11ee-bd91-fabf500b3286\SurrogateDll.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SurrogateDll" /sc ONLOGON /tr "'C:\Recovery\734fcb42-1063-11ee-bd91-fabf500b3286\SurrogateDll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SurrogateDllS" /sc MINUTE /mo 7 /tr "'C:\Recovery\734fcb42-1063-11ee-bd91-fabf500b3286\SurrogateDll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\en-US\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\PrintHood\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\PrintHood\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\Prefetch\ReadyBoot\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Windows\Prefetch\ReadyBoot\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe

Filesize
1.7MB

MD5
f350a345f85d5169efc0754964b14c8d

SHA1
50c5911d92d773d1555b187c441fbd1499d5cef6

SHA256
57add8bc2288ca4f329d8e54e48d48122d33e5328fa8b661d4ce4918e96081b2

SHA512
8f4166538264dcc7396ff126d09585f844b7fa430b15085a9586a744b50be58d5440f1669314ee61e9f910dab29328aa692f20a9ca02bf697c546542d4db0402

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe

Filesize
1.7MB

MD5
d0ef89872eba0f6aa71d4f64806617c1

SHA1
6af07fc0a2f13f28ce000ab998ca3c5270e0490a

SHA256
955815406148fe0698758d3b8ae17148975fc55a0e90fe79b5b48fd863c65ca8

SHA512
8cb8ce07d582a391a4f03bab5388269c3102d362f098ff6361288edc322837e08708bd2b07c6c76ce00a71313a2ab1a93ce557619a662c0342320f40ffb819dd

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe

Filesize
1.7MB

MD5
d0ef89872eba0f6aa71d4f64806617c1

SHA1
6af07fc0a2f13f28ce000ab998ca3c5270e0490a

SHA256
955815406148fe0698758d3b8ae17148975fc55a0e90fe79b5b48fd863c65ca8

SHA512
8cb8ce07d582a391a4f03bab5388269c3102d362f098ff6361288edc322837e08708bd2b07c6c76ce00a71313a2ab1a93ce557619a662c0342320f40ffb819dd

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe

Filesize
1.7MB

MD5
d0ef89872eba0f6aa71d4f64806617c1

SHA1
6af07fc0a2f13f28ce000ab998ca3c5270e0490a

SHA256
955815406148fe0698758d3b8ae17148975fc55a0e90fe79b5b48fd863c65ca8

SHA512
8cb8ce07d582a391a4f03bab5388269c3102d362f098ff6361288edc322837e08708bd2b07c6c76ce00a71313a2ab1a93ce557619a662c0342320f40ffb819dd

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\de-DE\wininit.exe

Filesize
1.7MB

MD5
d0ef89872eba0f6aa71d4f64806617c1

SHA1
6af07fc0a2f13f28ce000ab998ca3c5270e0490a

SHA256
955815406148fe0698758d3b8ae17148975fc55a0e90fe79b5b48fd863c65ca8

SHA512
8cb8ce07d582a391a4f03bab5388269c3102d362f098ff6361288edc322837e08708bd2b07c6c76ce00a71313a2ab1a93ce557619a662c0342320f40ffb819dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\192dceb32504a5994e45c2f0ab41af6697946146.exe

Filesize
1.7MB

MD5
d0ef89872eba0f6aa71d4f64806617c1

SHA1
6af07fc0a2f13f28ce000ab998ca3c5270e0490a

SHA256
955815406148fe0698758d3b8ae17148975fc55a0e90fe79b5b48fd863c65ca8

SHA512
8cb8ce07d582a391a4f03bab5388269c3102d362f098ff6361288edc322837e08708bd2b07c6c76ce00a71313a2ab1a93ce557619a662c0342320f40ffb819dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ca2380d-24cb-4d7b-94c2-d6313d4ec832.vbs

Filesize
513B

MD5
d0a683d44fc84ffac97aba81131ffdbf

SHA1
5ac77dbc8d2bb92cd8a3444e797bdc05ae178b7b

SHA256
376256cbbea6c7f2b4b8cb993132913a523fa69c28c107d5cca97508e553e95f

SHA512
24b85466c85997ba361541f6a98719092f99e8108a004222042f2d5030c2ad99f68fc5e49b93fc41bb064b7ce8bf8f1004ef60b68b1bd47b622297448980a4bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ca2380d-24cb-4d7b-94c2-d6313d4ec832.vbs

Filesize
513B

MD5
d0a683d44fc84ffac97aba81131ffdbf

SHA1
5ac77dbc8d2bb92cd8a3444e797bdc05ae178b7b

SHA256
376256cbbea6c7f2b4b8cb993132913a523fa69c28c107d5cca97508e553e95f

SHA512
24b85466c85997ba361541f6a98719092f99e8108a004222042f2d5030c2ad99f68fc5e49b93fc41bb064b7ce8bf8f1004ef60b68b1bd47b622297448980a4bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\9d8acfc6-f4a8-477b-af69-8e497ce3084f.vbs

Filesize
513B

MD5
d0a683d44fc84ffac97aba81131ffdbf

SHA1
5ac77dbc8d2bb92cd8a3444e797bdc05ae178b7b

SHA256
376256cbbea6c7f2b4b8cb993132913a523fa69c28c107d5cca97508e553e95f

SHA512
24b85466c85997ba361541f6a98719092f99e8108a004222042f2d5030c2ad99f68fc5e49b93fc41bb064b7ce8bf8f1004ef60b68b1bd47b622297448980a4bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\b294594f-c2ea-4b0c-aae9-f9b000d5b5ae.vbs

Filesize
737B

MD5
e3242501043eb50e4024e9e01be7a09b

SHA1
db1a0c7eb0b4f0e811a1038e0314fff3ab08d03d

SHA256
35dd39e87f7ddc4f082cf4cecea92f6a428306e5525728e6f34115974703990b

SHA512
2b13d5b72739c13ac653739e6ca99e2dac353c462bdc73162fc243c3fa5532ff9eea5488f42e44afbe27bc811d282dae26ffcf9ea633d74fe8d8b73859a86e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\e6c7232d-d23c-4204-b800-5941824b20b8.vbs

Filesize
737B

MD5
dc2a8daa74a0a002edb6e6d8f7b9fcc3

SHA1
6d640f7926b926ac4bd23a7d36234258563effbc

SHA256
0f6b3f6d455190d243fecbca52b6c29b8c6b3e4d7a9ae15942c66a54f59bd8d4

SHA512
277407ca0aedc0521c7ac72877cbe200fd228561c84244ce57a96bfcf78a6ae3af01d9b9c970d8276ed89fef4cf1f998b7248771478654b7e89f449b1f5c11ba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OUPPKP7V9IG786OY17SD.temp

Filesize
7KB

MD5
0213d315526ff94a386f91112d852c33

SHA1
59ec657bdf8fe714a25e2f8b181d0dd045355375

SHA256
e33efb2fc96c315a53fa82cc1b14bec0e32a393593b80f910e28abe7be7e4152

SHA512
7ac66135b4baa6a947b9ebe82334e6b9f7ad661d14d7993c9cbd54d93cae39a08ea9a27da974d071ade782fa300f1d2de2ed7ef0b0bd78d9a0c1f63218029fe9

Download Submit
C:\Users\Admin\explorer.exe

Filesize
1.7MB

MD5
7b4c52ffeb62388ae9e4174771f90bd4

SHA1
282d38d6a974055e24c27190d22331ebc9643b45

SHA256
4838b46a55389d775b77ec76898d4520cb420fa74a1a8a964a5375af51b53d8c

SHA512
8189bb7627909c9c2fc0ce79d6c0dca41777c50637e30e194dbe5699e514799877a3dd09bb0ceeb717401d2ecda3a93ba39d8d9d3c4ed15c1ef11c02b6f47ea1

Download Submit
C:\Users\Default\Saved Games\spoolsv.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\agentBrowsersavesRefBroker\DYj6G9.bat

Filesize
48B

MD5
5bb1a4946c35c47dd502dfbcd6d3a3d7

SHA1
1e1e42c5996031e92e8314c45201ccbf1fa23607

SHA256
30921e7d9a89121e8d56de5182e7e487f8e02293e82e82c2c04a6a537150ef06

SHA512
87a63b9f407a21db0cc2d80e3b639833e5e9f790790a9fc69a65788b193af80e19717ac4dc449190cc69817b161aabaf4a9c338e8936c6907adf5c432f7156e1

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
C:\agentBrowsersavesRefBroker\metokn3Gpa5i.vbe

Filesize
209B

MD5
22bdc192d231db2480148ba60871353b

SHA1
511712d83287343407b489ffbba56f1543062496

SHA256
442844f37559614e588adbd17a56c93e76687efdc6757a8aa0510e87b5a9fd22

SHA512
b7f044b2e707f474d7b5cba6fd4dd484debd04a7f7a80b81d81a1a9b49c8f85746804f5382770b338bdaf2471b09734deb5b0fdf30daa82e610435418866e444

Download Submit
\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
\agentBrowsersavesRefBroker\SurrogateDll.exe

Filesize
1.7MB

MD5
5420cbcfdf9d9cde25c9587c240354dc

SHA1
c87ddf64e1acd3b64df896eb091f97717d438076

SHA256
6f5ab9b6c6bbbb3930d8d5e3efbd1432c2cbbcb7a4153a85174a9e1cae7475e5

SHA512
14de4a786f4cb314bb66a28280204cbfb3547722fe6466f65de242897e1fbf49575c6b9b056dd8cdb9074c2df69a0d7db6151a3aa2329ff51d269caeb0bb92e6

Download Submit
memory/560-86-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-282-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-217-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-218-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-133-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-121-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-110-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-103-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-83-0x00000000020A0000-0x00000000020AC000-memory.dmp

Filesize
48KB

Download
memory/560-82-0x0000000002090000-0x000000000209C000-memory.dmp

Filesize
48KB

Download
memory/560-81-0x0000000002080000-0x0000000002088000-memory.dmp

Filesize
32KB

Download
memory/560-204-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-67-0x0000000000AC0000-0x0000000000C80000-memory.dmp

Filesize
1.8MB

Download
memory/560-80-0x0000000000AB0000-0x0000000000ABE000-memory.dmp

Filesize
56KB

Download
memory/560-68-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-79-0x0000000000690000-0x000000000069A000-memory.dmp

Filesize
40KB

Download
memory/560-78-0x00000000005E0000-0x00000000005EC000-memory.dmp

Filesize
48KB

Download
memory/560-73-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/560-283-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/560-69-0x00000000003B0000-0x00000000003CC000-memory.dmp

Filesize
112KB

Download
memory/560-77-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/560-75-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/560-72-0x00000000003F0000-0x0000000000406000-memory.dmp

Filesize
88KB

Download
memory/560-74-0x0000000000420000-0x000000000042C000-memory.dmp

Filesize
48KB

Download
memory/560-70-0x00000000003D0000-0x00000000003D8000-memory.dmp

Filesize
32KB

Download
memory/560-71-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/584-296-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/584-287-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/584-314-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/584-286-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/864-288-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download
memory/864-316-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download
memory/864-271-0x000000001B130000-0x000000001B412000-memory.dmp

Filesize
2.9MB

Download
memory/864-307-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download
memory/944-301-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/944-317-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/1152-303-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1152-322-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1276-315-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/1276-300-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/1348-319-0x00000000024D0000-0x0000000002550000-memory.dmp

Filesize
512KB

Download
memory/1348-302-0x00000000024D0000-0x0000000002550000-memory.dmp

Filesize
512KB

Download
memory/1512-310-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/1536-320-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/1584-308-0x0000000002330000-0x00000000023B0000-memory.dmp

Filesize
512KB

Download
memory/1584-311-0x0000000002330000-0x00000000023B0000-memory.dmp

Filesize
512KB

Download
memory/1584-309-0x0000000002330000-0x00000000023B0000-memory.dmp

Filesize
512KB

Download
memory/1636-298-0x0000000002470000-0x00000000024F0000-memory.dmp

Filesize
512KB

Download
memory/1636-304-0x0000000002470000-0x00000000024F0000-memory.dmp

Filesize
512KB

Download
memory/1636-313-0x0000000002470000-0x00000000024F0000-memory.dmp

Filesize
512KB

Download
memory/1636-270-0x0000000001C10000-0x0000000001C18000-memory.dmp

Filesize
32KB

Download
memory/1636-297-0x0000000002470000-0x00000000024F0000-memory.dmp

Filesize
512KB

Download
memory/1684-295-0x00000000027E0000-0x0000000002860000-memory.dmp

Filesize
512KB

Download
memory/1684-306-0x00000000027E0000-0x0000000002860000-memory.dmp

Filesize
512KB

Download
memory/1684-294-0x00000000027E0000-0x0000000002860000-memory.dmp

Filesize
512KB

Download
memory/1684-318-0x00000000027E0000-0x0000000002860000-memory.dmp

Filesize
512KB

Download
memory/1752-323-0x000000000236B000-0x00000000023A2000-memory.dmp

Filesize
220KB

Download
memory/1752-299-0x0000000002360000-0x00000000023E0000-memory.dmp

Filesize
512KB

Download
memory/1924-321-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/1924-285-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/1924-305-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/1924-284-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/1932-312-0x000000001B0C0000-0x000000001B140000-memory.dmp

Filesize
512KB

Download
memory/1932-230-0x0000000000B20000-0x0000000000CE0000-memory.dmp

Filesize
1.8MB

Download