Analysis

  • max time kernel
    154s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2023, 01:02

General

  • Target

    0924b9eca922c9227c4f426be5174bae.exe

  • Size

    4.8MB

  • MD5

    0924b9eca922c9227c4f426be5174bae

  • SHA1

    8d2abdecd0fc744ee836d75ad5c3b52585d8041f

  • SHA256

    e2955eb9de3b2d1d49eef7d0ff565d033429f0cb628439ef17571426758f58d8

  • SHA512

    47a234ac042b01fdd3d9eaf33f80d932386c841ad64cb8453e9c2e56a71d869eac632e0a8b5af029a9187e8367147ec1afcc337bc9249f253ddff6a743ba9de2

  • SSDEEP

    49152:wZ52zVeXI03Z6wg8NEoyC6Up4R8DrzSGRWGq1m2G2j4mddTpbuYs2P1C0q8dA9BA:YghQjZ6wt2W6eW8WAh2DQyC0q8G9wyQ/

Malware Config

Signatures

  • DcRat 29 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 9 IoCs
  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 39 IoCs
  • DCRat payload 27 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Adds Run key to start application 2 TTPs 18 IoCs
  • Checks whether UAC is enabled 1 TTPs 26 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 12 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0924b9eca922c9227c4f426be5174bae.exe
    "C:\Users\Admin\AppData\Local\Temp\0924b9eca922c9227c4f426be5174bae.exe"
    1⤵
    • DcRat
    • Checks computer location settings
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\driversessioncrt\iS3ZXZH7eGWUacRHzrnroa.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4020
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\driversessioncrt\7RYLxGVGAwiFGBwguvuUrv9KTj4HIJ.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4164
        • C:\driversessioncrt\winRefMonitor.exe
          "C:\driversessioncrt\winRefMonitor.exe"
          4⤵
          • DcRat
          • Modifies WinLogon for persistence
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:408
          • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
            "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
            5⤵
            • UAC bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:860
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c27bbc71-6775-4ee3-b607-e84b32aee802.vbs"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4640
              • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                7⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1748
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0c4cd8d-5d6d-49ad-b0b6-52c857eb6ea0.vbs"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:376
                  • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                    "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                    9⤵
                    • UAC bypass
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:4852
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6456acd-8ee4-40f0-addb-79668c1996a8.vbs"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3052
                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                        "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                        11⤵
                        • UAC bypass
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:3892
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4776bb40-6d7d-44cd-9e4a-4dcdb921d473.vbs"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4044
                          • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                            "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                            13⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            • System policy modification
                            PID:1660
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\184d4178-ba22-4563-a801-e33d6a7c8ad6.vbs"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4060
                              • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                                "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                                15⤵
                                • UAC bypass
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                • System policy modification
                                PID:4840
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d3db136-1657-4ca0-8b00-ae6796820123.vbs"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3716
                                  • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                                    "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                                    17⤵
                                    • UAC bypass
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    • System policy modification
                                    PID:4460
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ec08751-b681-4bac-b1a8-e4999c98d8a1.vbs"
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4280
                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                                        "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                                        19⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        • System policy modification
                                        PID:752
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37ec852f-af23-4b1c-ac53-2bdedec689fc.vbs"
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1244
                                          • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                                            "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                                            21⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • System policy modification
                                            PID:4404
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb0f8bc6-5270-4044-9174-c7fe08174d44.vbs"
                                              22⤵
                                                PID:4756
                                                • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                                                  "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                                                  23⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:2860
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd89738d-0af5-4f1d-a4a5-792869bf4983.vbs"
                                                    24⤵
                                                      PID:2724
                                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                                                        "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                                                        25⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:1048
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8188d727-d87d-46f7-977a-3e813f00fb3b.vbs"
                                                          26⤵
                                                            PID:224
                                                            • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe
                                                              "C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe"
                                                              27⤵
                                                              • UAC bypass
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:4948
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\119fbecb-e36d-415d-af22-f4a47140160a.vbs"
                                                            26⤵
                                                              PID:4908
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84fed986-2aac-4175-ae87-4e2519289131.vbs"
                                                          24⤵
                                                            PID:4624
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3513ed5e-cc76-41ce-a2f3-c6f08a8c2a80.vbs"
                                                        22⤵
                                                          PID:3968
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7844476-8e4e-4b7e-bc3f-79454c661585.vbs"
                                                      20⤵
                                                        PID:4428
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38beff78-6db4-4ad3-ae73-da695f383ddd.vbs"
                                                    18⤵
                                                      PID:4052
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\764ef9f6-e6cf-4189-b8ee-7d7c7994f828.vbs"
                                                  16⤵
                                                    PID:808
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6cce3b71-ce66-4372-94be-b5aebb138519.vbs"
                                                14⤵
                                                  PID:484
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08e34886-9c93-4c6e-b82f-34be045332b1.vbs"
                                              12⤵
                                                PID:2980
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\090a44c2-b0f8-4bf4-9980-3d2ed75a7616.vbs"
                                            10⤵
                                              PID:2056
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05b7c832-2497-4d0e-8a5c-20f59396a5f1.vbs"
                                          8⤵
                                            PID:840
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac64032d-c22d-4c37-9054-5ed1672efd3c.vbs"
                                        6⤵
                                          PID:2112
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                      4⤵
                                      • Modifies registry key
                                      PID:4516
                                • C:\Windows\SysWOW64\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\driversessioncrt\file.vbs"
                                  2⤵
                                    PID:2068
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2068
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3936
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:560
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4716
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4212
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1960
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\en-US\fontdrvhost.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3348
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\fontdrvhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1292
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\Accessories\en-US\fontdrvhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3964
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1564
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2944
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2432
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\odt\dllhost.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1608
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1616
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:708
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1892
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2544
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1676
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Saved Games\spoolsv.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2288
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\spoolsv.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1820
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Saved Games\spoolsv.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1744
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\de-DE\wininit.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:396
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2528
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\de-DE\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2892
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3316
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3640
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:1316

                                Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Program Files (x86)\Windows NT\Accessories\en-US\conhost.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Recovery\WindowsRE\Registry.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        49b64127208271d8f797256057d0b006

                                        SHA1

                                        b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                                        SHA256

                                        2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                                        SHA512

                                        f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                                      • C:\Users\Admin\AppData\Local\Temp\05b7c832-2497-4d0e-8a5c-20f59396a5f1.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\05b7c832-2497-4d0e-8a5c-20f59396a5f1.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\08e34886-9c93-4c6e-b82f-34be045332b1.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\090a44c2-b0f8-4bf4-9980-3d2ed75a7616.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\119fbecb-e36d-415d-af22-f4a47140160a.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\184d4178-ba22-4563-a801-e33d6a7c8ad6.vbs

                                        Filesize

                                        739B

                                        MD5

                                        bfc62d491cf261a894d198c90e5d26c0

                                        SHA1

                                        77b862afd5d5cd7231d359cafc36f74ec2254fdc

                                        SHA256

                                        278d0707dcc274d1c9afab447d003ff843ded8ee5cf79fd5ab7d782308e955ce

                                        SHA512

                                        f7b9286ca974e139890add2e1aa52b57692d45db48871cdc786edea1507e28e933f87083c68ffa64d11092ec2ef5fe366b2881efa287f9877bc50a8ebc01bc7f

                                      • C:\Users\Admin\AppData\Local\Temp\1ec08751-b681-4bac-b1a8-e4999c98d8a1.vbs

                                        Filesize

                                        739B

                                        MD5

                                        0a9d2547efe3231fbeac4a44deb1e72a

                                        SHA1

                                        145267dc807b45ca21b209dc1cd6703e59f25701

                                        SHA256

                                        11e47b8a60f9b0d98c3e6a37c5431413b0b7db0534f04b6764be4ad99362d448

                                        SHA512

                                        b8cbbea25c4bb8338271f62af8f82b90f0431c86278cab7cb7262fdb2c598b87082f3f35fde1a8792a9ddaab3461649e9d718207358718d3cdc4af602a1a9a2a

                                      • C:\Users\Admin\AppData\Local\Temp\2cabb165dada42e1e19104601b59ab888f669e70.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Temp\2cabb165dada42e1e19104601b59ab888f669e70.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Temp\2cabb165dada42e1e19104601b59ab888f669e70.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Temp\2cabb165dada42e1e19104601b59ab888f669e70.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Temp\2cabb165dada42e1e19104601b59ab888f669e70.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Temp\2cabb165dada42e1e19104601b59ab888f669e70.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Temp\2cabb165dada42e1e19104601b59ab888f669e70.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Temp\2cabb165dada42e1e19104601b59ab888f669e70.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Temp\2cabb165dada42e1e19104601b59ab888f669e70.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Temp\2cabb165dada42e1e19104601b59ab888f669e70.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\Users\Admin\AppData\Local\Temp\3513ed5e-cc76-41ce-a2f3-c6f08a8c2a80.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\37ec852f-af23-4b1c-ac53-2bdedec689fc.vbs

                                        Filesize

                                        738B

                                        MD5

                                        836b4492ae5f4ee9f7401581f1d86069

                                        SHA1

                                        9e4c307ef5281b190b2960a94f99a5ff25a1425e

                                        SHA256

                                        46000e0842c1c0e7d739484b42c6666fd70abbc1712c75eef6389787db08c58a

                                        SHA512

                                        d12e96b076a8d88ac0df7b4b8266ce6f1fe044cc4631f6de1561f862581ed836914e232557699c305dcf4bd04207087426110e766bad788bb2631a1e7f01b44e

                                      • C:\Users\Admin\AppData\Local\Temp\38beff78-6db4-4ad3-ae73-da695f383ddd.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\4776bb40-6d7d-44cd-9e4a-4dcdb921d473.vbs

                                        Filesize

                                        739B

                                        MD5

                                        22ba8b6eaead824d90367fbea994e092

                                        SHA1

                                        421abd4b5a45f5432d5edf0521207dd5bebf6375

                                        SHA256

                                        2bec7c202af7d671f4b2a6e751f34b1794e32fdd789d110421d338f7bb9b1329

                                        SHA512

                                        ced137a436d4922b496f09f0021e5705df4a8400386c0068c45e431e40c27e03dd289380a3252b0ce126195ff607bdf70a888c22d7d0d26d82f18ef0525bdf6c

                                      • C:\Users\Admin\AppData\Local\Temp\6cce3b71-ce66-4372-94be-b5aebb138519.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\764ef9f6-e6cf-4189-b8ee-7d7c7994f828.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\8188d727-d87d-46f7-977a-3e813f00fb3b.vbs

                                        Filesize

                                        739B

                                        MD5

                                        a8a73638587c5d3bb27d0f060c7c6bb3

                                        SHA1

                                        4aae3c956dd01d03eab172225c05fc02ed45d458

                                        SHA256

                                        61566dbfdc8a1512d7e9f400d77cb66faf7a9a615dd863f0aba0db208714ae9c

                                        SHA512

                                        68117e14d25392c46bd6bad3d00022d8051130ac7f779c92355fdd4fd762b21c8defd57fd196169a45fa0505bf13f7c42cb10a4d3fa02d70f097b16faf06bc3c

                                      • C:\Users\Admin\AppData\Local\Temp\84fed986-2aac-4175-ae87-4e2519289131.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\8d3db136-1657-4ca0-8b00-ae6796820123.vbs

                                        Filesize

                                        739B

                                        MD5

                                        a42730509405e9727f077fb1e10f05f6

                                        SHA1

                                        66a0fa3d14756369fb2971c1c6702ac19087b54d

                                        SHA256

                                        cbb5ec00a556328b7849141ed2518a6350c8453c1adefff2af7d689b508c0202

                                        SHA512

                                        d9a92e57630027f4f06120504b62f68b3d755f781969348046f8b70b3c8bb4f481e78593398f81c386d584a287a07fa10114b4f54b4f6cb218b914d85b12c18d

                                      • C:\Users\Admin\AppData\Local\Temp\a7844476-8e4e-4b7e-bc3f-79454c661585.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\ac64032d-c22d-4c37-9054-5ed1672efd3c.vbs

                                        Filesize

                                        515B

                                        MD5

                                        18286ed6e5cde0d765057ca3a580182a

                                        SHA1

                                        9a837e37d932ea7158cacbffe68c91161b73938f

                                        SHA256

                                        9c9aafb60ed7c381fb14ae1ebe19c16ec39ede5bf015b0898c03c3fdc543134b

                                        SHA512

                                        4fe6a680d2b13d72ea71201c1bb49553e8e03713286472c3d5d463b321c7876a40ea37e9c3873693657aa3ddb851638b1728d55f44f2582f3aaefbdee29a28a7

                                      • C:\Users\Admin\AppData\Local\Temp\bd89738d-0af5-4f1d-a4a5-792869bf4983.vbs

                                        Filesize

                                        739B

                                        MD5

                                        9deb15d3a1262b993c5d772b4bce8af8

                                        SHA1

                                        01a0698501643eec4e21e1e8eef49e482b07f463

                                        SHA256

                                        614eeb4b1e7ec3e81c7059fbb063f82014272f0a5fa6450395c0c4eaf6205486

                                        SHA512

                                        be7523016dd183615a7c5090bc5d8e7fdd3a98d1cfee2cc482e40c5dc42389f1981ea15c1701e2b0a812749d81741f62e4f0fe69fbe511c57122c7934482028c

                                      • C:\Users\Admin\AppData\Local\Temp\c27bbc71-6775-4ee3-b607-e84b32aee802.vbs

                                        Filesize

                                        738B

                                        MD5

                                        b88d4a3a4b740de33743386189d5158f

                                        SHA1

                                        8052965de2ac17880fea574168469991027fb252

                                        SHA256

                                        8cbefb3f2ec86e130b27011934fdb8d9133f54f5fb97f6c4c0ecf412980440af

                                        SHA512

                                        98200cd454719e905d9bc89472e5eac7c6a49d2446ccd4476ee8359df28e6385929784a8b7bbadb36e63a3e7957ef152eee4a211ad18808744c3a5c9141403a0

                                      • C:\Users\Admin\AppData\Local\Temp\d0c4cd8d-5d6d-49ad-b0b6-52c857eb6ea0.vbs

                                        Filesize

                                        739B

                                        MD5

                                        3331e33efbba06546fe247e8ca8a9fd4

                                        SHA1

                                        5a1a168c8341965ff0f135af8f0e7ccf15b875a9

                                        SHA256

                                        ca1866b0ca3e88ac1a094e8c50385c3e3bf98089b6e274eca848728bdd0a0fe2

                                        SHA512

                                        da73510a632e6000b209cf6e3bde7a891009c19db0465003afc287a4c94a1f9ca5ab6f57d49f695188a7ab13ccc0f76f6afa6df18f856eb32da7aa72e7e0807d

                                      • C:\Users\Admin\AppData\Local\Temp\d6456acd-8ee4-40f0-addb-79668c1996a8.vbs

                                        Filesize

                                        739B

                                        MD5

                                        bddb590cb06ef3328367070b291c5371

                                        SHA1

                                        7111891a457e0c78c45000e78f97355dc1bf380c

                                        SHA256

                                        a4eb43a315adc89e7fc602551590acebcddbc4e21cb8ec462dbc2e6b2661d04d

                                        SHA512

                                        0db89f0642e14dd2b7df5f82602164bc4ce019e19eec3797364b74c5cdf223bf0f5446b96d399964fd90326ec53e4ce1992608f6c8dbf8205aa399b6b71dc59d

                                      • C:\Users\Admin\AppData\Local\Temp\fb0f8bc6-5270-4044-9174-c7fe08174d44.vbs

                                        Filesize

                                        739B

                                        MD5

                                        c1299601ab47b8eebf141377a418aafa

                                        SHA1

                                        b21e99c9650380f5d0f8fea0a0bbc70e73a52a70

                                        SHA256

                                        54c0d8f804324b316adf4bf166e142367097729b91abdb60bae8e5a1303c953f

                                        SHA512

                                        75c0860a972205294a53f04dcae72db38e294efe76e17a2932fa817e0dedb47cd02ec346f999887451ee9e158d2993efc56f81fe965219897ee8d3b7b224fc9f

                                      • C:\driversessioncrt\7RYLxGVGAwiFGBwguvuUrv9KTj4HIJ.bat

                                        Filesize

                                        151B

                                        MD5

                                        40a5023d150998b4ba256dd94ea31230

                                        SHA1

                                        36702bfd3e71b3495e61ea589003bb856b959aca

                                        SHA256

                                        e9706a7a4d0fda27dac28f357e20d924779b307b0222c9a34f18701e5b78fbfc

                                        SHA512

                                        6deca418669bf26c67cbcc67f97478a445bf87ba3e1a886d479ee9a4ad736b0b47b196ed77e40f31ad2292ecbd43ec0129c0ce6a7b0915cc787f598577f26a15

                                      • C:\driversessioncrt\file.vbs

                                        Filesize

                                        34B

                                        MD5

                                        677cc4360477c72cb0ce00406a949c61

                                        SHA1

                                        b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

                                        SHA256

                                        f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

                                        SHA512

                                        7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

                                      • C:\driversessioncrt\iS3ZXZH7eGWUacRHzrnroa.vbe

                                        Filesize

                                        223B

                                        MD5

                                        d7664d494b1b6e05334ada9accc57d06

                                        SHA1

                                        2cc50d284a600e30287fdef5efe56a586199eb28

                                        SHA256

                                        531da88fff8963b42512583a711381b3ceef16ff6ff9763547e6eabf5665f9d6

                                        SHA512

                                        7e73fc680bd8aab94b89724c81cfd8e0b679ba0a9a4abca8dc522f1169f4123a8f2844677819190f1faba5df19c584fb1a7e7f2e361e57463050b7d3dc3eccb6

                                      • C:\driversessioncrt\winRefMonitor.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • C:\driversessioncrt\winRefMonitor.exe

                                        Filesize

                                        3.4MB

                                        MD5

                                        20ec8d347f674ebadc53399ef6aa49cb

                                        SHA1

                                        f418d228eb276f216b4986b55b2c762d11991a31

                                        SHA256

                                        9e7a70da8b8fbd3193c3a9c10cb1b120802a8ef88e4e1c4c03945cd87dc0dd2f

                                        SHA512

                                        e12b33da63567ab715a3040b3117ab52e98fe4d865811b4c9c4c17ef018c80a73cd2325f6a794d57c87b5065e41147df5d2246ffec5099b70c6d8c2330acfd44

                                      • memory/408-35-0x0000000002D30000-0x0000000002D3A000-memory.dmp

                                        Filesize

                                        40KB

                                      • memory/408-26-0x0000000002DE0000-0x0000000002E30000-memory.dmp

                                        Filesize

                                        320KB

                                      • memory/408-55-0x000000001C390000-0x000000001C39C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/408-20-0x00007FFEBEB50000-0x00007FFEBF611000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/408-54-0x000000001C380000-0x000000001C388000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-34-0x0000000002D20000-0x0000000002D30000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/408-33-0x0000000002D10000-0x0000000002D18000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-39-0x0000000002E40000-0x0000000002E4C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/408-40-0x000000001B990000-0x000000001B998000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-41-0x000000001B9A0000-0x000000001B9B2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/408-42-0x000000001C610000-0x000000001CB38000-memory.dmp

                                        Filesize

                                        5.2MB

                                      • memory/408-58-0x000000001C3C0000-0x000000001C3CC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/408-32-0x0000000002E50000-0x0000000002E5C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/408-31-0x0000000002DD0000-0x0000000002DE2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/408-30-0x0000000002DC0000-0x0000000002DC8000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-43-0x000000001C0E0000-0x000000001C0EC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/408-29-0x0000000002DA0000-0x0000000002DB6000-memory.dmp

                                        Filesize

                                        88KB

                                      • memory/408-44-0x000000001C0F0000-0x000000001C0FC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/408-46-0x000000001C110000-0x000000001C11C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/408-28-0x0000000002D90000-0x0000000002DA0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/408-88-0x00007FFEBEB50000-0x00007FFEBF611000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/408-27-0x0000000002D70000-0x0000000002D78000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-45-0x000000001C100000-0x000000001C108000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-19-0x00000000008A0000-0x0000000000C0A000-memory.dmp

                                        Filesize

                                        3.4MB

                                      • memory/408-47-0x000000001C120000-0x000000001C12C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/408-49-0x000000001C440000-0x000000001C44C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/408-48-0x000000001C330000-0x000000001C338000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-25-0x0000000002D50000-0x0000000002D6C000-memory.dmp

                                        Filesize

                                        112KB

                                      • memory/408-38-0x0000000002E30000-0x0000000002E38000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-24-0x0000000001500000-0x0000000001508000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-50-0x000000001C340000-0x000000001C34A000-memory.dmp

                                        Filesize

                                        40KB

                                      • memory/408-23-0x00000000014F0000-0x00000000014FE000-memory.dmp

                                        Filesize

                                        56KB

                                      • memory/408-51-0x000000001C350000-0x000000001C35E000-memory.dmp

                                        Filesize

                                        56KB

                                      • memory/408-37-0x0000000002D40000-0x0000000002D4C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/408-52-0x000000001C360000-0x000000001C368000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-22-0x00000000014E0000-0x00000000014EE000-memory.dmp

                                        Filesize

                                        56KB

                                      • memory/408-36-0x000000001B940000-0x000000001B996000-memory.dmp

                                        Filesize

                                        344KB

                                      • memory/408-53-0x000000001C370000-0x000000001C37E000-memory.dmp

                                        Filesize

                                        56KB

                                      • memory/408-21-0x00000000014D0000-0x00000000014E0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/408-56-0x000000001C3A0000-0x000000001C3A8000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/408-57-0x000000001C3B0000-0x000000001C3BA000-memory.dmp

                                        Filesize

                                        40KB

                                      • memory/860-92-0x000000001BFB0000-0x000000001BFC2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/860-89-0x00007FFEBEB50000-0x00007FFEBF611000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/860-103-0x00007FFEBEB50000-0x00007FFEBF611000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/860-90-0x000000001B7F0000-0x000000001B800000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/860-91-0x000000001B7E0000-0x000000001B7F2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/1660-152-0x000000001BBF0000-0x000000001BC00000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1660-163-0x00007FFEBEC70000-0x00007FFEBF731000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1660-151-0x00007FFEBEC70000-0x00007FFEBF731000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1748-120-0x00007FFEBEC70000-0x00007FFEBF731000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1748-109-0x000000001AF60000-0x000000001AFB6000-memory.dmp

                                        Filesize

                                        344KB

                                      • memory/1748-107-0x000000001B090000-0x000000001B0A0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1748-106-0x00007FFEBEC70000-0x00007FFEBF731000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/1748-108-0x0000000002630000-0x0000000002642000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2956-12-0x0000000000860000-0x0000000000C88000-memory.dmp

                                        Filesize

                                        4.2MB

                                      • memory/2956-0-0x0000000000860000-0x0000000000C88000-memory.dmp

                                        Filesize

                                        4.2MB

                                      • memory/3892-149-0x00007FFEBEC70000-0x00007FFEBF731000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3892-138-0x000000001B470000-0x000000001B482000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/3892-137-0x000000001B4A0000-0x000000001B4B0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/3892-136-0x00007FFEBEC70000-0x00007FFEBF731000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4840-166-0x000000001BE60000-0x000000001BE70000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4840-165-0x00007FFEBEC70000-0x00007FFEBF731000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4852-122-0x00007FFEBEC70000-0x00007FFEBF731000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/4852-123-0x000000001B370000-0x000000001B380000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/4852-134-0x00007FFEBEC70000-0x00007FFEBF731000-memory.dmp

                                        Filesize

                                        10.8MB