dcrat | 78e05cedaa8ac3d3361793ab8b19b6ba2147ea99cd6e406720e90dc5474fcda0

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/02/2024, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
132c11ac9545d4095a04e959370920aa.exe
Size 3.1MB
Sample240210-en3k7sae38
SHA256 78e05cedaa8ac3d3361793ab8b19b6ba2147ea99cd6e406720e90dc5474fcda0
MD5 132c11ac9545d4095a04e959370920aa
SHA1 6a01f059245a5aa70ff22e7901186fe57822a486
SHA512 6b53302f6d67fdce9f557e4a71dc5fc854e892a2ecf667a2cf5a824dec408e2b2d090a1482a7eb55527f14b05c66002fffe5ce5037168cd0a542ff0cd477f756
SSDEEP 98304:UbugDa3/Ja4ajpI4xiQ9jeRQx4QYGkPiJ:UygDSJlYJiKUQxgm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	2372	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2372	schtasks.exe	90

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	monitorDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	monitorDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	monitorDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000023205-10.dat	dcrat
behavioral2/memory/2328-12-0x0000000000C40000-0x0000000000F08000-memory.dmp	dcrat
behavioral2/files/0x0007000000023201-101.dat	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	monitorDll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	132c11ac9545d4095a04e959370920aa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2328	monitorDll.exe
812	fontdrvhost.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	monitorDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	monitorDll.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ipinfo.io
29	ipinfo.io

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\PackageManifests\wininit.exe	monitorDll.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\OfficeClickToRun.exe	monitorDll.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\e6c9b481da804f	monitorDll.exe
File created	C:\Program Files\7-Zip\Lang\9e8d7a4ca61bd9	monitorDll.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\56085415360792	monitorDll.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RuntimeBroker.exe	monitorDll.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\dllhost.exe	monitorDll.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\9e8d7a4ca61bd9	monitorDll.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RuntimeBroker.exe	monitorDll.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\wininit.exe	monitorDll.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\sysmon.exe	monitorDll.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Registration\OfficeClickToRun.exe	monitorDll.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\Registry.exe	monitorDll.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe	monitorDll.exe
File created	C:\Program Files\7-Zip\Lang\RuntimeBroker.exe	monitorDll.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe	monitorDll.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe	monitorDll.exe
File created	C:\Program Files (x86)\Windows Defender\ee2ad38f3d4382	monitorDll.exe
File created	C:\Program Files (x86)\Windows Portable Devices\sysmon.exe	monitorDll.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\5b884080fd4f94	monitorDll.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\RuntimeBroker.exe	monitorDll.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\9e8d7a4ca61bd9	monitorDll.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe	monitorDll.exe
File created	C:\Program Files (x86)\Windows Sidebar\dllhost.exe	monitorDll.exe
File created	C:\Program Files (x86)\Windows Sidebar\5940a34987c991	monitorDll.exe
File created	C:\Program Files (x86)\Windows Defender\Registry.exe	monitorDll.exe
File created	C:\Program Files (x86)\Windows Portable Devices\121e5b5079f7c0	monitorDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2424	schtasks.exe
1372	schtasks.exe
5000	schtasks.exe
2208	schtasks.exe
4604	schtasks.exe
4580	schtasks.exe
1288	schtasks.exe
3944	schtasks.exe
1732	schtasks.exe
792	schtasks.exe
2488	schtasks.exe
640	schtasks.exe
2184	schtasks.exe
1724	schtasks.exe
3756	schtasks.exe
556	schtasks.exe
2388	schtasks.exe
2076	schtasks.exe
2136	schtasks.exe
4272	schtasks.exe
3732	schtasks.exe
912	schtasks.exe
528	schtasks.exe
2632	schtasks.exe
4020	schtasks.exe
224	schtasks.exe
2824	schtasks.exe
3700	schtasks.exe
3552	schtasks.exe
4728	schtasks.exe
1388	schtasks.exe
4268	schtasks.exe
404	schtasks.exe
1072	schtasks.exe
1808	schtasks.exe
5064	schtasks.exe
1516	schtasks.exe
2432	schtasks.exe
2544	schtasks.exe
4456	schtasks.exe
2572	schtasks.exe
688	schtasks.exe
1640	schtasks.exe
4088	schtasks.exe
4168	schtasks.exe
1728	schtasks.exe
4024	schtasks.exe
4612	schtasks.exe
4092	schtasks.exe
1496	schtasks.exe
4980	schtasks.exe
4988	schtasks.exe
1956	schtasks.exe
4960	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	132c11ac9545d4095a04e959370920aa.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	monitorDll.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	fontdrvhost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2280	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe
2328	monitorDll.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
812	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	monitorDll.exe
Token: SeDebugPrivilege	812	fontdrvhost.exe
Token: SeBackupPrivilege	1072	vssvc.exe
Token: SeRestorePrivilege	1072	vssvc.exe
Token: SeAuditPrivilege	1072	vssvc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 624	4472	132c11ac9545d4095a04e959370920aa.exe	84
PID 4472 wrote to memory of 624	4472	132c11ac9545d4095a04e959370920aa.exe	84
PID 4472 wrote to memory of 624	4472	132c11ac9545d4095a04e959370920aa.exe	84
PID 624 wrote to memory of 1204	624	WScript.exe	85
PID 624 wrote to memory of 1204	624	WScript.exe	85
PID 624 wrote to memory of 1204	624	WScript.exe	85
PID 1204 wrote to memory of 2328	1204	cmd.exe	87
PID 1204 wrote to memory of 2328	1204	cmd.exe	87
PID 2328 wrote to memory of 2108	2328	monitorDll.exe	150
PID 2328 wrote to memory of 2108	2328	monitorDll.exe	150
PID 1204 wrote to memory of 2280	1204	cmd.exe	151
PID 1204 wrote to memory of 2280	1204	cmd.exe	151
PID 1204 wrote to memory of 2280	1204	cmd.exe	151
PID 2108 wrote to memory of 952	2108	cmd.exe	152
PID 2108 wrote to memory of 952	2108	cmd.exe	152
PID 2108 wrote to memory of 812	2108	cmd.exe	153
PID 2108 wrote to memory of 812	2108	cmd.exe	153
PID 812 wrote to memory of 2324	812	fontdrvhost.exe	154
PID 812 wrote to memory of 2324	812	fontdrvhost.exe	154
PID 812 wrote to memory of 2496	812	fontdrvhost.exe	155
PID 812 wrote to memory of 2496	812	fontdrvhost.exe	155

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	monitorDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	monitorDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	monitorDll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\132c11ac9545d4095a04e959370920aa.exe
"C:\Users\Admin\AppData\Local\Temp\132c11ac9545d4095a04e959370920aa.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\browserDriverhostdll\rpz2q0skhE.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\browserDriverhostdll\o5qCWswmRO9kFvTbwC5VMRYHXkr.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\browserDriverhostdll\monitorDll.exe
      "C:\browserDriverhostdll\monitorDll.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2328
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VWWZZaz3oW.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2108
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:952
      - C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c08aea31-dd55-45df-aacd-5b57941e7fa0.vbs"
        7⤵
        
        PID:2324
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f1bc1a3-6887-4ef9-8d7e-eeeb3af4ac56.vbs"
        7⤵
        
        PID:2496
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Users\Default\SendTo\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\SendTo\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Users\Default\SendTo\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\PackageManifests\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\PackageManifests\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\odt\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\odt\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\browserDriverhostdll\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\browserDriverhostdll\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\browserDriverhostdll\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\browserDriverhostdll\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\browserDriverhostdll\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\browserDriverhostdll\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2136

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe
Size 2.4MB
SHA256 d408ced1f6db995dee67afacd56b2db7ae1a4400bcf1f6c14ede40bcb2907a2d
MD5 b8d812e815220a701f81e90c48fecf0c
SHA1 3b71b1418adf6eebc32a926a9a3c9529cd3698fd
SHA512 29374a7c0119e2d7e14b3ead95818d035ff79be5e11ca4701117d3d1c54817acb40aa266f069b7f84478a68eb0491ee7dd2fea2aaac4b372f15d89d64b68c96a
SSDEEP 49152:yMdDa3/nJ7k334BksTBqNpI4T2m3yQ00FjeLmgAjxV+qMQ0Q8WuNrtaXLwn:ygDa3/Ja4ajpI4xiQ9jeRQx4QYGkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

1f1bc1a3-6887-4ef9-8d7e-eeeb3af4ac56.vbs

Path C:\Users\Admin\AppData\Local\Temp\1f1bc1a3-6887-4ef9-8d7e-eeeb3af4ac56.vbs
Size 514B
SHA256 e4ca9da7a56b6b4fdcf76f80e6e86e0e2799b39a068b48956e38605dcf8b4ca1
MD5 bb06b1277a7e6bcc1ce32fb4d960f152
SHA1 e5999c17b4c22fdee35986fc1add278fd5142e6e
SHA512 519e703451c8c35418abd6f1608f14b50c621bd789bbccfadf854a96094ca4a9e23020dcc44d86e00f87d520e618aec7c3a1f0b12cc47982c28d5d00fa8e9b02
MD5 SHA1 SHA512

Submit Download

VWWZZaz3oW.bat

Path C:\Users\Admin\AppData\Local\Temp\VWWZZaz3oW.bat
Size 227B
SHA256 df32e4feb82b658cd300de6f5e91aeb1eedd8425a33a4b3ce6cd38c2e6a99a4c
MD5 7363adc7773026c80f781c5ae4ceceb5
SHA1 ba338ea5a37ebd4f40103ed762d4f3fc48a9bb64
SHA512 cfbb8a3ee025a2a29b7ad48cff16da0c4c7ab680921be247269c10d4fef54e95b9cb578e7e2caaf7a59c5ed2bbe1515659014c2a762af955016b1d2a26096887
MD5 SHA1 SHA512

Submit Download

c08aea31-dd55-45df-aacd-5b57941e7fa0.vbs

Path C:\Users\Admin\AppData\Local\Temp\c08aea31-dd55-45df-aacd-5b57941e7fa0.vbs
Size 737B
SHA256 cb1729d70175a1c5145509f1117db9e928c5ace67b45d848a649b43dec9919c6
MD5 7eaf385172b9942450dc21d84833f483
SHA1 3ed638f8542565cf9d2b4b77d2cc03ca93f75594
SHA512 022702585d45892b074c7a907b2b5b75bd080aa7d0a19b8c395ceffb460838442db4e2727f4e04fc14131f469ddc6ebcc6def870f12aa7ac850277727a8ec0d2
MD5 SHA1 SHA512

Submit Download

tmpC28E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpC28E2.tmp
Size 1KB
SHA256 316a6b75db410c4d24edfd3736355d95a3bcbe2df1ca176324fac8599fc57525
MD5 c18914e68ae9eeed547c3620cc6c512f
SHA1 5648843e0b1ff224e631f6b0f05c17e6304484d1
SHA512 715be2617e3d6a6ee5b85b09e2b87ebc173a261c26873bb6facafba5e581d6e047b62c9cfafb8625f79948ea81088dbf4d68e0246a92ac9d6539acac22aeea67
MD5 SHA1 SHA512

Submit Download

monitorDll.exe

Path C:\browserDriverhostdll\monitorDll.exe
Size 2.8MB
SHA256 f2bce34c7134cb86ce9a577d6ee99a529cc268773ec27beb03f7676f512edacb
MD5 7e25254f622648de3fba537732772ad4
SHA1 2873b8ef12e98ae7b06a996981d3d4856069de07
SHA512 ff8af6dd9c5539e30d8a28070f9feffc951883da980cf4224661dab60003a4ee961c63a2134a9c91540f3be2a182b4ac2d83755fc576a52b3966daaa96661dd0
SSDEEP 49152:yMdDa3/nJ7k334BksTBqNpI4T2m3yQ00FjeLmgAjxV+qMQ0Q8WuNrtaXLwppiVRL:ygDa3/Ja4ajpI4xiQ9jeRQx4QYGkPi
MD5 SHA1 SHA512 SSDEEP

Submit Download

o5qCWswmRO9kFvTbwC5VMRYHXkr.bat

Path C:\browserDriverhostdll\o5qCWswmRO9kFvTbwC5VMRYHXkr.bat
Size 152B
SHA256 112f060c71c9dc70e5642e1ef5dc2c7f703696e3a7e51ad94ce399e6eeb4f625
MD5 a45497f732c680a5ce6ebe0981b453ad
SHA1 7d1bb31d3d971a3d1b2afd74891cc4f89805683d
SHA512 e3892609f1ef796096f4b89aa50c928cd5fed27b45f65dd58da5a6946b68113dad77632264190ec777d7832180ec7ac9ea33f96affd6ba5f8229ede830ed95a7
MD5 SHA1 SHA512

Submit Download

rpz2q0skhE.vbe

Path C:\browserDriverhostdll\rpz2q0skhE.vbe
Size 224B
SHA256 6c4f7047991f87cc00d1409365466fe9e6e369b51df2cc0092f33d5291af5827
MD5 01e6a8998df19a0bddc3e8fc3731e1dc
SHA1 f7e813a6c407ecbec29abcf118dac727cfb8433b
SHA512 7b2762e03dcbf76553e1cc6ffa3b6e383f3bde4b7fea6cc299a8a720576c63617e603508d1598c02828c0ea2ba5991bce41ba619f2c2c2753b42cf8772c00325
MD5 SHA1 SHA512

Submit Download

memory/812-116-0x000000001EBF0000-0x000000001F118000-memory.dmp

Download

memory/812-117-0x00007FFCF07F0000-0x00007FFCF12B1000-memory.dmp

Download

memory/812-114-0x000000001D850000-0x000000001DA12000-memory.dmp

Download

memory/812-118-0x000000001BA70000-0x000000001BA80000-memory.dmp

Download

memory/812-104-0x000000001BA70000-0x000000001BA80000-memory.dmp

Download

memory/812-103-0x00007FFCF07F0000-0x00007FFCF12B1000-memory.dmp

Download

memory/2328-18-0x000000001C150000-0x000000001C158000-memory.dmp

Download

memory/2328-36-0x000000001C610000-0x000000001C61A000-memory.dmp

Download

memory/2328-25-0x000000001C250000-0x000000001C25C000-memory.dmp

Download

memory/2328-26-0x000000001C260000-0x000000001C268000-memory.dmp

Download

memory/2328-27-0x000000001C270000-0x000000001C278000-memory.dmp

Download

memory/2328-28-0x000000001C280000-0x000000001C28C000-memory.dmp

Download

memory/2328-29-0x000000001C2D0000-0x000000001C2D8000-memory.dmp

Download

memory/2328-30-0x000000001C290000-0x000000001C29A000-memory.dmp

Download

memory/2328-33-0x000000001C2C0000-0x000000001C2CE000-memory.dmp

Download

memory/2328-32-0x000000001C2B0000-0x000000001C2B8000-memory.dmp

Download

memory/2328-31-0x000000001C2A0000-0x000000001C2AE000-memory.dmp

Download

memory/2328-34-0x000000001C2E0000-0x000000001C2EC000-memory.dmp

Download

memory/2328-35-0x000000001C500000-0x000000001C508000-memory.dmp

Download

memory/2328-24-0x000000001C240000-0x000000001C248000-memory.dmp

Download

memory/2328-37-0x000000001C510000-0x000000001C51C000-memory.dmp

Download

memory/2328-98-0x00007FFCF07F0000-0x00007FFCF12B1000-memory.dmp

Download

memory/2328-23-0x000000001C1F0000-0x000000001C246000-memory.dmp

Download

memory/2328-20-0x000000001C170000-0x000000001C186000-memory.dmp

Download

memory/2328-21-0x000000001C190000-0x000000001C198000-memory.dmp

Download

memory/2328-22-0x000000001C2F0000-0x000000001C2FA000-memory.dmp

Download

memory/2328-19-0x000000001C160000-0x000000001C170000-memory.dmp

Download

memory/2328-17-0x000000001C1A0000-0x000000001C1F0000-memory.dmp

Download

memory/2328-16-0x000000001C130000-0x000000001C14C000-memory.dmp

Download

memory/2328-15-0x000000001BC10000-0x000000001BC1E000-memory.dmp

Download

memory/2328-13-0x00007FFCF07F0000-0x00007FFCF12B1000-memory.dmp

Download

memory/2328-14-0x000000001BC20000-0x000000001BC30000-memory.dmp

Download

memory/2328-12-0x0000000000C40000-0x0000000000F08000-memory.dmp

Download