dcrat | dfdf2fdf2c2eb51f23f7cbe9003ae084e6a552032fadac0ee7b29d32876e3ac8

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f532bcaf7ab5bf19c152855abf535c5.exe
Size 1.7MB
Sample240509-2fcq5sde47
SHA256 dfdf2fdf2c2eb51f23f7cbe9003ae084e6a552032fadac0ee7b29d32876e3ac8
MD5 4f532bcaf7ab5bf19c152855abf535c5
SHA1 baef3146c3839bf07c0cb3f446b8359bff332ee4
SHA512 b4ed5ebe7ff508e81f488d046e86230624d1d1bc37fee25404bfa4c53eb25344a3c3171660d2686efee50ba831e14ab72e37b6b7f341bc4fb8930c8f44ef7f35
SSDEEP 49152:bVBe55gcW+nLV8DGHtovcGkNsYa3CYswN:bVI55gSZEGNnXa5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	4864	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	4864	schtasks.exe	89

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4f532bcaf7ab5bf19c152855abf535c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	4f532bcaf7ab5bf19c152855abf535c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	4f532bcaf7ab5bf19c152855abf535c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1560-1-0x0000000000D20000-0x0000000000ED0000-memory.dmp	dcrat
behavioral2/files/0x000700000002343f-28.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1944	powershell.exe
3980	powershell.exe
4028	powershell.exe
1360	powershell.exe
2636	powershell.exe
4408	powershell.exe
1168	powershell.exe
1064	powershell.exe
1652	powershell.exe
1400	powershell.exe
2144	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	4f532bcaf7ab5bf19c152855abf535c5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
4452	winlogon.exe
3788	winlogon.exe
2460	winlogon.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4f532bcaf7ab5bf19c152855abf535c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4f532bcaf7ab5bf19c152855abf535c5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\dllhost.exe	4f532bcaf7ab5bf19c152855abf535c5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\5940a34987c991	4f532bcaf7ab5bf19c152855abf535c5.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe	4f532bcaf7ab5bf19c152855abf535c5.exe
File opened for modification	C:\Program Files (x86)\Google\RCX87D7.tmp	4f532bcaf7ab5bf19c152855abf535c5.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\f3b6ecef712a24	4f532bcaf7ab5bf19c152855abf535c5.exe
File created	C:\Program Files\WindowsApps\TextInputHost.exe	4f532bcaf7ab5bf19c152855abf535c5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\dllhost.exe	4f532bcaf7ab5bf19c152855abf535c5.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX7AC2.tmp	4f532bcaf7ab5bf19c152855abf535c5.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RCX8351.tmp	4f532bcaf7ab5bf19c152855abf535c5.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe	4f532bcaf7ab5bf19c152855abf535c5.exe
File created	C:\Program Files (x86)\Google\StartMenuExperienceHost.exe	4f532bcaf7ab5bf19c152855abf535c5.exe
File created	C:\Program Files (x86)\Google\55b276f4edf653	4f532bcaf7ab5bf19c152855abf535c5.exe
File opened for modification	C:\Program Files (x86)\Google\StartMenuExperienceHost.exe	4f532bcaf7ab5bf19c152855abf535c5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1776	schtasks.exe
2712	schtasks.exe
3016	schtasks.exe
4632	schtasks.exe
4992	schtasks.exe
1780	schtasks.exe
3168	schtasks.exe
3708	schtasks.exe
3528	schtasks.exe
4172	schtasks.exe
4228	schtasks.exe
1784	schtasks.exe
3700	schtasks.exe
2144	schtasks.exe
4340	schtasks.exe
2392	schtasks.exe
4408	schtasks.exe
4572	schtasks.exe
116	schtasks.exe
1068	schtasks.exe
3244	schtasks.exe
968	schtasks.exe
2176	schtasks.exe
4840	schtasks.exe
3224	schtasks.exe
952	schtasks.exe
4780	schtasks.exe
3208	schtasks.exe
1516	schtasks.exe
4492	schtasks.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	4f532bcaf7ab5bf19c152855abf535c5.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	winlogon.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1560	4f532bcaf7ab5bf19c152855abf535c5.exe
1560	4f532bcaf7ab5bf19c152855abf535c5.exe
1560	4f532bcaf7ab5bf19c152855abf535c5.exe
1560	4f532bcaf7ab5bf19c152855abf535c5.exe
1560	4f532bcaf7ab5bf19c152855abf535c5.exe
1360	powershell.exe
1360	powershell.exe
1652	powershell.exe
1652	powershell.exe
3980	powershell.exe
3980	powershell.exe
2636	powershell.exe
2636	powershell.exe
1168	powershell.exe
1168	powershell.exe
1400	powershell.exe
1400	powershell.exe
4408	powershell.exe
4408	powershell.exe
2144	powershell.exe
2144	powershell.exe
4028	powershell.exe
4028	powershell.exe
1064	powershell.exe
1064	powershell.exe
1944	powershell.exe
1944	powershell.exe
1360	powershell.exe
1652	powershell.exe
3980	powershell.exe
1168	powershell.exe
4408	powershell.exe
2636	powershell.exe
1064	powershell.exe
1400	powershell.exe
2144	powershell.exe
4028	powershell.exe
1944	powershell.exe
4452	winlogon.exe
3788	winlogon.exe
2460	winlogon.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	4f532bcaf7ab5bf19c152855abf535c5.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	4452	winlogon.exe
Token: SeDebugPrivilege	3788	winlogon.exe
Token: SeDebugPrivilege	2460	winlogon.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1360	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	127
PID 1560 wrote to memory of 1360	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	127
PID 1560 wrote to memory of 1944	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	128
PID 1560 wrote to memory of 1944	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	128
PID 1560 wrote to memory of 2636	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	129
PID 1560 wrote to memory of 2636	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	129
PID 1560 wrote to memory of 4408	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	130
PID 1560 wrote to memory of 4408	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	130
PID 1560 wrote to memory of 1168	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	131
PID 1560 wrote to memory of 1168	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	131
PID 1560 wrote to memory of 1064	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	132
PID 1560 wrote to memory of 1064	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	132
PID 1560 wrote to memory of 1652	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	133
PID 1560 wrote to memory of 1652	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	133
PID 1560 wrote to memory of 1400	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	134
PID 1560 wrote to memory of 1400	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	134
PID 1560 wrote to memory of 3980	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	135
PID 1560 wrote to memory of 3980	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	135
PID 1560 wrote to memory of 4028	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	136
PID 1560 wrote to memory of 4028	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	136
PID 1560 wrote to memory of 2144	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	137
PID 1560 wrote to memory of 2144	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	137
PID 1560 wrote to memory of 4796	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	149
PID 1560 wrote to memory of 4796	1560	4f532bcaf7ab5bf19c152855abf535c5.exe	149
PID 4796 wrote to memory of 3180	4796	cmd.exe	152
PID 4796 wrote to memory of 3180	4796	cmd.exe	152
PID 4796 wrote to memory of 4452	4796	cmd.exe	154
PID 4796 wrote to memory of 4452	4796	cmd.exe	154
PID 4452 wrote to memory of 3092	4452	winlogon.exe	156
PID 4452 wrote to memory of 3092	4452	winlogon.exe	156
PID 4452 wrote to memory of 2316	4452	winlogon.exe	157
PID 4452 wrote to memory of 2316	4452	winlogon.exe	157
PID 3092 wrote to memory of 3788	3092	WScript.exe	160
PID 3092 wrote to memory of 3788	3092	WScript.exe	160
PID 3788 wrote to memory of 1244	3788	winlogon.exe	162
PID 3788 wrote to memory of 1244	3788	winlogon.exe	162
PID 3788 wrote to memory of 3536	3788	winlogon.exe	163
PID 3788 wrote to memory of 3536	3788	winlogon.exe	163
PID 1244 wrote to memory of 2460	1244	WScript.exe	170
PID 1244 wrote to memory of 2460	1244	WScript.exe	170
PID 2460 wrote to memory of 1588	2460	winlogon.exe	171
PID 2460 wrote to memory of 1588	2460	winlogon.exe	171
PID 2460 wrote to memory of 3896	2460	winlogon.exe	172
PID 2460 wrote to memory of 3896	2460	winlogon.exe	172

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	4f532bcaf7ab5bf19c152855abf535c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4f532bcaf7ab5bf19c152855abf535c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	4f532bcaf7ab5bf19c152855abf535c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4f532bcaf7ab5bf19c152855abf535c5.exe
"C:\Users\Admin\AppData\Local\Temp\4f532bcaf7ab5bf19c152855abf535c5.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4f532bcaf7ab5bf19c152855abf535c5.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Recent\upfc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NggDtzlG0U.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3180
- - C:\Recovery\WindowsRE\winlogon.exe
    "C:\Recovery\WindowsRE\winlogon.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4452
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\364d3dee-f7e9-4679-9acd-e9ffac628d6b.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Recovery\WindowsRE\winlogon.exe
        
        C:\Recovery\WindowsRE\winlogon.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3788
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03fcc9d0-6ba9-4ae8-805f-1a6bffe4cbfe.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Recovery\WindowsRE\winlogon.exe
        
        C:\Recovery\WindowsRE\winlogon.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6d3ba80-4576-48b5-8dc3-6598f469b3c8.vbs"
        8⤵
        
        PID:1588
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a8f0a81-da74-4a01-bd16-9b82d6e88ee8.vbs"
        8⤵
        
        PID:3896
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e6e88fe-828e-4347-8d7a-8eb5f0943144.vbs"
        6⤵
        
        PID:3536
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9979e3a8-2bfc-4ba7-881a-2b0e0ff6b81b.vbs"
      4⤵
      PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Adobe\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Desktop\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Recent\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Admin\Recent\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Recent\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Application Data\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Application Data\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogon.exe

Path C:\Recovery\WindowsRE\winlogon.exe
Size 1.7MB
SHA256 dfdf2fdf2c2eb51f23f7cbe9003ae084e6a552032fadac0ee7b29d32876e3ac8
MD5 4f532bcaf7ab5bf19c152855abf535c5
SHA1 baef3146c3839bf07c0cb3f446b8359bff332ee4
SHA512 b4ed5ebe7ff508e81f488d046e86230624d1d1bc37fee25404bfa4c53eb25344a3c3171660d2686efee50ba831e14ab72e37b6b7f341bc4fb8930c8f44ef7f35
SSDEEP 49152:bVBe55gcW+nLV8DGHtovcGkNsYa3CYswN:bVI55gSZEGNnXa5
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

winlogon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log
Size 1KB
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
MD5 6c47b3f4e68eebd47e9332eebfd2dd4e
SHA1 67f0b143336d7db7b281ed3de5e877fa87261834
SHA512 0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
MD5 SHA1 SHA512

Submit Download

03fcc9d0-6ba9-4ae8-805f-1a6bffe4cbfe.vbs

Path C:\Users\Admin\AppData\Local\Temp\03fcc9d0-6ba9-4ae8-805f-1a6bffe4cbfe.vbs
Size 710B
SHA256 f5a41ab0d0dabcc3a0ae98c88598dad5319dcd8fb2008e42a98b144f91caadb3
MD5 831090037367bd4b8ca477e8d4e2b793
SHA1 8d1dc1bba4f81a57e1da0adda25da5859ead679b
SHA512 d6db10726892bd5c2a89cd3df90c10327c3e32a6432677b38cf7ffa3f354647afa038f71736dfa27d94e1c95d54ba269e207ef455473fb58297d15d7dd8a0d49
MD5 SHA1 SHA512

Submit Download

364d3dee-f7e9-4679-9acd-e9ffac628d6b.vbs

Path C:\Users\Admin\AppData\Local\Temp\364d3dee-f7e9-4679-9acd-e9ffac628d6b.vbs
Size 710B
SHA256 b0d58b5c29e477b67e08d0fa82950b0f23e633022770df8bf4ebf19026acc2b5
MD5 971a080266b446c4dc63ed4a30d32a86
SHA1 51d51ce55d2c59cdf310a5898e24355e72f04d28
SHA512 f9873a3c549e00cf91e3820feee677ba4ffccf660ff90671a96aa5930cc740286a4bdb74a004cea786e970c2191552fff210c4ef2d3c52d6f2f2c23a6d8ed9e7
MD5 SHA1 SHA512

Submit Download

9979e3a8-2bfc-4ba7-881a-2b0e0ff6b81b.vbs

Path C:\Users\Admin\AppData\Local\Temp\9979e3a8-2bfc-4ba7-881a-2b0e0ff6b81b.vbs
Size 486B
SHA256 1b64d3f25a1d7509c1984446a2215f16fc970b502f359a7464bb4ce3620c6399
MD5 90f87a18f5aaa6c7217f8669e754ad9e
SHA1 3808323f245364961b45bc1aa59a2fb3c90a4383
SHA512 6fee885294cc823edcb4505faacf94aabe4986807ad8b5a5bd6abd6dddf0eb96865066b6650368dfacefe23b24a2cad7a61eafcb155f130d777ba774b773cd01
MD5 SHA1 SHA512

Submit Download

NggDtzlG0U.bat

Path C:\Users\Admin\AppData\Local\Temp\NggDtzlG0U.bat
Size 199B
SHA256 b5a3ecc3d57c4b54dabe8a248267eb47d66a94c199053145c1fb078937408cf4
MD5 ca94f19a2df3432383301cd7e82dad56
SHA1 5c5e0ef56c629783a00b5f8820b797d81004bac9
SHA512 82d654676e5b33c8a95defda7217933f4be33ad0f6e565ba46d708bb1a0b44cb89cc7c742773eb6b9d832d82941499ef409a5caa07e1b91d9a68394abef8806b
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_sew1tl0c.t3d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sew1tl0c.t3d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

d6d3ba80-4576-48b5-8dc3-6598f469b3c8.vbs

Path C:\Users\Admin\AppData\Local\Temp\d6d3ba80-4576-48b5-8dc3-6598f469b3c8.vbs
Size 710B
SHA256 019e5880a0409663aef69fff448cf4e3f883b6dbac73674e309154e5e54dacda
MD5 4fe9c5d71756007377cd0e9393b3c592
SHA1 41c2a500135073ff45a72bcf58b2d70de7d55ee4
SHA512 d5c47db708193c5b9a9810fc67d0cba937f1f4905cefb56c603c76ce46f7d7aaae58c04fb5a531a70592845a19c87af7aebdeedfce45f6c27ed972cfe80ffacf
MD5 SHA1 SHA512

Submit Download

memory/1360-124-0x0000022363580000-0x00000223635A2000-memory.dmp

Download

memory/1560-9-0x000000001C150000-0x000000001C158000-memory.dmp

Download

memory/1560-10-0x000000001C160000-0x000000001C172000-memory.dmp

Download

memory/1560-15-0x000000001C210000-0x000000001C21E000-memory.dmp

Download

memory/1560-14-0x000000001C200000-0x000000001C20A000-memory.dmp

Download

memory/1560-18-0x000000001C240000-0x000000001C24A000-memory.dmp

Download

memory/1560-17-0x000000001C230000-0x000000001C238000-memory.dmp

Download

memory/1560-19-0x000000001C250000-0x000000001C25C000-memory.dmp

Download

memory/1560-13-0x000000001C1F0000-0x000000001C1F8000-memory.dmp

Download

memory/1560-114-0x00007FFD5DB10000-0x00007FFD5E5D1000-memory.dmp

Download

memory/1560-12-0x000000001C1E0000-0x000000001C1EC000-memory.dmp

Download

memory/1560-11-0x000000001C710000-0x000000001CC38000-memory.dmp

Download

memory/1560-16-0x000000001C220000-0x000000001C22C000-memory.dmp

Download

memory/1560-0-0x00007FFD5DB13000-0x00007FFD5DB15000-memory.dmp

Download

memory/1560-7-0x000000001C120000-0x000000001C136000-memory.dmp

Download

memory/1560-8-0x000000001C140000-0x000000001C14A000-memory.dmp

Download

memory/1560-5-0x0000000003110000-0x0000000003118000-memory.dmp

Download

memory/1560-1-0x0000000000D20000-0x0000000000ED0000-memory.dmp

Download

memory/1560-6-0x0000000003120000-0x0000000003130000-memory.dmp

Download

memory/1560-4-0x000000001C170000-0x000000001C1C0000-memory.dmp

Download

memory/1560-3-0x00000000030F0000-0x000000000310C000-memory.dmp

Download

memory/1560-2-0x00007FFD5DB10000-0x00007FFD5E5D1000-memory.dmp

Download

memory/3788-253-0x000000001BC40000-0x000000001BC52000-memory.dmp

Download

memory/4452-240-0x000000001AEC0000-0x000000001AED2000-memory.dmp

Download