dcrat | 942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe
Size 8.4MB
Sample240517-mxhldsef97
SHA256 942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc
MD5 5d474e6a5232b3d3dd5576111a2b22a1
SHA1 60923eeaaf6334dde034a338302bcc25a2552618
SHA512 93794f9a4548c55ab64bdf0a72a5aa08271e7ca58793de0c20c34dbff679638c22a6515e8c402ed8cf41c0a8db25f2aea33a2552fb633f43fc1bcfd7d22fdfae
SSDEEP 98304:tVDbpZYm4jCCC08mudOK+rdYsL9mJ+C01l96Y:tVDbpZYxBC0wWrdYB+tl9B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat 55 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2600	schtasks.exe
		1732	schtasks.exe
		4992	schtasks.exe
		3036	schtasks.exe
		3312	schtasks.exe
		1896	schtasks.exe
		4900	schtasks.exe
		4476	schtasks.exe
		2700	schtasks.exe
		396	schtasks.exe
		4632	schtasks.exe
		4748	schtasks.exe
		2608	schtasks.exe
		4888	schtasks.exe
		2196	schtasks.exe
		3332	schtasks.exe
		1588	schtasks.exe
		4168	schtasks.exe
		4380	schtasks.exe
		2676	schtasks.exe
		1196	schtasks.exe
		4120	schtasks.exe
		4836	schtasks.exe
		5048	schtasks.exe
		3560	schtasks.exe
		2716	schtasks.exe
		4464	schtasks.exe
		3108	schtasks.exe
		2784	schtasks.exe
		2968	schtasks.exe
		2232	schtasks.exe
		4552	schtasks.exe
		4636	schtasks.exe
		2440	schtasks.exe
		2080	schtasks.exe
		1484	schtasks.exe
		4768	schtasks.exe
		1980	schtasks.exe
		1544	schtasks.exe
		4896	schtasks.exe
		2300	schtasks.exe
		732	schtasks.exe
		3368	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation		942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe
		2668	schtasks.exe
		3936	schtasks.exe
		2720	schtasks.exe
		3340	schtasks.exe
		1736	schtasks.exe
		4760	schtasks.exe
		4740	schtasks.exe
		3900	schtasks.exe
		4904	schtasks.exe
		1408	schtasks.exe
		2696	schtasks.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	3164	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	3164	schtasks.exe	89

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	runtimeDhcpCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	runtimeDhcpCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	runtimeDhcpCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/396-0-0x0000000000400000-0x0000000000C6C000-memory.dmp	dcrat
behavioral2/files/0x000a000000023401-67.dat	dcrat
behavioral2/files/0x0009000000023405-111.dat	dcrat
behavioral2/memory/3576-113-0x0000000000760000-0x0000000000ACA000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	runtimeDhcpCommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	System.exe

Executes dropped EXE 15 IoCs

pid	Process
3032	DCRatBuild.exe
3576	runtimeDhcpCommon.exe
3332	System.exe
3856	System.exe
2168	System.exe
4200	System.exe
1248	System.exe
4080	System.exe
2600	System.exe
3084	System.exe
1620	System.exe
1260	System.exe
1124	System.exe
756	System.exe
3684	System.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	runtimeDhcpCommon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	runtimeDhcpCommon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\WmiPrvSE.exe	runtimeDhcpCommon.exe
File created	C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\24dbde2999530e	runtimeDhcpCommon.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\9e8d7a4ca61bd9	runtimeDhcpCommon.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\spoolsv.exe	runtimeDhcpCommon.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\f3b6ecef712a24	runtimeDhcpCommon.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe	runtimeDhcpCommon.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\7a0fd90576e088	runtimeDhcpCommon.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RuntimeBroker.exe	runtimeDhcpCommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4120	schtasks.exe
3560	schtasks.exe
2440	schtasks.exe
1896	schtasks.exe
2232	schtasks.exe
4992	schtasks.exe
1732	schtasks.exe
3312	schtasks.exe
2668	schtasks.exe
1196	schtasks.exe
4836	schtasks.exe
2608	schtasks.exe
732	schtasks.exe
3900	schtasks.exe
4900	schtasks.exe
2696	schtasks.exe
1484	schtasks.exe
1408	schtasks.exe
1980	schtasks.exe
3332	schtasks.exe
3036	schtasks.exe
5048	schtasks.exe
4904	schtasks.exe
4748	schtasks.exe
396	schtasks.exe
4896	schtasks.exe
1736	schtasks.exe
4760	schtasks.exe
4888	schtasks.exe
3108	schtasks.exe
3936	schtasks.exe
4552	schtasks.exe
4476	schtasks.exe
4168	schtasks.exe
2196	schtasks.exe
2700	schtasks.exe
2300	schtasks.exe
4380	schtasks.exe
2600	schtasks.exe
2716	schtasks.exe
2080	schtasks.exe
2784	schtasks.exe
3368	schtasks.exe
2968	schtasks.exe
4464	schtasks.exe
4632	schtasks.exe
1544	schtasks.exe
3340	schtasks.exe
1588	schtasks.exe
2676	schtasks.exe
4768	schtasks.exe
4740	schtasks.exe
4636	schtasks.exe
2720	schtasks.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	System.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3576	runtimeDhcpCommon.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3332	System.exe
3856	System.exe
3856	System.exe
3856	System.exe
3856	System.exe
3856	System.exe
3856	System.exe
3856	System.exe
3856	System.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	runtimeDhcpCommon.exe
Token: SeDebugPrivilege	3332	System.exe
Token: SeDebugPrivilege	3856	System.exe
Token: SeDebugPrivilege	2168	System.exe
Token: SeDebugPrivilege	4200	System.exe
Token: SeDebugPrivilege	1248	System.exe
Token: SeDebugPrivilege	4080	System.exe
Token: SeDebugPrivilege	2600	System.exe
Token: SeDebugPrivilege	3084	System.exe
Token: SeDebugPrivilege	1620	System.exe
Token: SeDebugPrivilege	1260	System.exe
Token: SeDebugPrivilege	1124	System.exe
Token: SeDebugPrivilege	756	System.exe
Token: SeDebugPrivilege	3684	System.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 3032	396	942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe	93
PID 396 wrote to memory of 3032	396	942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe	93
PID 396 wrote to memory of 3032	396	942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe	93
PID 3032 wrote to memory of 3312	3032	DCRatBuild.exe	94
PID 3032 wrote to memory of 3312	3032	DCRatBuild.exe	94
PID 3032 wrote to memory of 3312	3032	DCRatBuild.exe	94
PID 3032 wrote to memory of 2148	3032	DCRatBuild.exe	95
PID 3032 wrote to memory of 2148	3032	DCRatBuild.exe	95
PID 3032 wrote to memory of 2148	3032	DCRatBuild.exe	95
PID 3312 wrote to memory of 2848	3312	WScript.exe	98
PID 3312 wrote to memory of 2848	3312	WScript.exe	98
PID 3312 wrote to memory of 2848	3312	WScript.exe	98
PID 2848 wrote to memory of 3576	2848	cmd.exe	100
PID 2848 wrote to memory of 3576	2848	cmd.exe	100
PID 3576 wrote to memory of 3332	3576	runtimeDhcpCommon.exe	155
PID 3576 wrote to memory of 3332	3576	runtimeDhcpCommon.exe	155
PID 3332 wrote to memory of 756	3332	System.exe	157
PID 3332 wrote to memory of 756	3332	System.exe	157
PID 3332 wrote to memory of 4336	3332	System.exe	158
PID 3332 wrote to memory of 4336	3332	System.exe	158
PID 756 wrote to memory of 3856	756	WScript.exe	160
PID 756 wrote to memory of 3856	756	WScript.exe	160
PID 3856 wrote to memory of 3760	3856	System.exe	162
PID 3856 wrote to memory of 3760	3856	System.exe	162
PID 3856 wrote to memory of 3028	3856	System.exe	163
PID 3856 wrote to memory of 3028	3856	System.exe	163
PID 3760 wrote to memory of 2168	3760	WScript.exe	164
PID 3760 wrote to memory of 2168	3760	WScript.exe	164
PID 2168 wrote to memory of 2332	2168	System.exe	165
PID 2168 wrote to memory of 2332	2168	System.exe	165
PID 2168 wrote to memory of 2220	2168	System.exe	166
PID 2168 wrote to memory of 2220	2168	System.exe	166
PID 2332 wrote to memory of 4200	2332	WScript.exe	167
PID 2332 wrote to memory of 4200	2332	WScript.exe	167
PID 4200 wrote to memory of 4752	4200	System.exe	168
PID 4200 wrote to memory of 4752	4200	System.exe	168
PID 4200 wrote to memory of 2472	4200	System.exe	169
PID 4200 wrote to memory of 2472	4200	System.exe	169
PID 4752 wrote to memory of 1248	4752	WScript.exe	171
PID 4752 wrote to memory of 1248	4752	WScript.exe	171
PID 1248 wrote to memory of 3492	1248	System.exe	172
PID 1248 wrote to memory of 3492	1248	System.exe	172
PID 1248 wrote to memory of 2720	1248	System.exe	173
PID 1248 wrote to memory of 2720	1248	System.exe	173
PID 3492 wrote to memory of 4080	3492	WScript.exe	174
PID 3492 wrote to memory of 4080	3492	WScript.exe	174
PID 4080 wrote to memory of 3576	4080	System.exe	175
PID 4080 wrote to memory of 3576	4080	System.exe	175
PID 4080 wrote to memory of 1704	4080	System.exe	176
PID 4080 wrote to memory of 1704	4080	System.exe	176
PID 3576 wrote to memory of 2600	3576	WScript.exe	177
PID 3576 wrote to memory of 2600	3576	WScript.exe	177
PID 2600 wrote to memory of 3000	2600	System.exe	178
PID 2600 wrote to memory of 3000	2600	System.exe	178
PID 2600 wrote to memory of 2680	2600	System.exe	179
PID 2600 wrote to memory of 2680	2600	System.exe	179
PID 3000 wrote to memory of 3084	3000	WScript.exe	184
PID 3000 wrote to memory of 3084	3000	WScript.exe	184
PID 3084 wrote to memory of 3248	3084	System.exe	185
PID 3084 wrote to memory of 3248	3084	System.exe	185
PID 3084 wrote to memory of 3356	3084	System.exe	186
PID 3084 wrote to memory of 3356	3084	System.exe	186
PID 3248 wrote to memory of 1620	3248	WScript.exe	187
PID 3248 wrote to memory of 1620	3248	WScript.exe	187

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	runtimeDhcpCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	runtimeDhcpCommon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	runtimeDhcpCommon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe
"C:\Users\Admin\AppData\Local\Temp\942f9e81e5d489676579e93f2e8f0c7af018399bbebf9d90f631333ab9853cbc.exe"
1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:396
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\surrogatedriverbroker\MX0u5YpaE0Bl8Q4tzHjuN5MlF.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\surrogatedriverbroker\iB8LDc93mffvsV4P5elLH7ibJvoD.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\surrogatedriverbroker\runtimeDhcpCommon.exe
        
        "C:\surrogatedriverbroker\runtimeDhcpCommon.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3576
      - C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5f3ade1-7858-4ad9-ab67-a3b37429168c.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f3af6c7-b296-404e-b984-cf4af6115098.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb5652ab-be32-4318-afbd-300c02ea3165.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59d9fae9-6e37-48a0-b31e-c1762332c5f2.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c0711e1-2fb1-4de2-9892-b39f0df4ff0c.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e0e725c3-5d1a-4222-941e-9d13d4f7fcc6.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48bd3e82-b7b6-498e-b202-442abb84c766.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        20⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8c5a765-b2f0-4b98-a53a-8e051c211b50.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        22⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e4d5e49-f258-4912-829b-843feca8cc92.vbs"
        23⤵
        
        PID:3844
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        24⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fefdf98d-b9b5-4c88-b301-aecfbea1eb24.vbs"
        25⤵
        
        PID:1948
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        26⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\055821e8-e045-4783-ad16-fe2869f495cd.vbs"
        27⤵
        
        PID:4636
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        28⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a75dc6a4-37dd-4063-bc55-64f6eaa171b5.vbs"
        29⤵
        
        PID:4332
        
        C:\Users\All Users\Templates\System.exe
        
        "C:\Users\All Users\Templates\System.exe"
        30⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3684
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45e4e674-3437-42f7-a5ff-9c823b2157a7.vbs"
        29⤵
        
        PID:2440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3d4cef9-1d4d-4a99-aff1-b11c19e1f647.vbs"
        27⤵
        
        PID:4720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a2b487a-b947-474d-bbbb-afaf85fd038b.vbs"
        25⤵
        
        PID:712
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3307ba4e-35e4-469c-9479-ead767024059.vbs"
        23⤵
        
        PID:4944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2601066c-b854-41c8-a5c5-6fbc94c8828a.vbs"
        21⤵
        
        PID:3356
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b5467a0-f668-493b-a7d5-0ba6b03d2de8.vbs"
        19⤵
        
        PID:2680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\92a0454c-6dd5-4c0f-8894-061b6c9d2022.vbs"
        17⤵
        
        PID:1704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa460d12-73f9-48d1-a3b1-44ca72c0f11b.vbs"
        15⤵
        
        PID:2720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e7a3a28-37e2-447c-83cd-cbd5b322f24c.vbs"
        13⤵
        
        PID:2472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbaab8ae-ef23-47e7-b8e1-a594dd363903.vbs"
        11⤵
        
        PID:2220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad818000-d029-4a4c-9aec-651549db1520.vbs"
        9⤵
        
        PID:3028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c28e7e49-c09b-4c4c-9582-622bf3f0f293.vbs"
        7⤵
        
        PID:4336
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\surrogatedriverbroker\file.vbs"
    3⤵
    PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\surrogatedriverbroker\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\surrogatedriverbroker\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\surrogatedriverbroker\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\surrogatedriverbroker\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\surrogatedriverbroker\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\surrogatedriverbroker\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\surrogatedriverbroker\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\surrogatedriverbroker\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\surrogatedriverbroker\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\Templates\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Templates\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Users\Public\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Public\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Users\Public\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\surrogatedriverbroker\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\surrogatedriverbroker\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\surrogatedriverbroker\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Desktop\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Desktop\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Templates\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\Templates\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\ssh\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\ssh\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\ssh\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log
Size 1KB
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
MD5 SHA1 SHA512

Submit Download

055821e8-e045-4783-ad16-fe2869f495cd.vbs

Path C:\Users\Admin\AppData\Local\Temp\055821e8-e045-4783-ad16-fe2869f495cd.vbs
Size 715B
SHA256 8c5bb9922c5fe51b407886376da585b94f7f6e49d3ff11747cb1f9edb8e87148
MD5 522945a4f92041f34dd82b64bf65b408
SHA1 569c2384b621d2c69c007e96d2d6cf96152b6010
SHA512 de50f6bad7caabeb5836f8d994cabb6ee43f37fd6718d43575cace7fe449d13cee66fd1ec7519a0c8fa4265cf1ebee6269b17bc88688b1c399cce0d38e401fc2
MD5 SHA1 SHA512

Submit Download

2f3af6c7-b296-404e-b984-cf4af6115098.vbs

Path C:\Users\Admin\AppData\Local\Temp\2f3af6c7-b296-404e-b984-cf4af6115098.vbs
Size 715B
SHA256 4d55a81893a298a00647257812e07f75aafd299799582a995572f319f6921b41
MD5 6757fcb4898d6ea953dd7e7d40c75dcf
SHA1 84c3d043e9ea4effe9901802c0c332bb1ba3984b
SHA512 1db3719c5d36b830030b1519897a0820cdbd2e7c5023e47d24c9a62b1335dd97a0702cbcf0b0913bcbd56f3910c5ee02f25e595675caa03cf78a5046dbc6ab05
MD5 SHA1 SHA512

Submit Download

3c0711e1-2fb1-4de2-9892-b39f0df4ff0c.vbs

Path C:\Users\Admin\AppData\Local\Temp\3c0711e1-2fb1-4de2-9892-b39f0df4ff0c.vbs
Size 715B
SHA256 883e07d4f70f4fa36c33a88ad2b48eb476a775055c82960ccb24f05dd0162aa6
MD5 cd84187981869432c0948263c064962a
SHA1 ec77985f316e8cc1208b2a0031ca6bec9b9fe21d
SHA512 f82d6acf9a24812646c0da25c585a372a7eb153cee6cf08a125bb190f869cd0f51f5d4d23877c742cedcb6ab7f5ee679edbac8b82497bdc3145b15ada28ca0f1
MD5 SHA1 SHA512

Submit Download

48bd3e82-b7b6-498e-b202-442abb84c766.vbs

Path C:\Users\Admin\AppData\Local\Temp\48bd3e82-b7b6-498e-b202-442abb84c766.vbs
Size 715B
SHA256 609b6a091e3f9500a37b30e1d3c69148a16d4d47c02e7341865a74b36fe8f7ff
MD5 b7e9f0a8e2d9bf408abecc20fb5e63bc
SHA1 d5be9f64d6eb724bfd5a8389195d9202d739180a
SHA512 b3535df432f90935662537707a0f6c0e43398112b4c9fd64ce1d75cbf1d115f0860412f1b97878c48c96c08d068b0be61c600f0164fa0f0867fc455a67e6ab86
MD5 SHA1 SHA512

Submit Download

59d9fae9-6e37-48a0-b31e-c1762332c5f2.vbs

Path C:\Users\Admin\AppData\Local\Temp\59d9fae9-6e37-48a0-b31e-c1762332c5f2.vbs
Size 715B
SHA256 1f1c5b3f81018ec0c4d2f08bd669e2a9dae7e37690401aad9e6d12fd923063b5
MD5 a56c2bfab0f48d934d350701e9c47a1b
SHA1 966a214da28f4b6983f7971df4d70af5baaa347e
SHA512 755b5ed7286e3d27dcc059a9d07b5a6a089c6b29ef7aa69c4362e12c016601d3db8bec98025ad7c1f583fbcfbc790b9a9ba5874207efa00d85abc86fc55c4754
MD5 SHA1 SHA512

Submit Download

7e4d5e49-f258-4912-829b-843feca8cc92.vbs

Path C:\Users\Admin\AppData\Local\Temp\7e4d5e49-f258-4912-829b-843feca8cc92.vbs
Size 715B
SHA256 315669377fb1020b9e2577df9196fbdd03be51a00aa0ed236f47ecef5b8c213c
MD5 9ba993bcd6b1ed2c6e7c50c6ae9f2637
SHA1 2c316a017cadf956fb2519049ce474d7ae9444fc
SHA512 37cbf6f390bc9d0829ffaae8715ac5b94a1c91952306178661e0e16959ef279d2a5a6e5d097b94f5eb2562b00fd8990c9a4698d95a7e1afdd243fe0e345c77f4
MD5 SHA1 SHA512

Submit Download

DCRatBuild.exe

Path C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
Size 3.7MB
SHA256 50548a8353e5f24e36e11a4dfa2beb766b1adc1d358c54202447c8d389212eb5
MD5 d26ea8a9103b82d0e4f80b687f0c1adc
SHA1 811bc8c8b6fcca69882e483ed0d59d45e7851f1a
SHA512 68583d1f11ff00baebc5271e852848c7df76ff32df4788f91792d98728cbd69ccd04e4814265ecbb12b79ddd46bad35aafe1192551f526ff616df3e97ea7884e
SSDEEP 49152:UbA30gBgQZtPwh31vnmuT5p9sO02zAZs+UYg+O8uFpIyPnbBJNKVtEeZDT6XbqMN:UbgC3BmuTVF9grnE86pbfbB4E06q0l
MD5 SHA1 SHA512 SSDEEP

Submit Download

New Project 1.exe

Path C:\Users\Admin\AppData\Local\Temp\New Project 1.exe
Size 1KB
SHA256 418b1fb225defe29d9605e560757d93048210818c49dce49f62a1f7f5e02f2fc
MD5 bba499baa7c430d4f0bac0b231e75b82
SHA1 743a8a70bae9478061103d668b0d000371fd1840
SHA512 17c745b9919405a6243564b7f44c7b9e3ae586dec6a2947572072b2c45a65e020cbcaf54f0761393cf088f7f4006492cda22ae3e9d19d416fd35a66f49e6cdeb
MD5 SHA1 SHA512

Submit Download

a5f3ade1-7858-4ad9-ab67-a3b37429168c.vbs

Path C:\Users\Admin\AppData\Local\Temp\a5f3ade1-7858-4ad9-ab67-a3b37429168c.vbs
Size 715B
SHA256 9d3d89c7274f24b20901563e0a6330d064538f101e3815b26cab39e075bacfcd
MD5 c308e060fe9916446caae1e26e8fcfd6
SHA1 adf8a292b80bb15dd2ffc0e5ff9d2321ec0efcab
SHA512 243dfb2960beee343752135246bab1f809839943ce2ccfcc1c0b7dc538a60e27e518e174e0f1d974ae756d43a5ace1bbf9b196a5b6b3fb2800c1bce5df935fcb
MD5 SHA1 SHA512

Submit Download

a75dc6a4-37dd-4063-bc55-64f6eaa171b5.vbs

Path C:\Users\Admin\AppData\Local\Temp\a75dc6a4-37dd-4063-bc55-64f6eaa171b5.vbs
Size 714B
SHA256 aae93a0bb61fcd14ed9f12ebf43d3dee79d5fa1e8d5c5bcedabc2336e85369f3
MD5 536cb2ba06f3a362fac59f9fb66428f8
SHA1 9f26b16b6ccd090a09bc02c7537201c266ff5377
SHA512 dab1c07a40904bad6bb1c2598bb2db8fbb77d362d5bebb726c9361f94cdd56ceb1fdceabe99de4546300dee1d25f9f85bcfec2d68c6807361bd90757365e0d9c
MD5 SHA1 SHA512

Submit Download

bb5652ab-be32-4318-afbd-300c02ea3165.vbs

Path C:\Users\Admin\AppData\Local\Temp\bb5652ab-be32-4318-afbd-300c02ea3165.vbs
Size 715B
SHA256 2b4ed3a604bbc8d39c6660cd73cab75090eef8e5fd932cce84d5c46b2f3ce0f6
MD5 2c4bb6607b87115eee4da3f03306bb95
SHA1 deab19126bef140c32ea31cb6aadf3b6f84abf56
SHA512 8d35f39770d9f139540005f0f789a800ce8704a060c8cc87d25bc1c8775566e023778f485a819f94edb4ef3b3050ac0505390feee719281bf1aa8e5b0ad868fb
MD5 SHA1 SHA512

Submit Download

c28e7e49-c09b-4c4c-9582-622bf3f0f293.vbs

Path C:\Users\Admin\AppData\Local\Temp\c28e7e49-c09b-4c4c-9582-622bf3f0f293.vbs
Size 491B
SHA256 2c4fc1a58e01b6ac4866cd52f06195c3e9a6e3a687f5fb2bbdcb30013a2f35a0
MD5 78686aedd829ee408ca08c0209c1e0c1
SHA1 3cf49982b23d07804e8be980dcd8e55b6a30e2eb
SHA512 70e7c9882131f535223427bc57a825da1c80674051627fc6642eb9c7c555e27cf7546d8b034eab9416ca3b0135773f992fed530123444247f83e3dae25a5c62c
MD5 SHA1 SHA512

Submit Download

c8c5a765-b2f0-4b98-a53a-8e051c211b50.vbs

Path C:\Users\Admin\AppData\Local\Temp\c8c5a765-b2f0-4b98-a53a-8e051c211b50.vbs
Size 715B
SHA256 a4d43b2e2c7f6ea77844bf1f3867b0625ce7b8fe654b58e3028810d866bc69b2
MD5 7e46917ddab88aa7e4d4f73234782e27
SHA1 7d2e584876bbb588660317659eb40175fb8e18d2
SHA512 801a79d17b00faf6d10461f07deb1e9ea061cda71778cc5e8514bb154331a5d62272b9bfceb4ba493243b9aaeabf9107aaaeb697849e065f999c45e49e849bd8
MD5 SHA1 SHA512

Submit Download

channels4_profile.ico

Path C:\Users\Admin\AppData\Local\Temp\channels4_profile.ico
Size 264KB
SHA256 c94678aff77a06737177b585f5c4139d5c67d41711754f055e9bed480522b7b1
MD5 18cc2b457a795b627b37dda9cfd355c5
SHA1 5778d3f45a662a681788e16426afdd266707f672
SHA512 cd68c7304443aa951898fef5a45da3fb689f7c61bf1c468f2d19a8e929bc1c8b5f0c90caac630457ba27114a131fb80e5dc3ad3e4886fce91ca82a3ffcbfd75d
SSDEEP 3072:yL9HMdKsC88nfZ+9bTyzVs1Ztyo4FGGypB66+K4oYt63ob+mhmG9obHU59hq1kCg:KpMD8nfmTQe1qF4Gi6K4oWGobKG9ax
MD5 SHA1 SHA512 SSDEEP

Submit Download

e0e725c3-5d1a-4222-941e-9d13d4f7fcc6.vbs

Path C:\Users\Admin\AppData\Local\Temp\e0e725c3-5d1a-4222-941e-9d13d4f7fcc6.vbs
Size 715B
SHA256 2c77e5d980f44b28e2266b1a6c3018ecf6d9d827e4a7ee6edb9a6e8367c006e5
MD5 2aaa3822c6077fc0fba140318b1f1e96
SHA1 4801aa303ebf6fefe276103f4b7bc01663a51c25
SHA512 91e3093b32ba9fd0bd0b625ce6fb8c888852d7b136a4278c0af05f4d63a5527eaa734047cb62777515a1d465d4150692559396f673eae5f6a3e957a2f54f92a2
MD5 SHA1 SHA512

Submit Download

fefdf98d-b9b5-4c88-b301-aecfbea1eb24.vbs

Path C:\Users\Admin\AppData\Local\Temp\fefdf98d-b9b5-4c88-b301-aecfbea1eb24.vbs
Size 715B
SHA256 c80fe71f09fb2ede5175055295e0f2db5ef4ab1fc2ad2dc3a700b9aa570206b3
MD5 1c3a2b4dc4fb0cef210d318be0ebc90d
SHA1 3180bbbb9fcf1276429a7e1195f3441652982cbb
SHA512 ad460262906ae40a2a1184de4918fa3a88d0dd6c55fcecc61d6ce3135aabdc9de096b54f63db653a8a65d7bbb7db2fdbe28270a0f020c6db8579c6bd0949fca4
MD5 SHA1 SHA512

Submit Download

MX0u5YpaE0Bl8Q4tzHjuN5MlF.vbe

Path C:\surrogatedriverbroker\MX0u5YpaE0Bl8Q4tzHjuN5MlF.vbe
Size 226B
SHA256 3329d6bb2e9c7115fb8ac58881e94796069d0b7874abccc4a0bc7718731de27e
MD5 d9095993dc975aad0602ba66b32dad3d
SHA1 8c26fd1ad732827301e5af7de044420f0c06fbbe
SHA512 2c7adbd664c8ee7aa84c12eea0e7685f5e2275c9cd19f9a1dece9f9e3f958f9b05339be799b643fe1a0e20d8fb74ca3df0fcb9903d830137fa774b13281d7d3a
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\surrogatedriverbroker\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

iB8LDc93mffvsV4P5elLH7ibJvoD.bat

Path C:\surrogatedriverbroker\iB8LDc93mffvsV4P5elLH7ibJvoD.bat
Size 48B
SHA256 3628bedd47e43459572a27570f4cf9c4ef2083703c2fbc32f3f7a67b7a109371
MD5 85cfb82d14d95349f280e53f0764fbfc
SHA1 645a8f36343a8e4b88966ab70a4a24f49b9ca2b9
SHA512 02cb06aa443a044f0f1a492a2e30e3d9521902a9fefba54a829bffbb37eed07e4e1c9753cd8cca71baa1a1229343ecbd05940389165e35fc71b90f48fc1191e8
MD5 SHA1 SHA512

Submit Download

runtimeDhcpCommon.exe

Path C:\surrogatedriverbroker\runtimeDhcpCommon.exe
Size 3.4MB
SHA256 0704d02dd6f8b50b3b60652096539fe51cd5ae2d3b4092763245dfcf8dc68316
MD5 dc167730759f4877ed79888e1f365249
SHA1 5ce03602609fa90f26b3a6774519c006a9c20bf6
SHA512 d027f85c981d182b2f4bc359d86e1093c2a2ab72a78dc5d408bbb103c0626e0da3063173710ffbf2c94e2080aefe56154d371f39f09a9e6e1f4a1cd62e20140b
SSDEEP 49152:dBgQZtPwh31vnmuT5p9sO02zAZs+UYg+O8uFpIyPnbBJNKVtEeZDT6XbqMSsvxu:BC3BmuTVF9grnE86pbfbB4E06q0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-0-0x0000000000400000-0x0000000000C6C000-memory.dmp

Download

memory/1248-245-0x000000001B880000-0x000000001B892000-memory.dmp

Download

memory/1260-302-0x000000001BF50000-0x000000001BF62000-memory.dmp

Download

memory/2168-222-0x000000001BE80000-0x000000001BE92000-memory.dmp

Download

memory/3576-121-0x000000001BD60000-0x000000001BD76000-memory.dmp

Download

memory/3576-150-0x000000001C3C0000-0x000000001C3CC000-memory.dmp

Download

memory/3576-133-0x000000001BFB0000-0x000000001BFC2000-memory.dmp

Download

memory/3576-134-0x000000001C510000-0x000000001CA38000-memory.dmp

Download

memory/3576-135-0x000000001BFE0000-0x000000001BFEC000-memory.dmp

Download

memory/3576-136-0x000000001BFF0000-0x000000001BFFC000-memory.dmp

Download

memory/3576-137-0x000000001C000000-0x000000001C008000-memory.dmp

Download

memory/3576-138-0x000000001C010000-0x000000001C01C000-memory.dmp

Download

memory/3576-139-0x000000001C020000-0x000000001C02C000-memory.dmp

Download

memory/3576-140-0x000000001C2A0000-0x000000001C2A8000-memory.dmp

Download

memory/3576-141-0x000000001C230000-0x000000001C23C000-memory.dmp

Download

memory/3576-142-0x000000001C240000-0x000000001C24A000-memory.dmp

Download

memory/3576-143-0x000000001C250000-0x000000001C25E000-memory.dmp

Download

memory/3576-144-0x000000001C260000-0x000000001C268000-memory.dmp

Download

memory/3576-145-0x000000001C270000-0x000000001C27E000-memory.dmp

Download

memory/3576-146-0x000000001C280000-0x000000001C288000-memory.dmp

Download

memory/3576-147-0x000000001C290000-0x000000001C29C000-memory.dmp

Download

memory/3576-148-0x000000001C3B0000-0x000000001C3B8000-memory.dmp

Download

memory/3576-149-0x000000001C4C0000-0x000000001C4CA000-memory.dmp

Download

memory/3576-132-0x000000001BFA0000-0x000000001BFA8000-memory.dmp

Download

memory/3576-131-0x000000001BF90000-0x000000001BF9C000-memory.dmp

Download

memory/3576-130-0x000000001BF80000-0x000000001BF88000-memory.dmp

Download

memory/3576-129-0x000000001BF70000-0x000000001BF7C000-memory.dmp

Download

memory/3576-128-0x000000001BF20000-0x000000001BF76000-memory.dmp

Download

memory/3576-127-0x000000001BF10000-0x000000001BF1A000-memory.dmp

Download

memory/3576-126-0x000000001BF00000-0x000000001BF10000-memory.dmp

Download

memory/3576-125-0x000000001BDA0000-0x000000001BDA8000-memory.dmp

Download

memory/3576-124-0x000000001BD80000-0x000000001BD8C000-memory.dmp

Download

memory/3576-123-0x000000001BD90000-0x000000001BDA2000-memory.dmp

Download

memory/3576-113-0x0000000000760000-0x0000000000ACA000-memory.dmp

Download

memory/3576-122-0x000000001B640000-0x000000001B648000-memory.dmp

Download

memory/3576-120-0x000000001B630000-0x000000001B640000-memory.dmp

Download

memory/3576-119-0x000000001B620000-0x000000001B628000-memory.dmp

Download

memory/3576-118-0x000000001BDB0000-0x000000001BE00000-memory.dmp

Download

memory/3576-117-0x000000001B600000-0x000000001B61C000-memory.dmp

Download

memory/3576-116-0x000000001B5F0000-0x000000001B5F8000-memory.dmp

Download

memory/3576-115-0x0000000002C00000-0x0000000002C0E000-memory.dmp

Download

memory/3576-114-0x0000000002BF0000-0x0000000002BFE000-memory.dmp

Download

memory/4080-257-0x000000001BB40000-0x000000001BB96000-memory.dmp

Download