dcrat | 32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
Size 1.4MB
Sample240528-e52egafg85
SHA256 32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d
MD5 32c213bef0a51b3310d80ffc4f7a7f8f
SHA1 0a5bde9d32b4593d52e68539dc1c607f83d716b4
SHA512 26acc82685d297f00c6b022e0d737fb52f2ac1352d9bdcdac8ec2f259c2f2194c79a06c173f804f1eb85c91252c36be24458fc77134815aca2b9abfd142c2a80
SSDEEP 24576:jwJfwwCPMBkgUQ8KaZhBvUO5VeRBJLpN/cNkNf9qwMjTmI:jwZdegxer9VKBFpBcNkbMj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4052	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	4052	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	4052	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	4052	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	4052	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	4052	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	4052	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	4052	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	4052	schtasks.exe	85

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4652-1-0x00000000000A0000-0x0000000000204000-memory.dmp	dcrat
behavioral2/files/0x0008000000023427-25.dat	dcrat
behavioral2/files/0x000d00000002338a-173.dat	dcrat

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 18 IoCs

pid	Process
3504	Idle.exe
3716	Idle.exe
2036	Idle.exe
2316	Idle.exe
4860	Idle.exe
2112	Idle.exe
4376	Idle.exe
3288	Idle.exe
3632	Idle.exe
3344	Idle.exe
4620	Idle.exe
440	Idle.exe
1824	Idle.exe
3584	Idle.exe
4772	Idle.exe
3100	Idle.exe
3296	Idle.exe
3260	Idle.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\sihost.exe	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\66fc9ff0ee96c2	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RCX3F4D.tmp	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\sihost.exe	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\en-US\69ddcba757bf72	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCX3D48.tmp	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
File created	C:\Windows\DigitalLocker\en-US\smss.exe	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\smss.exe	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1368	schtasks.exe
4892	schtasks.exe
2648	schtasks.exe
2388	schtasks.exe
4764	schtasks.exe
4572	schtasks.exe
5016	schtasks.exe
1564	schtasks.exe
3128	schtasks.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Idle.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4652	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
3504	Idle.exe
3716	Idle.exe
2036	Idle.exe
2316	Idle.exe
4860	Idle.exe
2112	Idle.exe
4376	Idle.exe
3288	Idle.exe
3632	Idle.exe
3344	Idle.exe
4620	Idle.exe
440	Idle.exe
1824	Idle.exe
3584	Idle.exe
4772	Idle.exe
3100	Idle.exe
3296	Idle.exe
3260	Idle.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
Token: SeDebugPrivilege	3504	Idle.exe
Token: SeDebugPrivilege	3716	Idle.exe
Token: SeDebugPrivilege	2036	Idle.exe
Token: SeDebugPrivilege	2316	Idle.exe
Token: SeDebugPrivilege	4860	Idle.exe
Token: SeDebugPrivilege	2112	Idle.exe
Token: SeDebugPrivilege	4376	Idle.exe
Token: SeDebugPrivilege	3288	Idle.exe
Token: SeDebugPrivilege	3632	Idle.exe
Token: SeDebugPrivilege	3344	Idle.exe
Token: SeDebugPrivilege	4620	Idle.exe
Token: SeDebugPrivilege	440	Idle.exe
Token: SeDebugPrivilege	1824	Idle.exe
Token: SeDebugPrivilege	3584	Idle.exe
Token: SeDebugPrivilege	4772	Idle.exe
Token: SeDebugPrivilege	3100	Idle.exe
Token: SeDebugPrivilege	3296	Idle.exe
Token: SeDebugPrivilege	3260	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 3504	4652	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe	99
PID 4652 wrote to memory of 3504	4652	32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe	99
PID 3504 wrote to memory of 1988	3504	Idle.exe	101
PID 3504 wrote to memory of 1988	3504	Idle.exe	101
PID 3504 wrote to memory of 3216	3504	Idle.exe	102
PID 3504 wrote to memory of 3216	3504	Idle.exe	102
PID 1988 wrote to memory of 3716	1988	WScript.exe	106
PID 1988 wrote to memory of 3716	1988	WScript.exe	106
PID 3716 wrote to memory of 4988	3716	Idle.exe	107
PID 3716 wrote to memory of 4988	3716	Idle.exe	107
PID 3716 wrote to memory of 2752	3716	Idle.exe	108
PID 3716 wrote to memory of 2752	3716	Idle.exe	108
PID 4988 wrote to memory of 2036	4988	WScript.exe	109
PID 4988 wrote to memory of 2036	4988	WScript.exe	109
PID 2036 wrote to memory of 2060	2036	Idle.exe	110
PID 2036 wrote to memory of 2060	2036	Idle.exe	110
PID 2036 wrote to memory of 1864	2036	Idle.exe	111
PID 2036 wrote to memory of 1864	2036	Idle.exe	111
PID 2060 wrote to memory of 2316	2060	WScript.exe	112
PID 2060 wrote to memory of 2316	2060	WScript.exe	112
PID 2316 wrote to memory of 4088	2316	Idle.exe	113
PID 2316 wrote to memory of 4088	2316	Idle.exe	113
PID 2316 wrote to memory of 3172	2316	Idle.exe	114
PID 2316 wrote to memory of 3172	2316	Idle.exe	114
PID 4088 wrote to memory of 4860	4088	WScript.exe	116
PID 4088 wrote to memory of 4860	4088	WScript.exe	116
PID 4860 wrote to memory of 1772	4860	Idle.exe	117
PID 4860 wrote to memory of 1772	4860	Idle.exe	117
PID 4860 wrote to memory of 536	4860	Idle.exe	118
PID 4860 wrote to memory of 536	4860	Idle.exe	118
PID 1772 wrote to memory of 2112	1772	WScript.exe	119
PID 1772 wrote to memory of 2112	1772	WScript.exe	119
PID 2112 wrote to memory of 2012	2112	Idle.exe	120
PID 2112 wrote to memory of 2012	2112	Idle.exe	120
PID 2112 wrote to memory of 1856	2112	Idle.exe	121
PID 2112 wrote to memory of 1856	2112	Idle.exe	121
PID 2012 wrote to memory of 4376	2012	WScript.exe	122
PID 2012 wrote to memory of 4376	2012	WScript.exe	122
PID 4376 wrote to memory of 4212	4376	Idle.exe	123
PID 4376 wrote to memory of 4212	4376	Idle.exe	123
PID 4376 wrote to memory of 1992	4376	Idle.exe	124
PID 4376 wrote to memory of 1992	4376	Idle.exe	124
PID 4212 wrote to memory of 3288	4212	WScript.exe	125
PID 4212 wrote to memory of 3288	4212	WScript.exe	125
PID 3288 wrote to memory of 2556	3288	Idle.exe	126
PID 3288 wrote to memory of 2556	3288	Idle.exe	126
PID 3288 wrote to memory of 4516	3288	Idle.exe	127
PID 3288 wrote to memory of 4516	3288	Idle.exe	127
PID 2556 wrote to memory of 3632	2556	WScript.exe	128
PID 2556 wrote to memory of 3632	2556	WScript.exe	128
PID 3632 wrote to memory of 2656	3632	Idle.exe	129
PID 3632 wrote to memory of 2656	3632	Idle.exe	129
PID 3632 wrote to memory of 2444	3632	Idle.exe	130
PID 3632 wrote to memory of 2444	3632	Idle.exe	130
PID 2656 wrote to memory of 3344	2656	WScript.exe	131
PID 2656 wrote to memory of 3344	2656	WScript.exe	131
PID 3344 wrote to memory of 3036	3344	Idle.exe	132
PID 3344 wrote to memory of 3036	3344	Idle.exe	132
PID 3344 wrote to memory of 1528	3344	Idle.exe	133
PID 3344 wrote to memory of 1528	3344	Idle.exe	133
PID 3036 wrote to memory of 4620	3036	WScript.exe	134
PID 3036 wrote to memory of 4620	3036	WScript.exe	134
PID 4620 wrote to memory of 3788	4620	Idle.exe	135
PID 4620 wrote to memory of 3788	4620	Idle.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe
"C:\Users\Admin\AppData\Local\Temp\32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Default\Cookies\Idle.exe
  "C:\Users\Default\Cookies\Idle.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd3b04c1-09fb-456e-8ccf-00f5caf92f08.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Users\Default\Cookies\Idle.exe
      C:\Users\Default\Cookies\Idle.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3716
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ecf3f7d3-cd22-47e0-a7c3-2d92bab0d406.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4988
      - C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce650f3b-1d7c-4e3f-aa98-1927efa3c885.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\512ba9dc-4031-431f-8475-3ca9147e8b28.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\142fb953-4bd4-4e28-ac22-762e76018256.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20ba120d-3bbb-4025-979c-90954992d9c0.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8325d747-f104-4623-bb84-9b1b6eb10acd.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce5f632d-9aa6-401d-85c5-31d487fa9e39.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbc77ea6-93e8-45f6-8466-3d87ebb61c7a.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa70e860-dd99-4e09-b38b-13142fbf0a50.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4620f1d-b56f-42e3-afb0-33d6b8fcdab6.vbs"
        23⤵
        
        PID:3788
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2665eeea-5457-46e0-9661-abfb1d0ed394.vbs"
        25⤵
        
        PID:2600
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\734ebf5f-57a4-4e4d-b796-51147e57ecea.vbs"
        27⤵
        
        PID:4044
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0317970b-52d5-4fc4-bc2f-e22586fc6852.vbs"
        29⤵
        
        PID:2312
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4772
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa211db7-0c51-4f88-aaed-dfcac80f5f92.vbs"
        31⤵
        
        PID:1600
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1277aec3-cf71-489b-8d5e-d32f7ed40508.vbs"
        33⤵
        
        PID:1652
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d38f126-10d7-40e6-aadf-8f90e708e359.vbs"
        35⤵
        
        PID:2932
        
        C:\Users\Default\Cookies\Idle.exe
        
        C:\Users\Default\Cookies\Idle.exe
        36⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\526eccbd-1f61-4913-9d33-63b02bc0580e.vbs"
        35⤵
        
        PID:1816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\446beaee-1ba1-4172-a8ff-5042130b1023.vbs"
        33⤵
        
        PID:2220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7836d216-296c-428e-823a-a0fa6120ef3a.vbs"
        31⤵
        
        PID:884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b78863c3-b4f0-4bd8-adfc-42fc4aa1b132.vbs"
        29⤵
        
        PID:744
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6d7e5c8-a885-4d83-a238-3c91e9d2a736.vbs"
        27⤵
        
        PID:1596
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\477e6483-e3c7-4280-aa8c-b3b32e1db839.vbs"
        25⤵
        
        PID:1464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82211bb0-8165-4483-a536-0979ea6bd2ca.vbs"
        23⤵
        
        PID:5060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d203530-13f7-47b3-86d9-c3dc8abdd264.vbs"
        21⤵
        
        PID:1528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b41a42e-db27-40c5-851c-5d735499428b.vbs"
        19⤵
        
        PID:2444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00fa29b0-1a68-4622-8cbb-c922756ed5ba.vbs"
        17⤵
        
        PID:4516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed240236-5c25-4811-9cfb-0500335927ef.vbs"
        15⤵
        
        PID:1992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45cb835f-589c-435f-ba2c-d3512bd42429.vbs"
        13⤵
        
        PID:1856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fead6b9-36d6-4bbf-a560-5523a8e28992.vbs"
        11⤵
        
        PID:536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5ff6a39-253e-4564-a035-d2b7dfa0fc4b.vbs"
        9⤵
        
        PID:3172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e28fb17d-a962-40bf-8f98-78d72ab8ae43.vbs"
        7⤵
        
        PID:1864
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f78125c7-34b9-40e9-ae2d-786c408420e0.vbs"
        5⤵
        
        PID:2752
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e0ed92a2-83ab-4e4e-9c28-84aa3db38f6f.vbs"
    3⤵
    PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\en-US\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Gadgets\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Gadgets\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Cookies\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Cookies\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Cookies\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Idle.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log
Size 1KB
SHA256 2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73
MD5 3690a1c3b695227a38625dcf27bd6dac
SHA1 c2ed91e98b120681182904fa2c7cd504e5c4b2f5
SHA512 15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1
MD5 SHA1 SHA512

Submit Download

0317970b-52d5-4fc4-bc2f-e22586fc6852.vbs

Path C:\Users\Admin\AppData\Local\Temp\0317970b-52d5-4fc4-bc2f-e22586fc6852.vbs
Size 709B
SHA256 006615a4764f38d6361a79a0cf2c35240de39602d5d5788f48356c82fa97cadf
MD5 26cfe819719ef64594516581631ed913
SHA1 e077754665d270224fb2fc5dc6b8ea592bfba8ae
SHA512 32d87ee3e6e3a6b7710440bf571ba837f5027af4b059f173d5c0b32f247352c2d375988a99c21ce1902a0ee9fdf1e8318762b4c16af8dac2d3d74da317de9d7c
MD5 SHA1 SHA512

Submit Download

1277aec3-cf71-489b-8d5e-d32f7ed40508.vbs

Path C:\Users\Admin\AppData\Local\Temp\1277aec3-cf71-489b-8d5e-d32f7ed40508.vbs
Size 709B
SHA256 31898e3e07ef02d7cdbfc0dbf3d3c38615f7235afd96375a4b0f845da70a4523
MD5 7328380de6a2b9694f6186bc8564439f
SHA1 1d168cfc924782ec0021e8e3ee2adc9a349686a2
SHA512 b012063ff48a4900ac578e925fdcc3ec75c4cd30ad5e4f1d002f11bf92ace400cbda18d501ac46ffe25fa7373c8e0796d20fe55035f2e6942bbbc7165b4f80c8
MD5 SHA1 SHA512

Submit Download

142fb953-4bd4-4e28-ac22-762e76018256.vbs

Path C:\Users\Admin\AppData\Local\Temp\142fb953-4bd4-4e28-ac22-762e76018256.vbs
Size 709B
SHA256 53badd717b5002c2f0c0c3a91748dd1b52dcf2fdfcdad7ff384474d074d5298c
MD5 b85960e4f19408ed16032b19c72746e2
SHA1 678a0f74cb8db9093785ff279dec6d4be468b6ed
SHA512 fe14b9fe119a9d98ea89ab129dc04b2f984dd65e207216c4240e14d74f48794ca02c6058a68d84cd80a597593bb8f1345f9d3f34a53f93614a78b8e52ae071f3
MD5 SHA1 SHA512

Submit Download

20ba120d-3bbb-4025-979c-90954992d9c0.vbs

Path C:\Users\Admin\AppData\Local\Temp\20ba120d-3bbb-4025-979c-90954992d9c0.vbs
Size 709B
SHA256 c64ec52cb3425020ba7feb18e18544d775fd6ae241e8eb4264fe59dd9c885b9e
MD5 027a45326925148bbae9479b52709411
SHA1 4093661bd5ae7232fe7f1e0fb490c7842556132c
SHA512 4b97848891e65444faabb70c51b36d24a01966ac5215d009ec90f90a66dcd06aaa25cba360282aa890e5d0d1171f2e8c984177a711ceb96d6d2ee3ad1c6c8857
MD5 SHA1 SHA512

Submit Download

2665eeea-5457-46e0-9661-abfb1d0ed394.vbs

Path C:\Users\Admin\AppData\Local\Temp\2665eeea-5457-46e0-9661-abfb1d0ed394.vbs
Size 708B
SHA256 e0fb61913efef5c33c58eec711223acf87d34840a007051234589035fc76f4e5
MD5 cda2054bbfae97c3bf912b3692986477
SHA1 8451bd70dc770056e71a6bb2649cf6d32999e882
SHA512 e6034ffc995b96e7fbde1ed0e80de9e25d5cc6cdebef55dc8884680e1d8e7ac5ff871f95831b92031036d472b188ff1e9e9312a0c986ef0c9d3df6e5921a8fdb
MD5 SHA1 SHA512

Submit Download

512ba9dc-4031-431f-8475-3ca9147e8b28.vbs

Path C:\Users\Admin\AppData\Local\Temp\512ba9dc-4031-431f-8475-3ca9147e8b28.vbs
Size 709B
SHA256 90e9bc673ee550fb71a86f5ebf799d6ffa5d595e9880734620775479b48afe61
MD5 2775d11588f3ebc454bfc5db744f7598
SHA1 8f4aa0d9de3bb49166b8559d37bd77a56c5e2398
SHA512 06ac07fd5429b161c906c47a8a897399f48e2d90f81187befe5638d3da0aa3119dc6f99d0b9379cd38db63e6075958a2258c05ded21bbd74f8bf31b3727b6fb3
MD5 SHA1 SHA512

Submit Download

62247f6109b9d02dc984f66d78ea362a29ff71b9.exe

Path C:\Users\Admin\AppData\Local\Temp\62247f6109b9d02dc984f66d78ea362a29ff71b9.exe
Size 1.4MB
SHA256 cd045eb594894ee58fdf9bfd2117c7ceff442a9757af4253f2b313c30b3f8cb5
MD5 b098ba0590f965a9100bf30779fc7305
SHA1 341eb805c2152f88d47008c411050abec0a72c4d
SHA512 619386dcf795489849fdef60efdad3a80662e86a5ceb6d8680e1f9ca3ef8d13bd3bc58451d8fa2f1afcf5fe7b4dde019b057543142be091b30c923e9e940a2ab
SSDEEP 24576:kwJfwwCPMBkgUQ8KaZhBvUO5VeRBJLpN/cNkNf9qwMjTmI:kwZdegxer9VKBFpBcNkbMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

734ebf5f-57a4-4e4d-b796-51147e57ecea.vbs

Path C:\Users\Admin\AppData\Local\Temp\734ebf5f-57a4-4e4d-b796-51147e57ecea.vbs
Size 709B
SHA256 e43558a992fc02d61107c2f920983b15f86ac5ea82abfecddbbc3a7cd52113b5
MD5 f8f91d91fd08b1a65b28b8a70f31820e
SHA1 af43e297e9fbfa7302f0546401b07368a683f9f2
SHA512 c7cdf6fa0effcc08ccd72e058ccfabc33e61f3914c494087a1d9f0bd471ab69688fe957db666b98c46fa9a8e265ea17451e6757315eaaa1102cbf00b871ae00f
MD5 SHA1 SHA512

Submit Download

8325d747-f104-4623-bb84-9b1b6eb10acd.vbs

Path C:\Users\Admin\AppData\Local\Temp\8325d747-f104-4623-bb84-9b1b6eb10acd.vbs
Size 709B
SHA256 6edf5ce3a9f5ac5f4470fa7641189e71486ffa61e26438b4d3eb7531e0137e73
MD5 025c48ed3225ba50f499504a2d7e6e3d
SHA1 dba6c3ac13a9866a272d148e50f3ee2c24737dd3
SHA512 d47d57573adcfdbcea3e84952f9dfbfec121b89c124409a2ac4a233cf99a280c993c270ca4c566c3a645125ed5c5dc6179fd7c547090f9043ff5b4e4ca77a9ae
MD5 SHA1 SHA512

Submit Download

aa70e860-dd99-4e09-b38b-13142fbf0a50.vbs

Path C:\Users\Admin\AppData\Local\Temp\aa70e860-dd99-4e09-b38b-13142fbf0a50.vbs
Size 709B
SHA256 9d65714548f3f0b119b6f8b955b9e4a43215827b9fd229a0dc845dd02f4e2f77
MD5 d72a3ebaa63d4726583b50c5742dfefd
SHA1 519ab2580a35b93f176ea9f641773493ab3dafe5
SHA512 a3783d2c4abb59319215c92e8996cfb80c5adbff583a52b4042d7c1234acd12d4333a3790b00199d2c79be5b5033597e5cff9706b05fac0078989b19f37b7613
MD5 SHA1 SHA512

Submit Download

bd3b04c1-09fb-456e-8ccf-00f5caf92f08.vbs

Path C:\Users\Admin\AppData\Local\Temp\bd3b04c1-09fb-456e-8ccf-00f5caf92f08.vbs
Size 709B
SHA256 dee05d25eafdbdd3017aae88e8d9afcd65eec70b7a663e4b970639a0e055631e
MD5 5a37f8037840eee95107deb0ef5741da
SHA1 1c18afafdf40cd0fcf11aaf564ece1cc4cd6a13c
SHA512 40c7fa5834a33599677db304f5efa497e2db9a3238aca91579469e174c0d695835f72acec26a45de8065007b91522ff1b2b791df27ab8c145dc7eaafa68cb66a
MD5 SHA1 SHA512

Submit Download

cbc77ea6-93e8-45f6-8466-3d87ebb61c7a.vbs

Path C:\Users\Admin\AppData\Local\Temp\cbc77ea6-93e8-45f6-8466-3d87ebb61c7a.vbs
Size 709B
SHA256 d35657c4cb7bdb5f5586ca72f250da032c6bcb2f0c85446f0d3731cf34268c67
MD5 688c6da24294d952a53edd85ffebbdc7
SHA1 e7b4940ade60e90065d2831d332a38ee029de051
SHA512 b12d0628f4713d379fa16bec37c9e433e62468e28483ce5b1f07e7887d369b6c2a16f3240a1e89a8e8fbbb2c8e53d3a027ffbdccef6404a40a94d07031cfa450
MD5 SHA1 SHA512

Submit Download

ce5f632d-9aa6-401d-85c5-31d487fa9e39.vbs

Path C:\Users\Admin\AppData\Local\Temp\ce5f632d-9aa6-401d-85c5-31d487fa9e39.vbs
Size 709B
SHA256 2c853929b15ecf776f6b1d2c67376189a68f2b9cc8a037c0c95612194a26fb5c
MD5 9a7a40b83bca08558f5440b635cd5dcd
SHA1 65d48e4b00ec66ff7ac2fffb4580bde74dbc7d53
SHA512 60f14ecba4354d3e0d766dc9e4e685210549f519fe65d46e2d19db3f3fa7a08141956706cc64febb07ef089d447c155393063e975045f0b735fe461452b9f5ac
MD5 SHA1 SHA512

Submit Download

ce650f3b-1d7c-4e3f-aa98-1927efa3c885.vbs

Path C:\Users\Admin\AppData\Local\Temp\ce650f3b-1d7c-4e3f-aa98-1927efa3c885.vbs
Size 709B
SHA256 e0e87740b859ccd70d098111f82bada04e14e21b3b7440934e583d9ed33763b0
MD5 efc3b5272562bfcb35773462e13c4131
SHA1 42f889f8a7e36d89866edf8af09a7bafd6cdc0d2
SHA512 2935057a7d040df5220964372e17ac682c14f89f690882e2872b3fbeabc8ad8ced6135ea53a2292cc7bf8cf60dbcb2a2631c972d1cc8bb39103f34fc00b3de70
MD5 SHA1 SHA512

Submit Download

e0ed92a2-83ab-4e4e-9c28-84aa3db38f6f.vbs

Path C:\Users\Admin\AppData\Local\Temp\e0ed92a2-83ab-4e4e-9c28-84aa3db38f6f.vbs
Size 485B
SHA256 7bab09dd0cef5e1654f67714d3a2cb830f6e847631785ad60292cd549239f612
MD5 7662ab351b25c8cebb60af128c400c1d
SHA1 058c1149ef1362475910be867cf675c23241d9a2
SHA512 4e825fe72ab7ad7977ae286bacfe60aba9f556c0929d737be691fe659860cfaf85f53d8907e1e06c41e52b3c61adaec9e48ded9452c63bcd6c336b2c0704d019
MD5 SHA1 SHA512

Submit Download

ecf3f7d3-cd22-47e0-a7c3-2d92bab0d406.vbs

Path C:\Users\Admin\AppData\Local\Temp\ecf3f7d3-cd22-47e0-a7c3-2d92bab0d406.vbs
Size 709B
SHA256 723582b7fe7be58751a1b5c8d57352b5b7de620819af2816a452a1e2a75b389c
MD5 bd10da36878ff99b9ba9cb45b459aaca
SHA1 37703d0509786e6f09314301c9b4373adac498f2
SHA512 997fca486f9f1222ed8c5a7203f87916fcca9081e99022b76a7e4344226515f5264dc8576de9c321cbfd336321b1d79dafce6d44c45fbb08db6fb2bcc94b7442
MD5 SHA1 SHA512

Submit Download

f4620f1d-b56f-42e3-afb0-33d6b8fcdab6.vbs

Path C:\Users\Admin\AppData\Local\Temp\f4620f1d-b56f-42e3-afb0-33d6b8fcdab6.vbs
Size 709B
SHA256 4228f7a55ca518dedf9fcd1a15f96a1c23ca30bdca9c5d7d62901101c7ee3ad3
MD5 9b2ab63bcf80ed0c3485f20ce0f675f9
SHA1 75669fbf813eb4d98d2cddd46b91b1eaac793d10
SHA512 a3382d8e64d4825b391e5566f063d7fc186f4fa4159df86d907246c32dea64cd0690d9bd44a56a001774b053f40c701db4bc267f21579713e6ab747355f07616
MD5 SHA1 SHA512

Submit Download

fa211db7-0c51-4f88-aaed-dfcac80f5f92.vbs

Path C:\Users\Admin\AppData\Local\Temp\fa211db7-0c51-4f88-aaed-dfcac80f5f92.vbs
Size 709B
SHA256 1f0d713de68546258b190eeb91b44e5980876cd7e9239b5b437f8981979b9b2a
MD5 e5290e78c7d2a1b63c1912b295a35b05
SHA1 7fbaf6df302ba1d690b513a04d1ffb1ea31e7b48
SHA512 2f13efc6a015084aec51ce4b43dc7a48020cd198af384537896269a3b198f8a4437a44c25ad2d581cc122696e38221a5e4b56688ba874824dbd537bde39cf06c
MD5 SHA1 SHA512

Submit Download

smss.exe

Path C:\Windows\DigitalLocker\en-US\smss.exe
Size 1.4MB
SHA256 32927eca5c9c14b3d12ee9e5c64b27b8562de4bf7eac2ae51563254d202a404d
MD5 32c213bef0a51b3310d80ffc4f7a7f8f
SHA1 0a5bde9d32b4593d52e68539dc1c607f83d716b4
SHA512 26acc82685d297f00c6b022e0d737fb52f2ac1352d9bdcdac8ec2f259c2f2194c79a06c173f804f1eb85c91252c36be24458fc77134815aca2b9abfd142c2a80
SSDEEP 24576:jwJfwwCPMBkgUQ8KaZhBvUO5VeRBJLpN/cNkNf9qwMjTmI:jwZdegxer9VKBFpBcNkbMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-183-0x000001B9AB660000-0x000001B9AB69B000-memory.dmp

Download

memory/1528-260-0x000002E89BF00000-0x000002E89BF3B000-memory.dmp

Download

memory/1856-187-0x000002AD48C30000-0x000002AD48C6B000-memory.dmp

Download

memory/1864-154-0x000001F6A3EA0000-0x000001F6A3EDB000-memory.dmp

Download

memory/1992-218-0x000001A11FC00000-0x000001A11FC3B000-memory.dmp

Download

memory/2012-186-0x0000028D831D0000-0x0000028D8320B000-memory.dmp

Download

memory/2444-251-0x0000020563270000-0x00000205632AB000-memory.dmp

Download

memory/2752-141-0x000001F3BE3A0000-0x000001F3BE3DB000-memory.dmp

Download

memory/3172-168-0x000001ED7F370000-0x000001ED7F3AB000-memory.dmp

Download

memory/3216-129-0x0000021744A90000-0x0000021744ACB000-memory.dmp

Download

memory/4516-234-0x000001F2FFF00000-0x000001F2FFF3B000-memory.dmp

Download

memory/4652-13-0x000000001B3C0000-0x000000001B3CA000-memory.dmp

Download

memory/4652-12-0x000000001B3B0000-0x000000001B3B8000-memory.dmp

Download

memory/4652-6-0x00000000009F0000-0x00000000009F8000-memory.dmp

Download

memory/4652-9-0x000000001B390000-0x000000001B398000-memory.dmp

Download

memory/4652-14-0x000000001B3D0000-0x000000001B3DE000-memory.dmp

Download

memory/4652-0-0x00007FFFD5833000-0x00007FFFD5835000-memory.dmp

Download

memory/4652-8-0x0000000002440000-0x0000000002448000-memory.dmp

Download

memory/4652-5-0x000000001B3E0000-0x000000001B430000-memory.dmp

Download

memory/4652-10-0x00000000024A0000-0x00000000024AC000-memory.dmp

Download

memory/4652-106-0x00007FFFD5830000-0x00007FFFD62F1000-memory.dmp

Download

memory/4652-11-0x000000001B3A0000-0x000000001B3AC000-memory.dmp

Download

memory/4652-1-0x00000000000A0000-0x0000000000204000-memory.dmp

Download

memory/4652-4-0x0000000002420000-0x000000000243C000-memory.dmp

Download

memory/4652-3-0x00000000009E0000-0x00000000009EE000-memory.dmp

Download

memory/4652-2-0x00007FFFD5830000-0x00007FFFD62F1000-memory.dmp

Download

memory/4652-7-0x0000000000A10000-0x0000000000A20000-memory.dmp

Download

memory/5060-284-0x0000029822290000-0x00000298222CB000-memory.dmp

Download