dcrat | 53d6112deaab099a9da782ba5fe8ccf729b2b1328bb0a62afdc9f09f9cd427c6

Analysis

max time kernel
9s
max time network
28s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17-07-2024 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Youtube.exe
Size

8.7MB
MD5

d25ebdfc04bdadea74017fa72f90781f
SHA1

f7278c4d04fc4db888368e0245d7607d8bcbb557
SHA256

9f30de67eacb0138506eff3c67dc9c52b0e923416dc75722ac90b12210b5383f
SHA512

77cca4e741a6f96cc35a3ce55c3f899f902719c8ee29c84a6f5dcb57e9d6b8f85cad2042486ff907046f3c87673f5a34da73730256822d090ae764ba21064e71
SSDEEP

196608:fE7JB0tYrXLW+d7UcIxptvyUQymRDSI1WCOK5m:fE9B0OjrdLK4J/Y

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat 44 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3140	schtasks.exe
		2972	schtasks.exe
		3804	schtasks.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings		Frage build.exe
		3616	schtasks.exe
		4652	schtasks.exe
		4276	schtasks.exe
		4696	schtasks.exe
		2352	schtasks.exe
		4772	schtasks.exe
		4192	schtasks.exe
		4252	schtasks.exe
		3872	schtasks.exe
		2124	schtasks.exe
		1768	schtasks.exe
		5056	schtasks.exe
		4440	schtasks.exe
		2816	schtasks.exe
		764	schtasks.exe
		512	schtasks.exe
		4804	schtasks.exe
		4188	schtasks.exe
		2772	schtasks.exe
		3588	schtasks.exe
		4416	schtasks.exe
		1268	schtasks.exe
		4624	schtasks.exe
		224	schtasks.exe
		3856	schtasks.exe
		2952	schtasks.exe
		3796	schtasks.exe
		972	schtasks.exe
		3912	schtasks.exe
		2384	schtasks.exe
		4236	schtasks.exe
		1852	schtasks.exe
		4616	schtasks.exe
		4456	schtasks.exe
		2928	schtasks.exe
		2104	schtasks.exe
		4172	schtasks.exe
		4180	schtasks.exe
		1840	schtasks.exe
		4628	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\", \"C:\\DriversavessessionDlldhcp\\conhost.exe\", \"C:\\winNet\\dllhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\", \"C:\\DriversavessessionDlldhcp\\conhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\dllhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\", \"C:\\DriversavessessionDlldhcp\\conhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\wininit.exe\", \"C:\\winNet\\explorer.exe\", \"C:\\Program Files\\Uninstall Information\\Refcrt.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\", \"C:\\DriversavessessionDlldhcp\\conhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\wininit.exe\", \"C:\\winNet\\explorer.exe\", \"C:\\Program Files\\Uninstall Information\\Refcrt.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\", \"C:\\DriversavessessionDlldhcp\\conhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\wininit.exe\", \"C:\\winNet\\explorer.exe\", \"C:\\Program Files\\Uninstall Information\\Refcrt.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\ApplicationFrameHost.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\", \"C:\\DriversavessessionDlldhcp\\conhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\wininit.exe\", \"C:\\winNet\\explorer.exe\", \"C:\\Program Files\\Uninstall Information\\Refcrt.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\ApplicationFrameHost.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\", \"C:\\DriversavessessionDlldhcp\\System.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\", \"C:\\DriversavessessionDlldhcp\\conhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\", \"C:\\DriversavessessionDlldhcp\\conhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\wininit.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\", \"C:\\DriversavessessionDlldhcp\\conhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\wininit.exe\", \"C:\\winNet\\explorer.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\cmd.exe\", \"C:\\DriversavessessionDlldhcp\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\winNet\\ShellExperienceHost.exe\", \"C:\\DriversavessessionDlldhcp\\conhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\dllhost.exe\", \"C:\\winNet\\wininit.exe\", \"C:\\winNet\\explorer.exe\", \"C:\\Program Files\\Uninstall Information\\Refcrt.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\ApplicationFrameHost.exe\""	Refcrt.exe

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	2448	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2448	schtasks.exe	87

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000a00000001ab58-3.dat	dcrat
behavioral1/memory/3012-27-0x0000000000400000-0x0000000000CC7000-memory.dmp	dcrat
behavioral1/files/0x000700000001ac47-32.dat	dcrat
behavioral1/memory/3620-35-0x0000000000400000-0x000000000069B000-memory.dmp	dcrat
behavioral1/files/0x000700000001ac52-66.dat	dcrat
behavioral1/memory/4292-68-0x0000000000BC0000-0x0000000000D44000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1152	powershell.exe
1868	powershell.exe
3540	powershell.exe
4368	powershell.exe
5596	powershell.exe
5644	powershell.exe
4576	powershell.exe
5592	powershell.exe
1344	powershell.exe
5532	powershell.exe
4924	powershell.exe
1348	powershell.exe
3080	powershell.exe
4648	powershell.exe
1968	powershell.exe
3624	powershell.exe
4748	powershell.exe
5360	powershell.exe
964	powershell.exe
2128	powershell.exe
3276	powershell.exe
4340	powershell.exe
1660	powershell.exe
2672	powershell.exe
520	powershell.exe
5296	powershell.exe
5372	powershell.exe
2896	powershell.exe
3064	powershell.exe
4208	powershell.exe
4600	powershell.exe
4776	powershell.exe
1268	powershell.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/3012-27-0x0000000000400000-0x0000000000CC7000-memory.dmp	net_reactor

Executes dropped EXE 7 IoCs

pid	Process
3620	Result.exe
308	DCRatBuild.exe
4432	Bloxstrap.exe
4708	Frage build.exe
4892	SolaraBootstrapper.exe
3188	solara.exe
4292	Refcrt.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\DriversavessessionDlldhcp\\System.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\DriversavessessionDlldhcp\\conhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\winNet\\wininit.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\Refcrt = "\"C:\\Program Files\\Uninstall Information\\Refcrt.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\DriversavessessionDlldhcp\\conhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\winNet\\wininit.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\winNet\\dllhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Google\\cmd.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\DriversavessessionDlldhcp\\explorer.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\winNet\\ShellExperienceHost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\tracing\\RuntimeBroker.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\DriversavessessionDlldhcp\\System.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\winNet\\ShellExperienceHost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\winNet\\dllhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\winNet\\explorer.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicationFrameHost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\ApplicationFrameHost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\tracing\\RuntimeBroker.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\winNet\\explorer.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Refcrt = "\"C:\\Program Files\\Uninstall Information\\Refcrt.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ApplicationFrameHost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\ApplicationFrameHost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Google\\cmd.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\DriversavessessionDlldhcp\\explorer.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	Refcrt.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com
26	ipinfo.io
27	ipinfo.io

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\ebf1f9fa8afd6d	Refcrt.exe
File created	C:\Program Files\Uninstall Information\Refcrt.exe	Refcrt.exe
File created	C:\Program Files\Uninstall Information\a0b1fd4c5438e9	Refcrt.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\ApplicationFrameHost.exe	Refcrt.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6dd19aba3e2428	Refcrt.exe
File created	C:\Program Files (x86)\Google\cmd.exe	Refcrt.exe
File opened for modification	C:\Program Files (x86)\Google\cmd.exe	Refcrt.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\tracing\RuntimeBroker.exe	Refcrt.exe
File created	C:\Windows\tracing\9e8d7a4ca61bd9	Refcrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	solara.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	Refcrt.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	Frage build.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	DCRatBuild.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4920	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 43 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3872	schtasks.exe
512	schtasks.exe
5056	schtasks.exe
4440	schtasks.exe
4772	schtasks.exe
4172	schtasks.exe
4252	schtasks.exe
3856	schtasks.exe
4628	schtasks.exe
2952	schtasks.exe
4456	schtasks.exe
3588	schtasks.exe
3804	schtasks.exe
1852	schtasks.exe
4416	schtasks.exe
4652	schtasks.exe
972	schtasks.exe
1268	schtasks.exe
3796	schtasks.exe
4616	schtasks.exe
4624	schtasks.exe
4180	schtasks.exe
2124	schtasks.exe
3140	schtasks.exe
2352	schtasks.exe
1768	schtasks.exe
3912	schtasks.exe
4804	schtasks.exe
2816	schtasks.exe
2104	schtasks.exe
1840	schtasks.exe
4236	schtasks.exe
4188	schtasks.exe
224	schtasks.exe
2972	schtasks.exe
4192	schtasks.exe
2928	schtasks.exe
764	schtasks.exe
4696	schtasks.exe
4276	schtasks.exe
2384	schtasks.exe
2772	schtasks.exe
3616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4892	SolaraBootstrapper.exe
4892	SolaraBootstrapper.exe
4292	Refcrt.exe
4292	Refcrt.exe
4292	Refcrt.exe
4292	Refcrt.exe
4292	Refcrt.exe
4292	Refcrt.exe
4292	Refcrt.exe
4292	Refcrt.exe
4292	Refcrt.exe
4292	Refcrt.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe
4924	powershell.exe
4924	powershell.exe
4924	powershell.exe
4600	powershell.exe
4924	powershell.exe
4748	powershell.exe
4748	powershell.exe
2128	powershell.exe
2128	powershell.exe
1348	powershell.exe
1348	powershell.exe
1348	powershell.exe
964	powershell.exe
964	powershell.exe
964	powershell.exe
4340	powershell.exe
4340	powershell.exe
2128	powershell.exe
3624	powershell.exe
3624	powershell.exe
4576	powershell.exe
4576	powershell.exe
4368	powershell.exe
4368	powershell.exe
2896	powershell.exe
2896	powershell.exe
1660	powershell.exe
1660	powershell.exe
964	powershell.exe
520	powershell.exe
520	powershell.exe
4208	powershell.exe
4208	powershell.exe
4208	powershell.exe
1348	powershell.exe
3064	powershell.exe
3064	powershell.exe
2128	powershell.exe
4748	powershell.exe
4368	powershell.exe
1660	powershell.exe
3624	powershell.exe
4340	powershell.exe
520	powershell.exe
4576	powershell.exe
3064	powershell.exe
2896	powershell.exe
4368	powershell.exe
1660	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	SolaraBootstrapper.exe
Token: SeDebugPrivilege	4292	Refcrt.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeIncreaseQuotaPrivilege	4600	powershell.exe
Token: SeSecurityPrivilege	4600	powershell.exe
Token: SeTakeOwnershipPrivilege	4600	powershell.exe
Token: SeLoadDriverPrivilege	4600	powershell.exe
Token: SeSystemProfilePrivilege	4600	powershell.exe
Token: SeSystemtimePrivilege	4600	powershell.exe
Token: SeProfSingleProcessPrivilege	4600	powershell.exe
Token: SeIncBasePriorityPrivilege	4600	powershell.exe
Token: SeCreatePagefilePrivilege	4600	powershell.exe
Token: SeBackupPrivilege	4600	powershell.exe
Token: SeRestorePrivilege	4600	powershell.exe
Token: SeShutdownPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeSystemEnvironmentPrivilege	4600	powershell.exe
Token: SeRemoteShutdownPrivilege	4600	powershell.exe
Token: SeUndockPrivilege	4600	powershell.exe
Token: SeManageVolumePrivilege	4600	powershell.exe
Token: 33	4600	powershell.exe
Token: 34	4600	powershell.exe
Token: 35	4600	powershell.exe
Token: 36	4600	powershell.exe
Token: SeIncreaseQuotaPrivilege	4924	powershell.exe
Token: SeSecurityPrivilege	4924	powershell.exe
Token: SeTakeOwnershipPrivilege	4924	powershell.exe
Token: SeLoadDriverPrivilege	4924	powershell.exe
Token: SeSystemProfilePrivilege	4924	powershell.exe
Token: SeSystemtimePrivilege	4924	powershell.exe
Token: SeProfSingleProcessPrivilege	4924	powershell.exe
Token: SeIncBasePriorityPrivilege	4924	powershell.exe
Token: SeCreatePagefilePrivilege	4924	powershell.exe
Token: SeBackupPrivilege	4924	powershell.exe
Token: SeRestorePrivilege	4924	powershell.exe
Token: SeShutdownPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeSystemEnvironmentPrivilege	4924	powershell.exe
Token: SeRemoteShutdownPrivilege	4924	powershell.exe
Token: SeUndockPrivilege	4924	powershell.exe
Token: SeManageVolumePrivilege	4924	powershell.exe
Token: 33	4924	powershell.exe
Token: 34	4924	powershell.exe
Token: 35	4924	powershell.exe
Token: 36	4924	powershell.exe
Token: SeIncreaseQuotaPrivilege	1348	powershell.exe
Token: SeSecurityPrivilege	1348	powershell.exe
Token: SeTakeOwnershipPrivilege	1348	powershell.exe
Token: SeLoadDriverPrivilege	1348	powershell.exe
Token: SeSystemProfilePrivilege	1348	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3620	3012	Youtube.exe	74
PID 3012 wrote to memory of 3620	3012	Youtube.exe	74
PID 3012 wrote to memory of 3620	3012	Youtube.exe	74
PID 3012 wrote to memory of 308	3012	Youtube.exe	75
PID 3012 wrote to memory of 308	3012	Youtube.exe	75
PID 3012 wrote to memory of 308	3012	Youtube.exe	75
PID 3012 wrote to memory of 4432	3012	Youtube.exe	76
PID 3012 wrote to memory of 4432	3012	Youtube.exe	76
PID 3012 wrote to memory of 4708	3012	Youtube.exe	77
PID 3012 wrote to memory of 4708	3012	Youtube.exe	77
PID 3012 wrote to memory of 4708	3012	Youtube.exe	77
PID 3620 wrote to memory of 4892	3620	Result.exe	78
PID 3620 wrote to memory of 4892	3620	Result.exe	78
PID 3620 wrote to memory of 4892	3620	Result.exe	78
PID 3620 wrote to memory of 3188	3620	Result.exe	80
PID 3620 wrote to memory of 3188	3620	Result.exe	80
PID 3620 wrote to memory of 3188	3620	Result.exe	80
PID 4708 wrote to memory of 1820	4708	Frage build.exe	81
PID 4708 wrote to memory of 1820	4708	Frage build.exe	81
PID 4708 wrote to memory of 1820	4708	Frage build.exe	81
PID 308 wrote to memory of 1968	308	DCRatBuild.exe	82
PID 308 wrote to memory of 1968	308	DCRatBuild.exe	82
PID 308 wrote to memory of 1968	308	DCRatBuild.exe	82
PID 3188 wrote to memory of 784	3188	solara.exe	83
PID 3188 wrote to memory of 784	3188	solara.exe	83
PID 3188 wrote to memory of 784	3188	solara.exe	83
PID 784 wrote to memory of 2248	784	WScript.exe	84
PID 784 wrote to memory of 2248	784	WScript.exe	84
PID 784 wrote to memory of 2248	784	WScript.exe	84
PID 2248 wrote to memory of 4292	2248	cmd.exe	86
PID 2248 wrote to memory of 4292	2248	cmd.exe	86
PID 4292 wrote to memory of 520	4292	Refcrt.exe	130
PID 4292 wrote to memory of 520	4292	Refcrt.exe	130
PID 4292 wrote to memory of 1348	4292	Refcrt.exe	131
PID 4292 wrote to memory of 1348	4292	Refcrt.exe	131
PID 4292 wrote to memory of 1660	4292	Refcrt.exe	132
PID 4292 wrote to memory of 1660	4292	Refcrt.exe	132
PID 4292 wrote to memory of 4924	4292	Refcrt.exe	133
PID 4292 wrote to memory of 4924	4292	Refcrt.exe	133
PID 4292 wrote to memory of 4368	4292	Refcrt.exe	134
PID 4292 wrote to memory of 4368	4292	Refcrt.exe	134
PID 4292 wrote to memory of 2128	4292	Refcrt.exe	135
PID 4292 wrote to memory of 2128	4292	Refcrt.exe	135
PID 4292 wrote to memory of 4748	4292	Refcrt.exe	136
PID 4292 wrote to memory of 4748	4292	Refcrt.exe	136
PID 4292 wrote to memory of 4340	4292	Refcrt.exe	137
PID 4292 wrote to memory of 4340	4292	Refcrt.exe	137
PID 4292 wrote to memory of 4576	4292	Refcrt.exe	138
PID 4292 wrote to memory of 4576	4292	Refcrt.exe	138
PID 4292 wrote to memory of 4208	4292	Refcrt.exe	139
PID 4292 wrote to memory of 4208	4292	Refcrt.exe	139
PID 4292 wrote to memory of 3064	4292	Refcrt.exe	140
PID 4292 wrote to memory of 3064	4292	Refcrt.exe	140
PID 4292 wrote to memory of 964	4292	Refcrt.exe	141
PID 4292 wrote to memory of 964	4292	Refcrt.exe	141
PID 4292 wrote to memory of 2896	4292	Refcrt.exe	142
PID 4292 wrote to memory of 2896	4292	Refcrt.exe	142
PID 4292 wrote to memory of 4600	4292	Refcrt.exe	143
PID 4292 wrote to memory of 4600	4292	Refcrt.exe	143
PID 4292 wrote to memory of 3624	4292	Refcrt.exe	144
PID 4292 wrote to memory of 3624	4292	Refcrt.exe	144
PID 4292 wrote to memory of 3800	4292	Refcrt.exe	160
PID 4292 wrote to memory of 3800	4292	Refcrt.exe	160
PID 3800 wrote to memory of 1368	3800	cmd.exe	162

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Youtube.exe
"C:\Users\Admin\AppData\Local\Temp\Youtube.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\Result.exe
  "C:\Users\Admin\AppData\Local\Temp\Result.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
  - - C:\Windows\SysWOW64\msiexec.exe
      "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
      4⤵
      PID:5760
- - C:\Users\Admin\AppData\Local\Temp\solara.exe
    "C:\Users\Admin\AppData\Local\Temp\solara.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\aImCrmZyeD77A2ANdrk.vbe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:784
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\4F0VCIGGZPxdNa.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2248
      - C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\Refcrt.exe
        
        "C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\Refcrt.exe"
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\Refcrt.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\cmd.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriversavessessionDlldhcp\explorer.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winNet\ShellExperienceHost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriversavessessionDlldhcp\conhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winNet\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winNet\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winNet\wininit.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winNet\explorer.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\Refcrt.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\ApplicationFrameHost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\tracing\RuntimeBroker.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriversavessessionDlldhcp\System.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QrWoKznpWM.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3800
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1368
        
        C:\winNet\dllhost.exe
        
        "C:\winNet\dllhost.exe"
        8⤵
        
        PID:5976
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\winNet\we9fgyC144zVOkGk.vbe"
    3⤵
    PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\winNet\rsH0xIUsPk2E2Mq2a4QwbDGWD6K8lz.bat" "
      4⤵
      PID:2456
    - - C:\winNet\ComContainerbrowserRefRuntime.exe
        
        "C:\winNet/ComContainerbrowserRefRuntime.exe"
        5⤵
        
        PID:4108
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dH0VDu0kHY.bat"
        6⤵
        
        PID:5328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2676
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:4920
- C:\Users\Admin\AppData\Local\Temp\Bloxstrap.exe
  "C:\Users\Admin\AppData\Local\Temp\Bloxstrap.exe"
  2⤵
  - Executes dropped EXE
  PID:4432
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Bloxstrap.exe"
    3⤵
    PID:5712
  - - C:\Windows\System32\cmd.exe
      "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
      4⤵
      PID:4616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5360
  - - C:\Windows\System32\cmd.exe
      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "Bloxstrap" /tr "C:\Users\Admin\Bloxstrap.exe"
      4⤵
      PID:4780
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Bloxstrap" /tr "C:\Users\Admin\Bloxstrap.exe"
        5⤵
        DcRat
        Scheduled Task/Job: Scheduled Task
        
        PID:4696
- C:\Users\Admin\AppData\Local\Temp\Frage build.exe
  "C:\Users\Admin\AppData\Local\Temp\Frage build.exe"
  2⤵
  - DcRat
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\DriversavessessionDlldhcp\ghJPtatrYDLygnNWh9dEZv.vbe"
    3⤵
    PID:1820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\DriversavessessionDlldhcp\exFbRiwQoowToPhSTKSA9iYE.bat" "
      4⤵
      PID:6068
    - - C:\DriversavessessionDlldhcp\Roblox.exe
        
        "C:\DriversavessessionDlldhcp/Roblox.exe"
        5⤵
        
        PID:5692
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qkpia11b\qkpia11b.cmdline"
        6⤵
        
        PID:6084
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB7F6.tmp" "c:\Program Files (x86)\Google\CSCAAD7179340394874A285D488B5457E8.TMP"
        7⤵
        
        PID:96
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uy1cycsw\uy1cycsw.cmdline"
        6⤵
        
        PID:3628
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8A1.tmp" "c:\winNet\CSC33431322FA0A4C2AA1FF32CB96ACA088.TMP"
        7⤵
        
        PID:5956
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xfyokzy5\xfyokzy5.cmdline"
        6⤵
        
        PID:1092
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB94D.tmp" "c:\Recovery\WindowsRE\CSC8E2D0880925B4D42A2BE6BB27ABF2955.TMP"
        7⤵
        
        PID:5988
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ssz5z133\ssz5z133.cmdline"
        6⤵
        
        PID:5880
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9DA.tmp" "c:\winNet\CSC1D1FB7DC12AD40469C4B3A16C8AA43E0.TMP"
        7⤵
        
        PID:3060
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eitr2zmf\eitr2zmf.cmdline"
        6⤵
        
        PID:3340
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA95.tmp" "c:\DriversavessessionDlldhcp\CSC99949F5AA9674D25B7A71472C63FC84C.TMP"
        7⤵
        
        PID:5776
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ppf41503\ppf41503.cmdline"
        6⤵
        
        PID:5964
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB80.tmp" "c:\winNet\CSC5154F297B074A44BAA8F5B68D6A65AC.TMP"
        7⤵
        
        PID:5856
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ia4c2baf\ia4c2baf.cmdline"
        6⤵
        
        PID:3488
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC7A.tmp" "c:\winNet\CSC73D9A6FF11DA41108AFACC98E2A14B19.TMP"
        7⤵
        
        PID:964
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\52u30wtj\52u30wtj.cmdline"
        6⤵
        
        PID:764
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD55.tmp" "c:\Program Files\Uninstall Information\CSC81410F1361FB4874A6866B8C5E41F24E.TMP"
        7⤵
        
        PID:3852
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b23ma4wc\b23ma4wc.cmdline"
        6⤵
        
        PID:4412
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE20.tmp" "c:\Recovery\WindowsRE\CSC1DF61AE3FCF042D9ADD6FC657A4E56.TMP"
        7⤵
        
        PID:1852
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l1uurysp\l1uurysp.cmdline"
        6⤵
        
        PID:3504
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE8D.tmp" "c:\Program Files (x86)\Mozilla Maintenance Service\logs\CSCEC9E023AC3D240AAB8859A15A7745B1.TMP"
        7⤵
        
        PID:4448
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hwfz5n3f\hwfz5n3f.cmdline"
        6⤵
        
        PID:2772
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBEFA.tmp" "c:\Windows\tracing\CSCF76DC855D5F84374BCA2CB2B4ED2E8B6.TMP"
        7⤵
        
        PID:5092
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dx3oaspc\dx3oaspc.cmdline"
        6⤵
        
        PID:5576
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBF77.tmp" "c:\DriversavessessionDlldhcp\CSCAA601D949B4496B87EEA619C83734FA.TMP"
        7⤵
        
        PID:5628
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lmcbb3wi\lmcbb3wi.cmdline"
        6⤵
        
        PID:5384
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC014.tmp" "c:\Windows\System32\CSC53FAC5036B7B4C0ABF3FBC59FD54BA.TMP"
        7⤵
        
        PID:5236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5296
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4648
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Config.Msi/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3276
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5596
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/DriversavessessionDlldhcp/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5532
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2672
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1344
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1968
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5372
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1268
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3540
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1868
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/winNet/'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1152
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5644
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriversavessessionDlldhcp\Roblox.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5592
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ria7y6pjUS.bat"
        6⤵
        
        PID:5420
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\DriversavessessionDlldhcp\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\DriversavessessionDlldhcp\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\DriversavessessionDlldhcp\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\winNet\ShellExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\winNet\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\winNet\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\DriversavessessionDlldhcp\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\DriversavessessionDlldhcp\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\DriversavessessionDlldhcp\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\winNet\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\winNet\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\winNet\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\winNet\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\winNet\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\winNet\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\winNet\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\winNet\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\winNet\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\winNet\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\winNet\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\winNet\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RefcrtR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\Refcrt.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Refcrt" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\Refcrt.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RefcrtR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\Refcrt.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\ApplicationFrameHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\ApplicationFrameHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\ApplicationFrameHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\tracing\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\tracing\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\tracing\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\DriversavessessionDlldhcp\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\DriversavessessionDlldhcp\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\DriversavessessionDlldhcp\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5912
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E89E82FEE6393646044B7523670A7719
  2⤵
  PID:2760
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C43786B3C051600E891CBB460ED82B8B
  2⤵
  PID:5408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DriversavessessionDlldhcp\Roblox.exe

Filesize
1.8MB

MD5
26e388ea32df635cd424decb2bff563e

SHA1
510ac8024dd524f7ebc92210b189804921fd29ee

SHA256
cf90b0e7318a9e4e3cbaeebd3f82f823e7754a35e689979fabd18e785383dc8e

SHA512
b59ecb856064e3d590ec3d0f17410195bf08cd6a2b0bb091c92c9200c3e163f5b0e918b09f7ff0f51990dae49ba27ea566862353647ee59ae9ea9c192faf79d1

Download Submit
C:\DriversavessessionDlldhcp\exFbRiwQoowToPhSTKSA9iYE.bat

Filesize
94B

MD5
1689f0727433844f3250241e9e030427

SHA1
bac7909c2a8e7a666edb56a7df07650701d9c013

SHA256
fa50cc35b05b88a91212dba6ca7cb348368309e9fdfa16273d1adc659f42cdab

SHA512
d814a8015dcce43a0128c7a5c34998a9a7df03231c5c2b1df169e8986de6e8ec1e77692756ada79f8355abaa50c35ccf5d5f2eaa13c76e02a4dd582ce9c51528

Download Submit
C:\DriversavessessionDlldhcp\ghJPtatrYDLygnNWh9dEZv.vbe

Filesize
239B

MD5
3492e48fb2e9fb2bfc18658e3d8f88bd

SHA1
34cec8222aedc8baf774aa863a041a23971c7631

SHA256
c0857f8c479b8fa90402a735a24b312819cdcec5c69b90bd6dafc175dbfd3b2e

SHA512
a9923e942d86d3e29a52d421ceb96c8cef8aae769cbb18a65e93793e444cf7712c52aaba3a5da2f06d2ee5c3eef42d6972457b13aa06a060eaf9b26369d0efc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fa2fd96a0cefb3443e3d5d36dcf49bdb

SHA1
62f89c94f6ef4b9f4cc1ffccf4b9e87e36d81755

SHA256
9269962ccbd30f9caed70951584ae74b4a78fe7c949e7d6d174d80633dd16924

SHA512
1e36cb55b41512329cf3cc33ed84f80bb6eccc94f015ec5ee84f1dbb604f9ea18d4bc7144f07a406d24e02974fc04cf51181884f9df3285fcd9e8a36d36b06b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d7572c868456ae097e27f20acb19f454

SHA1
ab1d21d24555748cfab1ccceb4c94cecb2110141

SHA256
03ccda37fdd1bf717f4ee00227b04dfd199e53465218304c53b42411e41360bd

SHA512
c1604cb51f9a26acac218a387b80df1ec89a8b3d6cdab6b1b3aed2a9cb2c274202e87e74c151a64c25a9c96c09b32264381a96446c69c366b4a5bdb2455b6605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c5890566af441a9c9df1029b604b4b28

SHA1
e6be0f519f65754fba8519bd43737b1d306a5fd2

SHA256
5f986fa78ea3044c2cb4fecd63c2d573a355e2f5e2d4cebbe2037d47f8212139

SHA512
a83e717c4691fc6a0e53335c6533f01e7ef2689fb15cad28500abbf4847bef992d1bfa0c345aebd170b91495544825eed5584300cd08942ceb2a21a82a9e9a33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
49cbd5994a26d6d4bcd15a4345946585

SHA1
e6d3e0e6076f3692fd81ff15380cc5fee0339aba

SHA256
9982ab584ad8f35286b8d9524916dd5dedd4746b7199fc8db1422adc765adeb4

SHA512
640b8ba8a22d94a507e7fda59615a085d30fb9a3cb71c8b6d2985fb5a64553594aad45ec4d76fa8b282e9f6fb4091a8631c37897b8e80328048347f10ff17b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c1023ec4417baf156a457c7c3c4dd047

SHA1
a4c8b25ec984945bca4b7fa40a1823ed2aca8405

SHA256
2ad7566acc4eb4934d4222bcf8fb086dd5b31694656c5db71e82838a9da1a2fc

SHA512
e1db38506c2ab16f7abecad0b15e76f8875b54cef4288dd494092462fb2f50a6d72229f8a5d83b78071553980c4336a8e28e251af3bc72d1eee8c8edfee63911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ba32517791375de6bdded4466d9489d6

SHA1
e45c03c2077efaea0b0177a9403faeade08e015e

SHA256
cea5f66fd744f8abb52de1c39ce0e84f508de80cfa0ddf94c911c45b5f0265f3

SHA512
882154e951637609354b8a1bac40946539c4d9dfb5039ba41b218231ad43df8ece68e80c25666e9154a2c3046ad6f5009e6843bc6d2669c62c2923b2459317ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b47606a0e6f9780269bd9e311238a04d

SHA1
427c44c8dfe92ded9dafd21ccb70159dbc69ae6e

SHA256
62a661c126d19ba491229037dd0cb82a3cf4cad7fac55410ace0f550626e0e0b

SHA512
246f8a77030cf9e69fce2cdc6ae27db4952b61fbaf959befc625991320440915ef946be2410e6b8411c7cd9dae628da4159a71c1409f6e661cbe02805d3abe6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b1c9d62db711bdf3941496b680e2b708

SHA1
37ff950f8a06448827fe72da11a83e684cdaecb5

SHA256
0056f2748967ade75279f9e95e77cd4fbc5d53d75200bd5c39d5240b08047ec3

SHA512
69b3a0c2f522cc7049db183060f64f62082d215e4015945a0c3fd0364b2041d407ddb1da2cfbd84a6b1af8d32cdaaf0e8604438fb4feae054945de6f503b389c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ea240777b98f30d67d680a72aa13983c

SHA1
502eb5b3a1a5ac91989eeb26db7d2e124430c060

SHA256
abdeb435f89362256def95336d397f6b2a88ab3e8062f546bb1a1520b9063411

SHA512
1f38d55aa480c3796aa9fa195034fdd2b58c83d2959a05afed1f107c04339d018e203d96de01cf881a89db96ef880cdc11cb212f22d2cad442be92a1accc5cd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a945d6da7cbaefcf388ff92cfae25ab0

SHA1
098793ada86ff245c6b3eaa334c19a2b49263501

SHA256
5aa65645113d851884650ec895d22a72829d8716e96fb89604c9930d4f50f34e

SHA512
47a030e94681347053e57da967e93d37c1bba599d901a2c88402957b04dce751a9b698153cfe44fdb2870cbbc6474ae990307f9ce55eba27b561f6a4d4c36c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6485b842e32e19e7cb8d8848cde9764a

SHA1
ef5d08e2d7111a0607889e7ab87d7e0a326f1b51

SHA256
87dd5c7809ab14f0260a8e4d5751c0d08447f5afb599d4e464c859a8907af47c

SHA512
858710067ac6b235f8b6a035754574437804d18f34638510289af2722319a72fb051f5b970efd0e4be24f4cfcb9d87753f3d70d9b12be7fecff5acd634d1efa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
37f8535645e51bf8d5fa611dff58eb9b

SHA1
019680b82cab08223a57653b176bbc68fcd09c9d

SHA256
7f45ce3709ecfa5ef07d2a6a0d3cb312418ea7094c7ed3fdabf02ac44549de98

SHA512
1fe84dbbfec57fd21316ca2781764849625463d978b430266f9098ba5f8b727f47cf9d95975a5c176c086ce0d248e1737e542c8d21ed04adef717990301a6e5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bloxstrap.exe

Filesize
2.2MB

MD5
7529e4004c0fe742df146464e6aeadb0

SHA1
ae7341ee066b31de5a1a1a25851b70ced41de13f

SHA256
a80a68f1b63391ba9a91870173a0db962c73950c191594750e705f1d1c77be81

SHA512
d50112143b1a2acf918606e2f0a1d01fc2d5ed3e2e4ecdcdb2405669af2444a3274c7e39461c723d675e230f8cb72be351cdb1b8e31b9f5b5517a03c66f47f27

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
1.9MB

MD5
7d4b84a8c3d14cb3d1bb864719463404

SHA1
544cf51aec717c63552f0fdf97d364b1b62a7a0c

SHA256
3aa0597b5d053594cce551ac5d8a9bc83059c3d55ef024dc7dff59c73a88e663

SHA512
d962cbe9998d2e04a9bbd2ab1a97535409015b183acc0d61d49f6b696eac046e7c41028b55c8d33c3b6c1dacbf3704771dbdf911b06c8e9c247b49d2c6864a29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Frage build.exe

Filesize
2.1MB

MD5
11fdce42422f8ed518fedf290f5bfc3c

SHA1
f18a4ad694af5ba50a7697b4cb66308454c555d9

SHA256
b62b6592549d56b573efdd053c73e37542742301fffbeb786a60c227564b97a3

SHA512
4e1c700ed33db9b29fe3545efeb7616ccf9c86b0716ee684d5375097651b44b3aab99302e6e159bb3f088b4cb59334aa473864d3d8b43a583b3cbfd9a12d16ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\QrWoKznpWM.bat

Filesize
186B

MD5
5541b56069f1a4153bd19fd83534df9f

SHA1
05b49a6b9921c8f1b734ebc35b9a88a125194cf6

SHA256
91214d046a486cee1ba767286d3dab353c970e406269ebc03cb12a7a8b51eea8

SHA512
3b88dcbe1eaafc8bda53bd6b9f80dbd5fbe564d386d694ad60032f0bea95e7b30c861f513e0b4e8216217156bbfe40ccc5b56e7b7e17215912a22a29e28670c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB7F6.tmp

Filesize
1KB

MD5
d61f8887383e5fbee50affdfc53658aa

SHA1
87601f082f3e2eee58d123437f63b5e927acfb06

SHA256
7fc9cd9da3b14239c80f40ee86b5549414243607eeb499304a23da72f5be4057

SHA512
a8ea47e0bf625bfd69362ece036c66ede13572290e87cd04d38073a0d075ae4d40348ce460612db1e95b8d0dd26b8a36af2f2d572a478d0abb623f97ce8621e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Result.exe

Filesize
2.6MB

MD5
170b43350048ed4b6fca0e50a0178621

SHA1
db863b7b04a7c58baa9120e2f184517ed27a7252

SHA256
248856f33f34ee7f97fd2a83264d4c85251f06bce6d5761d416405a33849079b

SHA512
e8dc07cf863d01e5ae18b44432cbf3ae54cd24f12d00981a5b5df51684039783339f7b43f79816d25790210654b3da17eae4687f2a3b34b6e2570c5ce990bde7

Download Submit
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe

Filesize
797KB

MD5
36b62ba7d1b5e149a2c297f11e0417ee

SHA1
ce1b828476274375e632542c4842a6b002955603

SHA256
8353c5ace62fda6aba330fb3396e4aab11d7e0476f815666bd96a978724b9e0c

SHA512
fddec44631e7a800abf232648bbf417969cd5cc650f32c17b0cdc12a0a2afeb9a5dbf5c1f899bd2fa496bd22307bfc8d1237c94920fceafd84f47e13a6b98b94

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j5umwgph.ykq.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dH0VDu0kHY.bat

Filesize
169B

MD5
51d7e3815592ba405d8a0119b0517b34

SHA1
786786628bf132b46210d3f260f09d459f2e355a

SHA256
c8a05fd21a0fad0ec935bcb38ba170aa5ca3928ac3cb2b67368a8b1fdcbc7965

SHA512
52f89bfeb21f7f2c5b9095e5a3e22706b4b218fc2fa220c15e3d4fa848a91bfd925f8e919c226e08abc8c9a8b7969f14f4121f960e4a0716c9e60bf5393b6352

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Local\Temp\solara.exe

Filesize
1.8MB

MD5
1797c0e37f4b9dd408cbf0d7bfcb7c95

SHA1
10df695351ac6074e23a3d3b4bd31a17c10fd614

SHA256
8a1b256aa65d666d8b566576c86065bb9401483f705bce0c597fc27b9cde2cfb

SHA512
52289cb15c7b2c5a600da9e9894f5dbc66566eff9c864488dfd8d318800fbbf8622a3dad79f7f5aec6d77badfc0707010ffffe521eef8f218be33e07092010b1

Download Submit
C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\4F0VCIGGZPxdNa.bat

Filesize
46B

MD5
83a7f739f51f1acd83f143afa6ec1533

SHA1
2f653f906842f8f507d02f81550eb26a35f38acc

SHA256
5faae2c746c71afcb3dc0b9eb4fbf6087786936484f62ee08412a94c13642545

SHA512
c4487c0ca0e630ee8daf2443c290fac2d0de60b0ce36c28e6451cfd66b2b81669a87726da31d4e172d2794a0345bbe9111402486b6e28d941fb6d124be604793

Download Submit
C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\Refcrt.exe

Filesize
1.5MB

MD5
9cf4017a8383ae846a908c79a28354bf

SHA1
adbe6a02b90147431e80fc38100de42d88dd765a

SHA256
bc7ea8011a8098690cf8976f14533fdbd5a0532818ed30365ef5412a256516f2

SHA512
490a19bdd35657a50e72f2c133c8d731cf1cccd14dc4ce9648d22f486540edd9f7448eb4d2840d52bd7601c52036572937b4c79bc32206eb98b7dc76765d1f00

Download Submit
C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\aImCrmZyeD77A2ANdrk.vbe

Filesize
221B

MD5
1a3448b944b91cebda73adc5064e6286

SHA1
4f8716c6e56a675944a5f0f250947c8d45a362e1

SHA256
5b489dab912970289bd0bfb41928010990288e7a3ec8acb18f637e670c50e0e5

SHA512
b355ffb98b0744cc6a1baaff7645c862344b12cfc251a1a243da666f7d41f8eea8b6a179faaeb600ffd4b4ce51b8c3f942c0cc6bd06875a4b80440468ce63795

Download Submit
C:\Windows\Installer\MSI9337.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSI93F5.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIA29D.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
C:\winNet\ComContainerbrowserRefRuntime.exe

Filesize
1.6MB

MD5
e41ef428aaa4841f258a38dc1cc305ef

SHA1
edf3a17831e013b74479e2e635b8cf0c1b3787ce

SHA256
6c02076f8f42678e0576a71ff170ed84b203a0e5e9a31bda9aed912822f25995

SHA512
a92a30077601aaf34a05ceaab5738ad2aa585498868bb6b675dd43d332c46424c859ed19cf0159b04fcf7b4da3b773e37ca064e8975a43964cc6a654661f46bd

Download Submit
C:\winNet\rsH0xIUsPk2E2Mq2a4QwbDGWD6K8lz.bat

Filesize
92B

MD5
81c6a00913630266cef3d07065db9b1f

SHA1
db6260ef38563ec05f910277af358fbaa2387154

SHA256
5898912e30972853e1b8ee628e9c300f25c5959d11e6b91b6454ddc19e328cf4

SHA512
a643512ca118e8745ae8aafb010bb21099ba0a358eb8a951471cc5092e14c51ffafae0c288d84ddcda5eaad2a3e93b30ecd205bfe0938a21f05e6c87ead3cb36

Download Submit
C:\winNet\we9fgyC144zVOkGk.vbe

Filesize
215B

MD5
aa1a085aba94a5fc38c26b79a2217336

SHA1
f847af2aec7fd56fe8734ccb51d8027b9b4e817b

SHA256
f66e935da9738cbddac905b9b55a2cfe5003aab76863b180a28e42238cbaa545

SHA512
75f66a848dc09ea859d7ddad59f6d7cac148936340eef14c4ad6cec7d4d92cf0c32bdaf911c0d943e7c478445118852180bdaceb72d9d4aae919f99cd6538981

Download Submit
\??\c:\Program Files (x86)\Google\CSCAAD7179340394874A285D488B5457E8.TMP

Filesize
1KB

MD5
987ffb806ae972d4d819462882de79b5

SHA1
f83a142a5257aeaf4e4b1a6890a4a3dc5bc742af

SHA256
ccbc1d568bc16cfcacaf127122b7ffeacb1cf5c1237e0c5f3bc6921d9ab82496

SHA512
69c6c8bd9b3ddc4196d1d92e7e224d51d814aeed0c674790480ab321e5564b398c8fae97154e2ae508928e51066bef58a6cdcbd2528de71953facaa360f10937

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qkpia11b\qkpia11b.0.cs

Filesize
377B

MD5
b9bafaf742aaa6d494826974631d6cdc

SHA1
df022577e633f7af62350d920a98401184ce1c1f

SHA256
fe916fc85ac13b044ec21b311f8999c25fea8942152a47c6f0c82d374895c9fe

SHA512
b59de87be53b06423dd54ea2525bd3658e60fdf0da769f7f2f94c4cc1fc9e2fe8be8d8b183f271f02dc31f0f3f2652bf2fd490ca4317258e255068a7f1248c85

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qkpia11b\qkpia11b.cmdline

Filesize
242B

MD5
d09fb03c0014156828eac6f6a3f78d95

SHA1
260a768d2ae84450a2d2e0f8437ce5fd7826389a

SHA256
bae22c0de51fabd7e2d17513c60039768ec66ebabc2ee2633b516d53d3b5a312

SHA512
415c36e4c317a6bd3eb97d3d4ca4fdf1f8798169cc1a3df7dbfac6af655e537caf4f6dd6aec59c128799e69107f2c26976ab8c5873b40770547512bb6503c5d3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uy1cycsw\uy1cycsw.0.cs

Filesize
362B

MD5
5cbb0f5953484f487923f3a505177ee4

SHA1
243ba5ccf2b7b08dbb5a873ee8bc13c8d62f6e16

SHA256
9aea70b80686e812b89b34a82f527633772cd38fe1cd71a898a237e9b0b9cb8a

SHA512
6f0140f7b5170ecc61159199e1de222b235977768347b25407f90e596d3802dbed1ca173f4758887afff72b4dc39dc72c1602a3a85609fb0b18973b14bbd2c58

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uy1cycsw\uy1cycsw.cmdline

Filesize
227B

MD5
ca9d57ae6b611281c86d053b502590fe

SHA1
c71ea1b3189d7f621630d6fb1da5bb2bb08f40da

SHA256
d4c90c7d4751a3db9507563506b111c18c6568d6c6359859341316f0c1043fc0

SHA512
4f2884d57c9361cbfb312d96565822fd8e8ade7205eceacb0be3458720f03dd1559ae523ea4d683be57a3beefab36ad7abae89a5124309d63fad5fafcd116c7e

Download Submit
memory/3012-27-0x0000000000400000-0x0000000000CC7000-memory.dmp

Filesize
8.8MB

Download
memory/3620-35-0x0000000000400000-0x000000000069B000-memory.dmp

Filesize
2.6MB

Download
memory/4108-905-0x0000000000620000-0x00000000007B6000-memory.dmp

Filesize
1.6MB

Download
memory/4292-75-0x000000001C4F0000-0x000000001C4FE000-memory.dmp

Filesize
56KB

Download
memory/4292-74-0x000000001C4E0000-0x000000001C4F0000-memory.dmp

Filesize
64KB

Download
memory/4292-73-0x000000001BFC0000-0x000000001BFD6000-memory.dmp

Filesize
88KB

Download
memory/4292-72-0x000000001B970000-0x000000001B978000-memory.dmp

Filesize
32KB

Download
memory/4292-70-0x000000001B940000-0x000000001B95C000-memory.dmp

Filesize
112KB

Download
memory/4292-69-0x000000001B910000-0x000000001B91E000-memory.dmp

Filesize
56KB

Download
memory/4292-68-0x0000000000BC0000-0x0000000000D44000-memory.dmp

Filesize
1.5MB

Download
memory/4292-71-0x000000001C530000-0x000000001C580000-memory.dmp

Filesize
320KB

Download
memory/4292-76-0x000000001C500000-0x000000001C50E000-memory.dmp

Filesize
56KB

Download
memory/4292-78-0x000000001C520000-0x000000001C52C000-memory.dmp

Filesize
48KB

Download
memory/4292-77-0x000000001C510000-0x000000001C51A000-memory.dmp

Filesize
40KB

Download
memory/4600-174-0x0000017F6CAF0000-0x0000017F6CB66000-memory.dmp

Filesize
472KB

Download
memory/4600-170-0x0000017F6C360000-0x0000017F6C382000-memory.dmp

Filesize
136KB

Download
memory/4892-63-0x00000000055B0000-0x0000000005AAE000-memory.dmp

Filesize
5.0MB

Download
memory/4892-61-0x00000000008A0000-0x000000000096E000-memory.dmp

Filesize
824KB

Download
memory/5692-929-0x00000000007E0000-0x00000000009BA000-memory.dmp

Filesize
1.9MB

Download
memory/5692-931-0x00000000011B0000-0x00000000011BE000-memory.dmp

Filesize
56KB

Download
memory/5692-933-0x00000000011F0000-0x000000000120C000-memory.dmp

Filesize
112KB

Download
memory/5692-935-0x0000000002C10000-0x0000000002C28000-memory.dmp

Filesize
96KB

Download
memory/5692-937-0x00000000011C0000-0x00000000011CC000-memory.dmp

Filesize
48KB

Download
memory/5712-805-0x000001A0233C0000-0x000001A0233D2000-memory.dmp

Filesize
72KB

Download
memory/5712-803-0x000001A0237F0000-0x000001A023A10000-memory.dmp

Filesize
2.1MB

Download
memory/5712-798-0x000001A008C60000-0x000001A008E81000-memory.dmp

Filesize
2.1MB

Download
memory/5976-925-0x000000001D470000-0x000000001D996000-memory.dmp

Filesize
5.1MB

Download
memory/5976-907-0x000000001C770000-0x000000001C932000-memory.dmp

Filesize
1.8MB

Download