dcrat | c1be767404a3d71717a54b01ebfa91ebff578dad8dd518a1a49012bcf012738e

Resubmissions

27/07/2024, 17:08

240727-vnrrpszapr 10

24/07/2024, 13:55

240724-q8e67aygrr 10

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
Size

2.0MB
MD5

40ac7d11ebb91612d8d5c16c05af0a13
SHA1

543a6c16f8f058fb6ba029ee3a9c5fde92aaa212
SHA256

4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e
SHA512

223ecc008fe3b9818597c3870ef605674eb96c52f8f140edb1d7c878691ce16c604440be77107c795a2bbb4e1b5c28ba94141e5703d9488c3a06580e38bf953c
SSDEEP

49152:PbA3HdwWe2aSe6pcUwxE0G+dK7RB7/wWnm1Xl:Pbt2M4cUwxEII7RB0d1Xl

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\", \"C:\\Windows\\Media\\Heritage\\dwm.exe\", \"C:\\componentCommon\\sihost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\", \"C:\\Windows\\Media\\Heritage\\dwm.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\", \"C:\\Windows\\Media\\Heritage\\dwm.exe\", \"C:\\componentCommon\\sihost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\", \"C:\\Windows\\Media\\Heritage\\dwm.exe\", \"C:\\componentCommon\\sihost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\", \"C:\\componentCommon\\wininit.exe\", \"C:\\componentCommon\\spoolsv.exe\", \"C:\\Windows\\Installer\\services.exe\", \"C:\\Program Files\\Windows Portable Devices\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\", \"C:\\Windows\\Media\\Heritage\\dwm.exe\", \"C:\\componentCommon\\sihost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\", \"C:\\componentCommon\\wininit.exe\", \"C:\\componentCommon\\spoolsv.exe\", \"C:\\Windows\\Installer\\services.exe\", \"C:\\Program Files\\Windows Portable Devices\\sppsvc.exe\", \"C:\\Windows\\Web\\Screen\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\", \"C:\\Windows\\Media\\Heritage\\dwm.exe\", \"C:\\componentCommon\\sihost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\", \"C:\\componentCommon\\wininit.exe\", \"C:\\componentCommon\\spoolsv.exe\", \"C:\\Windows\\Installer\\services.exe\", \"C:\\Program Files\\Windows Portable Devices\\sppsvc.exe\", \"C:\\Windows\\Web\\Screen\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\", \"C:\\Windows\\Media\\Heritage\\dwm.exe\", \"C:\\componentCommon\\sihost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\", \"C:\\componentCommon\\wininit.exe\", \"C:\\componentCommon\\spoolsv.exe\", \"C:\\Windows\\Installer\\services.exe\", \"C:\\Program Files\\Windows Portable Devices\\sppsvc.exe\", \"C:\\Windows\\Web\\Screen\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\componentCommon\\StartMenuExperienceHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\", \"C:\\Windows\\Media\\Heritage\\dwm.exe\", \"C:\\componentCommon\\sihost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\", \"C:\\componentCommon\\wininit.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\", \"C:\\Windows\\Media\\Heritage\\dwm.exe\", \"C:\\componentCommon\\sihost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\", \"C:\\componentCommon\\wininit.exe\", \"C:\\componentCommon\\spoolsv.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default\\Links\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\", \"C:\\Windows\\Media\\Heritage\\dwm.exe\", \"C:\\componentCommon\\sihost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\", \"C:\\componentCommon\\wininit.exe\", \"C:\\componentCommon\\spoolsv.exe\", \"C:\\Windows\\Installer\\services.exe\""	ComInto.exe

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	424	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	244	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3148	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	3148	schtasks.exe	95

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral24/files/0x000700000002346e-10.dat	dcrat
behavioral24/memory/1764-13-0x0000000000340000-0x00000000004EC000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	ComInto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 2 IoCs

pid	Process
1764	ComInto.exe
3280	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\componentCommon\\spoolsv.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Portable Devices\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Portable Devices\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Web\\Screen\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\componentCommon\\StartMenuExperienceHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\Media\\Heritage\\dwm.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\Media\\Heritage\\dwm.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Installer\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default\\Links\\wininit.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default\\Links\\wininit.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\componentCommon\\wininit.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\componentCommon\\spoolsv.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\componentCommon\\sihost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Installer\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\componentCommon\\sihost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\componentCommon\\wininit.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Web\\Screen\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\componentCommon\\StartMenuExperienceHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Microsoft Office 15\\RuntimeBroker.exe\""	ComInto.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\eddb19405b7ce1	ComInto.exe
File created	C:\Program Files\Windows Portable Devices\sppsvc.exe	ComInto.exe
File created	C:\Program Files\Windows Portable Devices\0a1fd5f707cd16	ComInto.exe
File created	C:\Program Files\Microsoft Office 15\RuntimeBroker.exe	ComInto.exe
File created	C:\Program Files\Microsoft Office 15\9e8d7a4ca61bd9	ComInto.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\backgroundTaskHost.exe	ComInto.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Web\Screen\RuntimeBroker.exe	ComInto.exe
File created	C:\Windows\Web\Screen\9e8d7a4ca61bd9	ComInto.exe
File created	C:\Windows\Media\Heritage\dwm.exe	ComInto.exe
File created	C:\Windows\Media\Heritage\6cb0b6c459d5d3	ComInto.exe
File created	C:\Windows\Installer\services.exe	ComInto.exe
File created	C:\Windows\Installer\c5b4cb5e9653cc	ComInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3272	schtasks.exe
2300	schtasks.exe
880	schtasks.exe
4964	schtasks.exe
244	schtasks.exe
3096	schtasks.exe
4728	schtasks.exe
3468	schtasks.exe
1464	schtasks.exe
1452	schtasks.exe
3744	schtasks.exe
400	schtasks.exe
4788	schtasks.exe
2532	schtasks.exe
3520	schtasks.exe
4076	schtasks.exe
676	schtasks.exe
4372	schtasks.exe
4600	schtasks.exe
3936	schtasks.exe
2228	schtasks.exe
2820	schtasks.exe
3948	schtasks.exe
1180	schtasks.exe
4500	schtasks.exe
4676	schtasks.exe
424	schtasks.exe
4528	schtasks.exe
2800	schtasks.exe
1132	schtasks.exe
856	schtasks.exe
664	schtasks.exe
4064	schtasks.exe
2460	schtasks.exe
1012	schtasks.exe
2020	schtasks.exe
3076	schtasks.exe
4892	schtasks.exe
4012	schtasks.exe
4576	schtasks.exe
220	schtasks.exe
3996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1764	ComInto.exe
1764	ComInto.exe
1764	ComInto.exe
1764	ComInto.exe
1764	ComInto.exe
1764	ComInto.exe
1764	ComInto.exe
1764	ComInto.exe
1764	ComInto.exe
1764	ComInto.exe
3280	RuntimeBroker.exe
3280	RuntimeBroker.exe
3280	RuntimeBroker.exe
3280	RuntimeBroker.exe
3280	RuntimeBroker.exe
3280	RuntimeBroker.exe
3280	RuntimeBroker.exe
3280	RuntimeBroker.exe
3280	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3280	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	ComInto.exe
Token: SeDebugPrivilege	3280	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 5088	2520	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe	88
PID 2520 wrote to memory of 5088	2520	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe	88
PID 2520 wrote to memory of 5088	2520	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe	88
PID 5088 wrote to memory of 4744	5088	WScript.exe	89
PID 5088 wrote to memory of 4744	5088	WScript.exe	89
PID 5088 wrote to memory of 4744	5088	WScript.exe	89
PID 4744 wrote to memory of 1764	4744	cmd.exe	91
PID 4744 wrote to memory of 1764	4744	cmd.exe	91
PID 1764 wrote to memory of 3280	1764	ComInto.exe	138
PID 1764 wrote to memory of 3280	1764	ComInto.exe	138
PID 3280 wrote to memory of 384	3280	RuntimeBroker.exe	140
PID 3280 wrote to memory of 384	3280	RuntimeBroker.exe	140
PID 3280 wrote to memory of 2472	3280	RuntimeBroker.exe	141
PID 3280 wrote to memory of 2472	3280	RuntimeBroker.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
"C:\Users\Admin\AppData\Local\Temp\4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\componentCommon\TsZJDcKjHujznUYiyXhQefVwV2.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\componentCommon\j1nvYpGjbyEFrc.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\componentCommon\ComInto.exe
      "C:\componentCommon\ComInto.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\Windows\Web\Screen\RuntimeBroker.exe
        
        "C:\Windows\Web\Screen\RuntimeBroker.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3280
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd92a9b0-9c9c-479b-9ef1-d0d242317fc5.vbs"
        6⤵
        
        PID:384
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30926640-acd5-4ea5-a51c-1f56691982c8.vbs"
        6⤵
        
        PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Links\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Links\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Links\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\Heritage\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Media\Heritage\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\Heritage\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\componentCommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\componentCommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\componentCommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\componentCommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\componentCommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\componentCommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\componentCommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\componentCommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\componentCommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\Installer\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Installer\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\Installer\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\Web\Screen\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Web\Screen\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\Web\Screen\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\componentCommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\componentCommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\componentCommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\30926640-acd5-4ea5-a51c-1f56691982c8.vbs

Filesize
491B

MD5
695dfb6671b1a13e03adcb0a2f982b1d

SHA1
c82397b7755495fe519f8e5ac4202b1dce921663

SHA256
d12a0017c521cbef8833fba5f9b10254b864b92a7ee8daa35788deaf7c45ec69

SHA512
826f35ec16dd168e4b9d3d9c52799feef796b66530c74ec6b2d260e85af36ae24eec8d2eb46f672a4ac9ea857dfd8bcd19f55b9530b6c6e71db7400113dff5a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\fd92a9b0-9c9c-479b-9ef1-d0d242317fc5.vbs

Filesize
715B

MD5
157c04c01788503a745ece3c95555da8

SHA1
3f5e8d29373142ebb6ae4d0d377475e0ae2908e6

SHA256
ade58989db7bde9fe2cfca2dd7dccca03596814ed89b9dd9fd363dc822a2385b

SHA512
89ee1a41242b53bf442e1a4c65faab44ebafde2b2f543077d8e218a54a18b12ba289c5bf64e2464fb3d32a0549fbc21752babbfd29d15ac7e91bcd21c5c3b736

Download Submit
C:\componentCommon\ComInto.exe

Filesize
1.6MB

MD5
9a0cee5a5ce317b7a70f88bb6aaa49e1

SHA1
95a779063656075a8ddc2f2164393fa59e3c93d9

SHA256
701924dd5d93b99a1e90fcd92f399c4453455e78375125f7a06aca20b84956bc

SHA512
d9c6240b6809c3decbdf4d97aca246f308670097b704b47449c53d8dc121f391d3ec6596f7947c36a01a388eeefe6f9ac9785698cf743f8a89c7cbf7b9da41a4

Download Submit
C:\componentCommon\TsZJDcKjHujznUYiyXhQefVwV2.vbe

Filesize
206B

MD5
e986ea5d4cac976a6de65d3f1ef8b332

SHA1
6465da0abcfac05b8ed1f32b9cca57e2e2f54aea

SHA256
3ad8783bacfea22158df341d1bbedf8f6f0dcc4d9504555b36a756d2fcd83831

SHA512
896934c1a2941a8edfd38b03a858fc589cfb6622ae75019a542638be0c9c4e436aacd0916196dd71442d1a90404afa29d2864c92401222ff5ec2a712d873fa11

Download Submit
C:\componentCommon\j1nvYpGjbyEFrc.bat

Filesize
32B

MD5
a0b9b0891c2cae67cd1beae705d09d4f

SHA1
997953188d6226de19faa0ab4e8fdbddf1fb5617

SHA256
13593fab7a2113730fdbe4cbf436dde9a26116cda0bd4a33dff27d5678e9f9fc

SHA512
bdcd0c6a765c3927180706f7b30f2ea0f7cab6f27e512433839ebe3f6cb148923a6733ae954c24fa6eedeca97b8dc01cae945eea07e1121ff74885a69b34f2bb

Download Submit
memory/1764-20-0x0000000000DD0000-0x0000000000DE0000-memory.dmp

Filesize
64KB

Download
memory/1764-24-0x00000000027D0000-0x00000000027DC000-memory.dmp

Filesize
48KB

Download
memory/1764-16-0x0000000002900000-0x0000000002950000-memory.dmp

Filesize
320KB

Download
memory/1764-19-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

Filesize
32KB

Download
memory/1764-18-0x0000000000DA0000-0x0000000000DB6000-memory.dmp

Filesize
88KB

Download
memory/1764-14-0x0000000000D50000-0x0000000000D5E000-memory.dmp

Filesize
56KB

Download
memory/1764-17-0x0000000000D60000-0x0000000000D68000-memory.dmp

Filesize
32KB

Download
memory/1764-21-0x0000000000DE0000-0x0000000000DE8000-memory.dmp

Filesize
32KB

Download
memory/1764-22-0x00000000027A0000-0x00000000027B2000-memory.dmp

Filesize
72KB

Download
memory/1764-15-0x0000000000D80000-0x0000000000D9C000-memory.dmp

Filesize
112KB

Download
memory/1764-23-0x000000001BDE0000-0x000000001C308000-memory.dmp

Filesize
5.2MB

Download
memory/1764-28-0x0000000002980000-0x000000000298C000-memory.dmp

Filesize
48KB

Download
memory/1764-27-0x0000000002970000-0x000000000297E000-memory.dmp

Filesize
56KB

Download
memory/1764-29-0x0000000002990000-0x000000000299C000-memory.dmp

Filesize
48KB

Download
memory/1764-26-0x0000000002960000-0x000000000296A000-memory.dmp

Filesize
40KB

Download
memory/1764-25-0x0000000002950000-0x0000000002958000-memory.dmp

Filesize
32KB

Download
memory/1764-13-0x0000000000340000-0x00000000004EC000-memory.dmp

Filesize
1.7MB

Download
memory/1764-12-0x00007FFCE3CC3000-0x00007FFCE3CC5000-memory.dmp

Filesize
8KB

Download