dcrat | 80446e16d616fee4a8ffeef94f2dc1f5737435d07a111de9622f13a98a5f196e

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe
Size

745KB
MD5

5e82f4a00b31da2ecd210a7c7575e29d
SHA1

518e5f78b256ee794ebbc8f96275993a9252be23
SHA256

80446e16d616fee4a8ffeef94f2dc1f5737435d07a111de9622f13a98a5f196e
SHA512

5f794743493acff89407966cdc2b3df386389d90f2468ec5a32c4df2a2ba6dfddea60886ab14a6e9a1b4ddc173989278e2c7397d430aea8c01297b40d782a900
SSDEEP

12288:sBpoIY///1UFxJF80IsoBVnsNxd2LFErkUzw2jtQsnmeTRf7qrc5PPjr21tM/7nf:ZIY/4FcHG/MnUzVhmMRfG4lLr2M/T

Score

10^/10

dcrat njrat hacked discovery evasion infostealer rat trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

thomas-drops.gl.at.ply.gg:45773

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2820	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2820	schtasks.exe	35

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reviewdriver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reviewdriver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reviewdriver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000f000000018ab4-6.dat	dcrat
behavioral1/files/0x0006000000018b5d-27.dat	dcrat
behavioral1/memory/2656-31-0x00000000002C0000-0x00000000003B4000-memory.dmp	dcrat
behavioral1/memory/3040-80-0x00000000008A0000-0x0000000000994000-memory.dmp	dcrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Server.exe

Executes dropped EXE 4 IoCs

pid	Process
1220	gggg.exe
2784	Server.exe
2656	reviewdriver.exe
3040	dllhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2956	cmd.exe
2956	cmd.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	reviewdriver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reviewdriver.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\csrss.exe	reviewdriver.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\886983d96e3d3e	reviewdriver.exe
File created	C:\Program Files\Windows Portable Devices\69ddcba757bf72	reviewdriver.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\taskhost.exe	reviewdriver.exe
File created	C:\Program Files\Windows Sidebar\es-ES\lsm.exe	reviewdriver.exe
File created	C:\Program Files\Windows Sidebar\es-ES\101b941d020240	reviewdriver.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\5940a34987c991	reviewdriver.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\taskhost.exe	reviewdriver.exe
File created	C:\Program Files (x86)\Uninstall Information\5940a34987c991	reviewdriver.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\Server.exe	reviewdriver.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\dllhost.exe	reviewdriver.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\b75386f1303e64	reviewdriver.exe
File created	C:\Program Files\Windows Portable Devices\smss.exe	reviewdriver.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\fr-FR\taskhost.exe	reviewdriver.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\b75386f1303e64	reviewdriver.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\786bd863e8d80c	reviewdriver.exe
File created	C:\Program Files (x86)\Uninstall Information\dllhost.exe	reviewdriver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gggg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
752	schtasks.exe
936	schtasks.exe
2372	schtasks.exe
956	schtasks.exe
808	schtasks.exe
1192	schtasks.exe
2448	schtasks.exe
2476	schtasks.exe
560	schtasks.exe
2928	schtasks.exe
1824	schtasks.exe
1000	schtasks.exe
1780	schtasks.exe
1116	schtasks.exe
2544	schtasks.exe
2732	schtasks.exe
3000	schtasks.exe
1776	schtasks.exe
1004	schtasks.exe
2268	schtasks.exe
2900	schtasks.exe
2740	schtasks.exe
2248	schtasks.exe
2272	schtasks.exe
2416	schtasks.exe
1436	schtasks.exe
2840	schtasks.exe
2708	schtasks.exe
1920	schtasks.exe
1308	schtasks.exe
1060	schtasks.exe
1960	schtasks.exe
2780	schtasks.exe
1808	schtasks.exe
692	schtasks.exe
2392	schtasks.exe
2400	schtasks.exe
3028	schtasks.exe
1320	schtasks.exe
1976	schtasks.exe
2164	schtasks.exe
2244	schtasks.exe
2584	schtasks.exe
2972	schtasks.exe
2340	schtasks.exe
1788	schtasks.exe
2080	schtasks.exe
2536	schtasks.exe
2704	schtasks.exe
2540	schtasks.exe
1488	schtasks.exe
1740	schtasks.exe
2920	schtasks.exe
1140	schtasks.exe
1744	schtasks.exe
876	schtasks.exe
2092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2656	reviewdriver.exe
2656	reviewdriver.exe
2656	reviewdriver.exe
3040	dllhost.exe
3040	dllhost.exe
3040	dllhost.exe
3040	dllhost.exe
3040	dllhost.exe
3040	dllhost.exe
3040	dllhost.exe
3040	dllhost.exe
3040	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2784	Server.exe
3040	dllhost.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	reviewdriver.exe
Token: SeDebugPrivilege	3040	dllhost.exe
Token: SeDebugPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe
Token: 33	2784	Server.exe
Token: SeIncBasePriorityPrivilege	2784	Server.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1220	1656	АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe	29
PID 1656 wrote to memory of 1220	1656	АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe	29
PID 1656 wrote to memory of 1220	1656	АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe	29
PID 1656 wrote to memory of 1220	1656	АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe	29
PID 1656 wrote to memory of 2784	1656	АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe	30
PID 1656 wrote to memory of 2784	1656	АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe	30
PID 1656 wrote to memory of 2784	1656	АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe	30
PID 1656 wrote to memory of 2784	1656	АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe	30
PID 1220 wrote to memory of 2800	1220	gggg.exe	31
PID 1220 wrote to memory of 2800	1220	gggg.exe	31
PID 1220 wrote to memory of 2800	1220	gggg.exe	31
PID 1220 wrote to memory of 2800	1220	gggg.exe	31
PID 2800 wrote to memory of 2956	2800	WScript.exe	32
PID 2800 wrote to memory of 2956	2800	WScript.exe	32
PID 2800 wrote to memory of 2956	2800	WScript.exe	32
PID 2800 wrote to memory of 2956	2800	WScript.exe	32
PID 2956 wrote to memory of 2656	2956	cmd.exe	34
PID 2956 wrote to memory of 2656	2956	cmd.exe	34
PID 2956 wrote to memory of 2656	2956	cmd.exe	34
PID 2956 wrote to memory of 2656	2956	cmd.exe	34
PID 2656 wrote to memory of 3040	2656	reviewdriver.exe	93
PID 2656 wrote to memory of 3040	2656	reviewdriver.exe	93
PID 2656 wrote to memory of 3040	2656	reviewdriver.exe	93
PID 3040 wrote to memory of 2212	3040	dllhost.exe	94
PID 3040 wrote to memory of 2212	3040	dllhost.exe	94
PID 3040 wrote to memory of 2212	3040	dllhost.exe	94
PID 3040 wrote to memory of 2172	3040	dllhost.exe	95
PID 3040 wrote to memory of 2172	3040	dllhost.exe	95
PID 3040 wrote to memory of 2172	3040	dllhost.exe	95

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reviewdriver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reviewdriver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reviewdriver.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe
"C:\Users\Admin\AppData\Local\Temp\АОАОАОАОА БЕСПЛАТНЫЕ РОБУКСЫ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\gggg.exe
  "C:\Users\Admin\AppData\Local\Temp\gggg.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ChainComponentBrowserwin\zJJP8u9NRTk6u.vbe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\ChainComponentBrowserwin\ZckenFSJPCIUJWjfI5CZYMEmaPZVg.bat" "
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\ChainComponentBrowserwin\reviewdriver.exe
        
        "C:\ChainComponentBrowserwin\reviewdriver.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2656
      - C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\dllhost.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11b54f33-dfd7-4805-bfa5-d9838026c706.vbs"
        7⤵
        
        PID:2212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\65d3fc47-f9be-47ef-8150-45c0f59548b6.vbs"
        7⤵
        
        PID:2172
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Games\FreeCell\fr-FR\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\FreeCell\fr-FR\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Games\FreeCell\fr-FR\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ServerS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\Server.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Server" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\Server.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ServerS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\Server.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\es-ES\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\es-ES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\es-ES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ServerS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Server.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Server" /sc ONLOGON /tr "'C:\Users\Default User\Server.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ServerS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\Server.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Downloads\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Downloads\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\ChainComponentBrowserwin\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\ChainComponentBrowserwin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\ChainComponentBrowserwin\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Uninstall Information\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Uninstall Information\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\ChainComponentBrowserwin\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\ChainComponentBrowserwin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\ChainComponentBrowserwin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ChainComponentBrowserwin\ZckenFSJPCIUJWjfI5CZYMEmaPZVg.bat

Filesize
46B

MD5
3e83fda43f1932bb71d930d2f89e68b2

SHA1
1fa2f89990c21a7f0eebfbf06f7064c19e46b081

SHA256
ecb36758516d13f656baac1a37f3af9dd3e683e8aab3847d65bb82c9eb05cb51

SHA512
d6efea92b244d10f5a0e2b228782cc7e1b45fcf262dcc7ea709a9ab8fa458b2e8d3e3bfa4cdf4a4852812d01bb9ff1c7bba65abbe62527e5a84e5b3b15f8ea9b

Download Submit
C:\ChainComponentBrowserwin\zJJP8u9NRTk6u.vbe

Filesize
230B

MD5
b9b72befe720ec640eb23938f752a453

SHA1
c621298c3cfac9aa9c5cdfebd5efa0a1b01c7b34

SHA256
bddc35ffa29cfc10fc39778a551335781091aec61771943662e66cdf4c4a07ad

SHA512
4d119e2aba40fe14d624690103d08620369eeeb0a922a3091027a7cf90597db7d491653ed356eb85a45104bdcbd3eb5876e5c4c508ed85d0e235d71a65578f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\11b54f33-dfd7-4805-bfa5-d9838026c706.vbs

Filesize
762B

MD5
e31df84e24c5e8056b676e48fb878f49

SHA1
cfa3cae3cd69f611876ccbde02aa31b70e25ba5e

SHA256
688bf760cbc680827e74af103497eabd26f8b42fef997cfd6bb6d890b613a584

SHA512
6fb6957236202f97b7a52d9356e76d1ef270917b01f34eedf01944ad5a81396b313cb55f826a200a6b20ef9f316a8c34834af1912aefd2d61b00f86aec764586

Download Submit
C:\Users\Admin\AppData\Local\Temp\65d3fc47-f9be-47ef-8150-45c0f59548b6.vbs

Filesize
538B

MD5
fa10fe7a3f5b9966e0f73aefbc3b1b4a

SHA1
51752f3abb9079b3eb03a8e0e0d1c743fb7f9dd3

SHA256
ea30fefaf31394b67b67e6a1f8803e1ba5e97c61eed2916b9a402100e4bafcac

SHA512
903ddd766f04b80592e2c96bc7dd4dadc295626759854eaf918e4ac7cc3934d3daad4cd6c7be3b3c196a842bbb34504bd87cb660c17bac93e197ac98380f2363

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
43KB

MD5
eab8788760465b2b46598ff289b4b8c4

SHA1
8c7b27c7ec66ea41f7e20afaf1394fb71b7c4a35

SHA256
7ba3084c6d0fcc0e6e1fedfdd04d24768b819aaf309b933d0f4243c37297821f

SHA512
996471d395c297950a4df7140cf0dda388f87ad8a26fb99feb35fa265873b77a7e100520df69770fbe1554ad4bf7f877f9214a61b44326353935dfe7def12ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\gggg.exe

Filesize
1.2MB

MD5
c5607848210b7d664771584276d7d7ae

SHA1
9a395fbac63306fa240e51646cad80a803064352

SHA256
16de1516d3fc00a0873b270ffa44f20c13524827a88798e2743afe0bb06b9815

SHA512
ef9c622ee75161fc038456a2a7e7b9e881f66852dd06331fa2fecac13ce4d585b332672d51a6c8ab3dfd5a99de22b863dd52b53750669d0175aea45ed08a6e8b

Download Submit
\ChainComponentBrowserwin\reviewdriver.exe

Filesize
948KB

MD5
2e2c059f61338c40914c10d40502e57e

SHA1
e6cb5a1ffdf369b3135c72ab12d71cc3d5f2b053

SHA256
8e4df816223a625bf911553d5f80219f81fc44f07ba98c95f379fd12169c2918

SHA512
1b1f2dae55f50874532b37ad4ab74a54452f65d7499004b37b0afc3dc2c1d16d66a0e41c1733ac1f4cff9993325d32ea714b441c06ba4eba350136835c746d3e

Download Submit
memory/1656-14-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/1656-1-0x00000000009C0000-0x0000000000A80000-memory.dmp

Filesize
768KB

Download
memory/1656-10-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/1656-0-0x000007FEF6033000-0x000007FEF6034000-memory.dmp

Filesize
4KB

Download
memory/2656-31-0x00000000002C0000-0x00000000003B4000-memory.dmp

Filesize
976KB

Download
memory/2656-32-0x00000000002B0000-0x00000000002BA000-memory.dmp

Filesize
40KB

Download
memory/2656-33-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/2656-34-0x00000000004D0000-0x00000000004DA000-memory.dmp

Filesize
40KB

Download
memory/2784-81-0x000000007436E000-0x000000007436F000-memory.dmp

Filesize
4KB

Download
memory/2784-17-0x0000000000EE0000-0x0000000000EF2000-memory.dmp

Filesize
72KB

Download
memory/2784-16-0x000000007436E000-0x000000007436F000-memory.dmp

Filesize
4KB

Download
memory/3040-80-0x00000000008A0000-0x0000000000994000-memory.dmp

Filesize
976KB

Download