Overview

overview

10

Static

static

10

272d470872...26.exe

windows7-x64

10

272d470872...26.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/10/2024, 02:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe

  • Size

    1.4MB

  • MD5

    77fffee187fabb45ffc7219d421ea83f

  • SHA1

    3f21e5a79d674131678ac5de8eaf30bbfcbb177c

  • SHA256

    272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26

  • SHA512

    3c27ed77b4e5c522804b48b94b70071bc07b4227ed3f5018d45160cb192136296f75a84af770caf72c797d2ea7fa36c8d897f2d68199f0fe0123c94781452b1f

  • SSDEEP

    24576:KufUOExyABqHwzAsZg7ySXHzf9gUQ4zWp2Wn7b5kXxK:K3zBqATEzf9gUQPn7b5kXx

Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 9 IoCs
    persistence
  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 51 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Adds Run key to start application 2 TTPs 18 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 34 IoCs
    evasiontrojan
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 17 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 51 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
    "C:\Users\Admin\AppData\Local\Temp\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3404
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bVDEVcmN0E.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:5072
        • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
          "C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4996
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9be196b6-8b36-4f30-b290-2b24f2a9b3c3.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2820
            • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
              C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4956
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33bb359c-0c42-4a9b-88eb-ab5db1c1bfeb.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4840
                • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                  C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:864
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a185c625-fec3-4ac2-a869-c5f762809ca6.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2880
                    • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                      C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:5004
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eea509ec-c5d0-4b01-a761-0bbcb3853246.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1596
                        • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                          C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:2944
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db0bf3c6-67ed-4056-979e-863d64001583.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1924
                            • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                              C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:1772
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c915eaf-d3b3-4dcd-8b19-31d9e9c62687.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3020
                                • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                  C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:2208
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16ce91ad-b0f0-4858-9a84-c7b36f4acb22.vbs"
                                    16⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3552
                                    • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                      C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                      17⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • System policy modification
                                      PID:4868
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8dff233-54f3-4268-9918-b3d3af55b61e.vbs"
                                        18⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2556
                                        • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                          C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                          19⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:3948
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd83b9b3-ec3f-45cc-bac9-6238e9a70729.vbs"
                                            20⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:884
                                            • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                              C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                              21⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:4008
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ee9c904-0703-4330-8350-47d8f88e8d07.vbs"
                                                22⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:4508
                                                • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                  C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                  23⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  • System policy modification
                                                  PID:3656
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2e034c7-94b1-430f-815e-c3536ffdb416.vbs"
                                                    24⤵
                                                      PID:1936
                                                      • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                        C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                        25⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:4892
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3f7f52f-8fd9-4fca-a27e-c81c534d9a22.vbs"
                                                          26⤵
                                                            PID:2328
                                                            • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                              C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                              27⤵
                                                              • UAC bypass
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:3996
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b94b43a5-07c6-4507-a82d-8ba54e271b64.vbs"
                                                                28⤵
                                                                  PID:2724
                                                                  • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                                    C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                                    29⤵
                                                                    • UAC bypass
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • System policy modification
                                                                    PID:3024
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23d3c3ee-eaaa-4a95-816b-3f487a291280.vbs"
                                                                      30⤵
                                                                        PID:4640
                                                                        • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                                          C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                                          31⤵
                                                                          • UAC bypass
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Checks whether UAC is enabled
                                                                          • Modifies registry class
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • System policy modification
                                                                          PID:1740
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06b912ef-896f-40da-bb2a-55ef6320a650.vbs"
                                                                            32⤵
                                                                              PID:2164
                                                                              • C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                                                C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe
                                                                                33⤵
                                                                                • UAC bypass
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Checks whether UAC is enabled
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • System policy modification
                                                                                PID:3780
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c02a212-6c65-4883-b8c1-738c7536b515.vbs"
                                                                                  34⤵
                                                                                    PID:1452
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a684eaa8-388c-4c64-8a1b-eeb93cb91b80.vbs"
                                                                                    34⤵
                                                                                      PID:3496
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\127853ed-496f-4c00-aab1-eb74ae36b7a8.vbs"
                                                                                  32⤵
                                                                                    PID:3212
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd5db2af-17a2-48ff-aa83-c4d83165c2be.vbs"
                                                                                30⤵
                                                                                  PID:1900
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec486f70-cd6f-486c-8805-bc03ec1fa5e5.vbs"
                                                                              28⤵
                                                                                PID:3704
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2c089f5-ff05-49a5-98f6-8cfc9c64b5d0.vbs"
                                                                            26⤵
                                                                              PID:2140
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c2d9325-6171-4464-a0ce-b1bb82988276.vbs"
                                                                          24⤵
                                                                            PID:2068
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e035402-8b62-457b-aed2-ee03e19424c1.vbs"
                                                                        22⤵
                                                                          PID:4652
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9072a01b-62e5-4160-bf7f-59c795ba5fd1.vbs"
                                                                      20⤵
                                                                        PID:1660
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e96db7f6-cfd9-4369-b2e0-1b162864fbea.vbs"
                                                                    18⤵
                                                                      PID:4636
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\850f9be9-73b8-4681-b3c1-dd8215ca9b68.vbs"
                                                                  16⤵
                                                                    PID:2880
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8025d0a5-b792-4a08-9813-77c353ddeb18.vbs"
                                                                14⤵
                                                                  PID:5088
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50138985-2ac3-4b5e-9b1b-fe3a90753708.vbs"
                                                              12⤵
                                                                PID:720
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c24bea70-9fd3-4dff-89ff-50b5f0c45069.vbs"
                                                            10⤵
                                                              PID:4432
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d5008da-2f15-400f-8891-12eccbcc26d3.vbs"
                                                          8⤵
                                                            PID:4524
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36cd0636-cdf6-425a-8cff-6af297cfdbcf.vbs"
                                                        6⤵
                                                          PID:3332
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\85a64c8d-8068-41d3-842d-378f3b5c9f38.vbs"
                                                      4⤵
                                                        PID:3088
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\MusNotification.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5004
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\MusNotification.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4032
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\MusNotification.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4912
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4320
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3044
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2560
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2060
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4324
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4676
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e262" /sc MINUTE /mo 13 /tr "'C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2940
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26" /sc ONLOGON /tr "'C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4724
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e262" /sc MINUTE /mo 7 /tr "'C:\Windows\Cursors\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4668
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1616
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4472
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3600
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3948
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2564
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4596
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\csrss.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4796
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\csrss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2276
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\csrss.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1016
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\fontdrvhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2328
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4856
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3392
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\winlogon.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4052
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\winlogon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4756
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\winlogon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3680

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Winlogon Helper DLL

                                                1
                                                T1547.004

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Privilege Escalation

                                                Abuse Elevation Control Mechanism

                                                1
                                                T1548

                                                Bypass User Account Control

                                                1
                                                T1548.002

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Winlogon Helper DLL

                                                1
                                                T1547.004

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Defense Evasion

                                                Abuse Elevation Control Mechanism

                                                1
                                                T1548

                                                Bypass User Account Control

                                                1
                                                T1548.002

                                                Impair Defenses

                                                1
                                                T1562

                                                Disable or Modify Tools

                                                1
                                                T1562.001

                                                Modify Registry

                                                4
                                                T1112

                                                Credential Access

                                                Discovery

                                                Query Registry

                                                2
                                                T1012

                                                System Information Discovery

                                                3
                                                T1082

                                                Lateral Movement

                                                Collection

                                                Command and Control

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe
                                                  Filesize

                                                  1.4MB

                                                  MD5

                                                  77fffee187fabb45ffc7219d421ea83f

                                                  SHA1

                                                  3f21e5a79d674131678ac5de8eaf30bbfcbb177c

                                                  SHA256

                                                  272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26

                                                  SHA512

                                                  3c27ed77b4e5c522804b48b94b70071bc07b4227ed3f5018d45160cb192136296f75a84af770caf72c797d2ea7fa36c8d897f2d68199f0fe0123c94781452b1f

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26.exe.log
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  655010c15ea0ca05a6e5ddcd84986b98

                                                  SHA1

                                                  120bf7e516aeed462c07625fbfcdab5124ad05d3

                                                  SHA256

                                                  2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14

                                                  SHA512

                                                  e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\06b912ef-896f-40da-bb2a-55ef6320a650.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  8ef1ce2d6ceea8e196c78c74c809a8ea

                                                  SHA1

                                                  1d3cd30bd2f6bf3b2aafc2e11b89c46035ffe9e6

                                                  SHA256

                                                  952595debfaa1567c8d4d98a2347ed7657ec89eae4d3febaa0650563865482b6

                                                  SHA512

                                                  0f9c18755cbcd4f319960a39cd29073c3e1319f732e9d4d92c6ea009df5c1da1ad0203609bd63fdcc5e98615801b4aaab46f3e2cce2ef957f1e64f71889f0be5

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\0c02a212-6c65-4883-b8c1-738c7536b515.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  5add619c10a3f98151d9bd2f507ab409

                                                  SHA1

                                                  5f766d06259d552a569212128b91fefaaa52f85e

                                                  SHA256

                                                  e76e10bbb4a939237c8c0f3b76ba5493c564ee9febb1413abdc722ba5371b6b0

                                                  SHA512

                                                  705dd49c619e08c158c0416aefc4798b642539803ee8671db080f9ec3d9fbc2605ff027a1ac886a4e012b44295f9c6b45d6c45ff7b3a1ea0145e07fdeb4c5d98

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\16ce91ad-b0f0-4858-9a84-c7b36f4acb22.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  0e0d210b25dc23ef630e4647982d4cbc

                                                  SHA1

                                                  f67b56ef7e123868ad5ad41b4c32f5646ef6386d

                                                  SHA256

                                                  67eca09835648d65ade3c07a9f889e453e739ce389191c0640e89ccb29542b16

                                                  SHA512

                                                  e90e302fbcecee6df2b459e5f6faec918f0d15875154eee69e8e08596b84f3a1d3fcb38be8d8b95230cc0a16a68c28a0bd13fb862070b9c8e039b9b0613fbcd0

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\1c915eaf-d3b3-4dcd-8b19-31d9e9c62687.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  34c65a0ab2a185007ba5f6dac4433f27

                                                  SHA1

                                                  b99d9df473ec2c3bbcf30f12fa40c6a805fc2659

                                                  SHA256

                                                  782a626110731f44e6ac39583df488fd16413e82a7f74651858c291737322d1a

                                                  SHA512

                                                  cc0ac1e0935a77c2451806343a5f06ddd438995e681c5ea260a2a872064805d6859d845bfa8448b6975dfd905e6e699c7aa52784f98034ef8453358d0cfc7c67

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\23d3c3ee-eaaa-4a95-816b-3f487a291280.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  30a3d901c9c821c57c98435c1e40def8

                                                  SHA1

                                                  8e0ddfb4fa2749b39b68fe3dc46095d6d59f6566

                                                  SHA256

                                                  09cee4df8802647851b57551f799dd32ff995b9fb04bd42ff6ab0d4548fbeeb5

                                                  SHA512

                                                  aba5089873dddfbbc0b56006e02cc8e7c44f6595a9721c3961d22a57578a07f000bfe9b11fb0117472fd1a02c2688a1084bb714ab350e0e26d806ebfbc9cd1f9

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\33bb359c-0c42-4a9b-88eb-ab5db1c1bfeb.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  051e1c6f9061fe18ee5da9814d6c91eb

                                                  SHA1

                                                  8f79eab9a95fb4289ac22196964fe76f83b1e223

                                                  SHA256

                                                  fc19cee77f68873e8c87c47107a2c5e87a5e64907c9a145267317aff072247ef

                                                  SHA512

                                                  f8794f9558ae6d8ff4e704da2e4f6fc53b9287567dc9968064344632cebf65b967a854b109fb7fd7e893544ae379430086e6bdeea734e0c8dc6774118d7747b1

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\7ee9c904-0703-4330-8350-47d8f88e8d07.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  a9235416398a4dbc5cbfa9af9a522053

                                                  SHA1

                                                  56342a2c427e3b72dce658359ce82aeacbdd4634

                                                  SHA256

                                                  fa1fcc1d87a938e2870c2476a60c87b6db57d6014e9cf50ccb00f574506bc482

                                                  SHA512

                                                  d8d65d7747cf45c5e27eb7e531f34856081b5f5906eb03d67e19ccae8dd257c9a423216df5d055112dc5efd8d557b5d7e243d7a86063069bcd714cb1346760b6

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\85a64c8d-8068-41d3-842d-378f3b5c9f38.vbs
                                                  Filesize

                                                  539B

                                                  MD5

                                                  bbcb25b301a00e2931ea89bbbfbbcce6

                                                  SHA1

                                                  22a9f8fab8da2525b78306e5e9cdc8ea7ba1b685

                                                  SHA256

                                                  4dbac3ee7aa839cee94e0b7bea7b77cf760dc3c013b99dbafae397318e4d76b3

                                                  SHA512

                                                  425fef187b6c49a55371bcef17e4a697812f7f28916348699ec0e2e28ca4af80f433306d6c7d5e2e444e265ffb3c4f10fee666e01449c05f985d60f74d4490f4

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\9be196b6-8b36-4f30-b290-2b24f2a9b3c3.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  b90e3dcc8a2aa3ac98488da39acb499a

                                                  SHA1

                                                  1075c550a0f272e3dc1a8a508fe5abe23e027cfd

                                                  SHA256

                                                  627fa94e49fc95c4ed82d55d5c575b748bf4988f58b9bb0e51be06546c375589

                                                  SHA512

                                                  de38715b088eb2c3bbd3eb634115a3d6a996520a70843204e523fc06309883d9cd6cbeb510ea97b1b66188701a4a21bf0657a92dd5913911ff45a5e678094fd3

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\a185c625-fec3-4ac2-a869-c5f762809ca6.vbs
                                                  Filesize

                                                  762B

                                                  MD5

                                                  1f9ca7e95d3fd86eabaf1b765d97f145

                                                  SHA1

                                                  589f8f15ab01c59c4ce5d4e4e845003bf3fce0f6

                                                  SHA256

                                                  1d5e4ad6665e73307d03144fb63baf53cbb54f88b3392acadf7a28b7407dbd04

                                                  SHA512

                                                  9305e57c3e48bbae180a327a474a46d8e402cae09a33b0986a708b0153e2b225105b4996a4765a79bb4db0987bc4689106a546d617ae135c4495cd6eab5c4a82

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\b94b43a5-07c6-4507-a82d-8ba54e271b64.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  09743ef51388b2eba23c3a9049266ce3

                                                  SHA1

                                                  20c2a7bc4c74229a24baf3b93a6e16802dee04aa

                                                  SHA256

                                                  602d3636c9e9bf70125fa001f24c889b81ce95f2a181c311d783b4fd2a716c1c

                                                  SHA512

                                                  e3eb6addcc6e5104820bd1206d94a73239afb74082eca793c8cebf67fe58fcff3c49eae505c3e1dca7dfcc3900b63b24229f89afd4be9746eec3339bcf900bc0

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\bVDEVcmN0E.bat
                                                  Filesize

                                                  252B

                                                  MD5

                                                  9ee62f4f94b0d3b06b87bc7e011bcfa3

                                                  SHA1

                                                  c0bac50ef2c7f3d375693238c20ea8c0717327bf

                                                  SHA256

                                                  de10e5681f1e934dcdc11387c5633d7f44405dbb82112bb2da6b1a1a71692035

                                                  SHA512

                                                  d0224057dfb43bf98d918c48eb1185b94bca158df6801f1710669ba87e6299445deb569ca78a0724b5fd0df05f22bd7fa5522c6443455ed6cc409aa3abc79b00

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\bd83b9b3-ec3f-45cc-bac9-6238e9a70729.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  5dfdd88214b93471c66d9f3bb08cad9c

                                                  SHA1

                                                  cb848433def5823e5d52a7ec5465aca373488b49

                                                  SHA256

                                                  86ee49ea976aad19c7d52aa22a1e6797a62e617ed52f0ee92892cd7574848d71

                                                  SHA512

                                                  834fc2bd9a752a39e683dcc2f431fe2b96d9dea5a5b4c141f5c18f8a36a5f4ff111d4aee2c836c51c5601d00249b16893c761c8d7c561c540cdb2329b64e56d3

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\db0bf3c6-67ed-4056-979e-863d64001583.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  b2e6a23ac5ea5c3ba364201d3db4d97e

                                                  SHA1

                                                  00d9c53a95c340ac56cf36b4e1a6dc4b2548e8c8

                                                  SHA256

                                                  8b07432a080681dbfd7b344cf1abc3d8ea048b20e43211a029d2d614075e65fa

                                                  SHA512

                                                  2652fa0ce21296af7d93eb726c2e97399527bdd4f8aef2dd8baf8a54d50d32909f1b83c042f15c75abe00343a1c16af94b12183ddb74e4f1b13bc2f8dd7c55f2

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\eea509ec-c5d0-4b01-a761-0bbcb3853246.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  a9a3d84fc9d1bea6eb1da5f9e2944a91

                                                  SHA1

                                                  d19ddd5a46320baa625ed018d9a9cb09fc9329d8

                                                  SHA256

                                                  91d2e827a0f211796b479c9d0aadf369af147357d948514260308f3d85e28099

                                                  SHA512

                                                  96139861db556007abc39bfae769797a63acfa8f4b5d4a1a7012f2a43f273485ab645377a216e3f4a905e0af3b6e7911f259ed70341f77fe0918904c216b1cf8

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\f2e034c7-94b1-430f-815e-c3536ffdb416.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  4b3d17879c2ad64c7c392b62fb31093a

                                                  SHA1

                                                  a25d095f6a6d6b2da2cec864eaf38ef4f7a82a3c

                                                  SHA256

                                                  d1f17978e45758a4cd3fb80c9411d4cb59827545c0c29983412487dc92e28cc0

                                                  SHA512

                                                  d51ede53b434757a32eaa1571f8e0ddb9750858eb4eb12c53984e0d6d9a0f17b08bfcfd46c1b7b9667874aaaa69ac18ff1f58a78f97c012a29e2cc286b359f30

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\f3f7f52f-8fd9-4fca-a27e-c81c534d9a22.vbs
                                                  Filesize

                                                  763B

                                                  MD5

                                                  11c619c7e1833a0606ff2eefbc56ea14

                                                  SHA1

                                                  68b34245457fbe40c60498230179b63fca179c6c

                                                  SHA256

                                                  6e015e2cb6ce69fc234653d9234818e4a6be7110e709cdbe173505db0b4a05b3

                                                  SHA512

                                                  6a929354fd989399fea370bf96e6647432ea39c97b90d6b792f300f95202a11d404cf8cea03c3ec9b16b8b5e0e6437afa47b461e5aad5ca9c7ee8fd4fa46010f

                                                  Download Submit

                                                • memory/720-134-0x0000024411400000-0x0000024411429000-memory.dmp

                                                  Filesize

                                                  164KB

                                                  Download

                                                • memory/720-135-0x00000244117A0000-0x00000244117DB000-memory.dmp

                                                  Filesize

                                                  236KB

                                                  Download

                                                • memory/1772-119-0x0000000002EB0000-0x0000000002EC2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/2880-174-0x00000205A0870000-0x00000205A0899000-memory.dmp

                                                  Filesize

                                                  164KB

                                                  Download

                                                • memory/2880-82-0x000001857A050000-0x000001857A079000-memory.dmp

                                                  Filesize

                                                  164KB

                                                  Download

                                                • memory/2880-83-0x000001857BBC0000-0x000001857BBFB000-memory.dmp

                                                  Filesize

                                                  236KB

                                                  Download

                                                • memory/2880-175-0x00000205A08A0000-0x00000205A08DB000-memory.dmp

                                                  Filesize

                                                  236KB

                                                  Download

                                                • memory/3020-141-0x000002578C2A0000-0x000002578C2DB000-memory.dmp

                                                  Filesize

                                                  236KB

                                                  Download

                                                • memory/3020-140-0x000002578C270000-0x000002578C299000-memory.dmp

                                                  Filesize

                                                  164KB

                                                  Download

                                                • memory/3088-53-0x000001DB63350000-0x000001DB63379000-memory.dmp

                                                  Filesize

                                                  164KB

                                                  Download

                                                • memory/3088-54-0x000001DB63390000-0x000001DB633CB000-memory.dmp

                                                  Filesize

                                                  236KB

                                                  Download

                                                • memory/3332-78-0x000001E9CD0E0000-0x000001E9CD109000-memory.dmp

                                                  Filesize

                                                  164KB

                                                  Download

                                                • memory/3332-79-0x000001E9CD560000-0x000001E9CD59B000-memory.dmp

                                                  Filesize

                                                  236KB

                                                  Download

                                                • memory/3404-12-0x000000001B430000-0x000000001B43E000-memory.dmp

                                                  Filesize

                                                  56KB

                                                  Download

                                                • memory/3404-8-0x0000000002A00000-0x0000000002A12000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/3404-13-0x000000001B440000-0x000000001B44C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/3404-6-0x0000000002990000-0x0000000002998000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/3404-11-0x0000000002A40000-0x0000000002A4A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/3404-10-0x0000000002A30000-0x0000000002A3C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/3404-38-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                  Download

                                                • memory/3404-2-0x00007FFA5E940000-0x00007FFA5F401000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                  Download

                                                • memory/3404-4-0x0000000002970000-0x000000000298C000-memory.dmp

                                                  Filesize

                                                  112KB

                                                  Download

                                                • memory/3404-7-0x00000000029F0000-0x00000000029FA000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/3404-9-0x000000001C080000-0x000000001C5A8000-memory.dmp

                                                  Filesize

                                                  5.2MB

                                                  Download

                                                • memory/3404-0-0x00007FFA5E943000-0x00007FFA5E945000-memory.dmp

                                                  Filesize

                                                  8KB

                                                  Download

                                                • memory/3404-1-0x0000000000620000-0x000000000078A000-memory.dmp

                                                  Filesize

                                                  1.4MB

                                                  Download

                                                • memory/3404-3-0x0000000000FB0000-0x0000000000FBE000-memory.dmp

                                                  Filesize

                                                  56KB

                                                  Download

                                                • memory/3404-5-0x000000001B960000-0x000000001B9B0000-memory.dmp

                                                  Filesize

                                                  320KB

                                                  Download

                                                • memory/3656-242-0x0000000002580000-0x0000000002592000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/3996-310-0x000000001B680000-0x000000001B692000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/4008-208-0x0000000002BC0000-0x0000000002BD2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/4432-116-0x000001FF42AD0000-0x000001FF42AF9000-memory.dmp

                                                  Filesize

                                                  164KB

                                                  Download

                                                • memory/4432-117-0x000001FF42B00000-0x000001FF42B3B000-memory.dmp

                                                  Filesize

                                                  236KB

                                                  Download

                                                • memory/4524-84-0x0000027C64F30000-0x0000027C64F59000-memory.dmp

                                                  Filesize

                                                  164KB

                                                  Download

                                                • memory/4524-85-0x0000027C64F60000-0x0000027C64F9B000-memory.dmp

                                                  Filesize

                                                  236KB

                                                  Download

                                                • memory/4636-194-0x000002738E720000-0x000002738E75B000-memory.dmp

                                                  Filesize

                                                  236KB

                                                  Download

                                                • memory/4636-193-0x000002738CAE0000-0x000002738CB09000-memory.dmp

                                                  Filesize

                                                  164KB

                                                  Download

                                                • memory/4892-282-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/5088-144-0x000001FB0C930000-0x000001FB0C96B000-memory.dmp

                                                  Filesize

                                                  236KB

                                                  Download

                                                • memory/5088-143-0x000001FB0C900000-0x000001FB0C929000-memory.dmp

                                                  Filesize

                                                  164KB

                                                  Download