dcrat | 191d579dcc73daaca18b2442b8411f05d50ad19ea1ba834a0e2c67414edfdaf5

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DCRatBuild.exe
Size

1.8MB
MD5

013bc21b187fbf033bdeec699b2263b5
SHA1

78a44777f96bdd338e037fc87c548fe9b6e7f241
SHA256

191d579dcc73daaca18b2442b8411f05d50ad19ea1ba834a0e2c67414edfdaf5
SHA512

332b58b80ed3b88bbaaf59c4b3ab8735af56e6377ed36d8da625fd8c139d5607a7f5de603d85ba155dd78fdaca46e3a456693afd32b5cb1d88567e765a35abf0
SSDEEP

24576:2TbBv5rUyXVuTutB3BpIRgMS/JiVQZph3Ute6XjQ+O34nNRB2PfC0xOhAjKEge1o:IBJuTu3ERX2Ysh30Ep34NKTxOWjKECd

Score

10^/10

dcrat discovery evasion execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Driverruntimeperfdll\\csrss.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Driverruntimeperfdll\\csrss.exe\", \"C:\\Driverruntimeperfdll\\csrss.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Driverruntimeperfdll\\csrss.exe\", \"C:\\Driverruntimeperfdll\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Driverruntimeperfdll\\csrss.exe\", \"C:\\Driverruntimeperfdll\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Driverruntimeperfdll\\csrss.exe\", \"C:\\Driverruntimeperfdll\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Driverruntimeperfdll\\csrss.exe\", \"C:\\Driverruntimeperfdll\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Driverruntimeperfdll\\surrogatesavesBrokerhost.exe\""	surrogatesavesBrokerhost.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	1704	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	1704	schtasks.exe	96

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
716	powershell.exe
3064	powershell.exe
3016	powershell.exe
5100	powershell.exe
1620	powershell.exe
4440	powershell.exe
3564	powershell.exe
3740	powershell.exe
64	powershell.exe
976	powershell.exe
2708	powershell.exe
3816	powershell.exe
3352	powershell.exe
1596	powershell.exe
2404	powershell.exe
3504	powershell.exe
1568	powershell.exe
4436	powershell.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	surrogatesavesBrokerhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe

Executes dropped EXE 2 IoCs

pid	Process
2488	surrogatesavesBrokerhost.exe
960	surrogatesavesBrokerhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Driverruntimeperfdll\\csrss.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Portable Devices\\winlogon.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\surrogatesavesBrokerhost = "\"C:\\Driverruntimeperfdll\\surrogatesavesBrokerhost.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\surrogatesavesBrokerhost = "\"C:\\Driverruntimeperfdll\\surrogatesavesBrokerhost.exe\""	surrogatesavesBrokerhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Driverruntimeperfdll\\csrss.exe\""	surrogatesavesBrokerhost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\ip2t47.exe	csc.exe
File created	\??\c:\Windows\System32\CSC576C537C966044B4B34E7D57EB45B2B.TMP	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\cc11b995f2a76d	surrogatesavesBrokerhost.exe
File created	C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	surrogatesavesBrokerhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	surrogatesavesBrokerhost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5112	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3476	schtasks.exe
4784	schtasks.exe
1860	schtasks.exe
2436	schtasks.exe
4844	schtasks.exe
1496	schtasks.exe
868	schtasks.exe
4220	schtasks.exe
5040	schtasks.exe
4696	schtasks.exe
4296	schtasks.exe
4040	schtasks.exe
4816	schtasks.exe
1092	schtasks.exe
1836	schtasks.exe
4020	schtasks.exe
4648	schtasks.exe
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe
2488	surrogatesavesBrokerhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
960	surrogatesavesBrokerhost.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	surrogatesavesBrokerhost.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	64	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	960	surrogatesavesBrokerhost.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3716	3064	DCRatBuild.exe	84
PID 3064 wrote to memory of 3716	3064	DCRatBuild.exe	84
PID 3064 wrote to memory of 3716	3064	DCRatBuild.exe	84
PID 3716 wrote to memory of 3972	3716	WScript.exe	89
PID 3716 wrote to memory of 3972	3716	WScript.exe	89
PID 3716 wrote to memory of 3972	3716	WScript.exe	89
PID 3972 wrote to memory of 5112	3972	cmd.exe	91
PID 3972 wrote to memory of 5112	3972	cmd.exe	91
PID 3972 wrote to memory of 5112	3972	cmd.exe	91
PID 3972 wrote to memory of 2488	3972	cmd.exe	92
PID 3972 wrote to memory of 2488	3972	cmd.exe	92
PID 2488 wrote to memory of 4828	2488	surrogatesavesBrokerhost.exe	100
PID 2488 wrote to memory of 4828	2488	surrogatesavesBrokerhost.exe	100
PID 4828 wrote to memory of 1920	4828	csc.exe	102
PID 4828 wrote to memory of 1920	4828	csc.exe	102
PID 2488 wrote to memory of 976	2488	surrogatesavesBrokerhost.exe	118
PID 2488 wrote to memory of 976	2488	surrogatesavesBrokerhost.exe	118
PID 2488 wrote to memory of 4440	2488	surrogatesavesBrokerhost.exe	119
PID 2488 wrote to memory of 4440	2488	surrogatesavesBrokerhost.exe	119
PID 2488 wrote to memory of 64	2488	surrogatesavesBrokerhost.exe	120
PID 2488 wrote to memory of 64	2488	surrogatesavesBrokerhost.exe	120
PID 2488 wrote to memory of 2708	2488	surrogatesavesBrokerhost.exe	121
PID 2488 wrote to memory of 2708	2488	surrogatesavesBrokerhost.exe	121
PID 2488 wrote to memory of 1620	2488	surrogatesavesBrokerhost.exe	122
PID 2488 wrote to memory of 1620	2488	surrogatesavesBrokerhost.exe	122
PID 2488 wrote to memory of 4436	2488	surrogatesavesBrokerhost.exe	123
PID 2488 wrote to memory of 4436	2488	surrogatesavesBrokerhost.exe	123
PID 2488 wrote to memory of 3816	2488	surrogatesavesBrokerhost.exe	125
PID 2488 wrote to memory of 3816	2488	surrogatesavesBrokerhost.exe	125
PID 2488 wrote to memory of 1596	2488	surrogatesavesBrokerhost.exe	127
PID 2488 wrote to memory of 1596	2488	surrogatesavesBrokerhost.exe	127
PID 2488 wrote to memory of 5100	2488	surrogatesavesBrokerhost.exe	128
PID 2488 wrote to memory of 5100	2488	surrogatesavesBrokerhost.exe	128
PID 2488 wrote to memory of 3740	2488	surrogatesavesBrokerhost.exe	129
PID 2488 wrote to memory of 3740	2488	surrogatesavesBrokerhost.exe	129
PID 2488 wrote to memory of 3064	2488	surrogatesavesBrokerhost.exe	130
PID 2488 wrote to memory of 3064	2488	surrogatesavesBrokerhost.exe	130
PID 2488 wrote to memory of 1568	2488	surrogatesavesBrokerhost.exe	131
PID 2488 wrote to memory of 1568	2488	surrogatesavesBrokerhost.exe	131
PID 2488 wrote to memory of 3504	2488	surrogatesavesBrokerhost.exe	132
PID 2488 wrote to memory of 3504	2488	surrogatesavesBrokerhost.exe	132
PID 2488 wrote to memory of 3352	2488	surrogatesavesBrokerhost.exe	133
PID 2488 wrote to memory of 3352	2488	surrogatesavesBrokerhost.exe	133
PID 2488 wrote to memory of 716	2488	surrogatesavesBrokerhost.exe	135
PID 2488 wrote to memory of 716	2488	surrogatesavesBrokerhost.exe	135
PID 2488 wrote to memory of 2404	2488	surrogatesavesBrokerhost.exe	136
PID 2488 wrote to memory of 2404	2488	surrogatesavesBrokerhost.exe	136
PID 2488 wrote to memory of 3016	2488	surrogatesavesBrokerhost.exe	144
PID 2488 wrote to memory of 3016	2488	surrogatesavesBrokerhost.exe	144
PID 2488 wrote to memory of 3564	2488	surrogatesavesBrokerhost.exe	145
PID 2488 wrote to memory of 3564	2488	surrogatesavesBrokerhost.exe	145
PID 2488 wrote to memory of 2272	2488	surrogatesavesBrokerhost.exe	153
PID 2488 wrote to memory of 2272	2488	surrogatesavesBrokerhost.exe	153
PID 2272 wrote to memory of 5408	2272	cmd.exe	162
PID 2272 wrote to memory of 5408	2272	cmd.exe	162
PID 2272 wrote to memory of 5968	2272	cmd.exe	158
PID 2272 wrote to memory of 5968	2272	cmd.exe	158
PID 2272 wrote to memory of 960	2272	cmd.exe	164
PID 2272 wrote to memory of 960	2272	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Driverruntimeperfdll\m71jv3paESEH9S1QA3ZsNaBNLB28NhVlZEjuWU.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Driverruntimeperfdll\uPDozmlRKjrXNChMTgfGYis2.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5112
  - - C:\Driverruntimeperfdll\surrogatesavesBrokerhost.exe
      "C:\Driverruntimeperfdll/surrogatesavesBrokerhost.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2tm41gmy\2tm41gmy.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4828
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF7A.tmp" "c:\Windows\System32\CSC576C537C966044B4B34E7D57EB45B2B.TMP"
        6⤵
        
        PID:1920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:64
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Driverruntimeperfdll/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Driverruntimeperfdll\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Driverruntimeperfdll\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Driverruntimeperfdll\surrogatesavesBrokerhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3564
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bi5f3Tlxap.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2272
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5408
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5968
      - C:\Driverruntimeperfdll\surrogatesavesBrokerhost.exe
        
        "C:\Driverruntimeperfdll\surrogatesavesBrokerhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Driverruntimeperfdll\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Driverruntimeperfdll\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Driverruntimeperfdll\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Driverruntimeperfdll\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Driverruntimeperfdll\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Driverruntimeperfdll\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesavesBrokerhosts" /sc MINUTE /mo 6 /tr "'C:\Driverruntimeperfdll\surrogatesavesBrokerhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesavesBrokerhost" /sc ONLOGON /tr "'C:\Driverruntimeperfdll\surrogatesavesBrokerhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "surrogatesavesBrokerhosts" /sc MINUTE /mo 8 /tr "'C:\Driverruntimeperfdll\surrogatesavesBrokerhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:5408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Driverruntimeperfdll\m71jv3paESEH9S1QA3ZsNaBNLB28NhVlZEjuWU.vbe

Filesize
222B

MD5
b6b3920b58d924e219828c67336f9202

SHA1
cb1edfba46ed630f75d694921ee738880dffd095

SHA256
f16ba871ed12b8a447a30c861a27a1324a11346541aabdc38469adcce6d3adaa

SHA512
04e583eb72e34c3f5ebf7b24cc4fe97d52e4a1e2b8deeef20210bcf82161e7cfeebf467767e246c0b4af948a71ca1768ab61e416e915f72eba55e7cca23cab3b

Download Submit
C:\Driverruntimeperfdll\surrogatesavesBrokerhost.exe

Filesize
1.9MB

MD5
967181542acac77f5b13f46542e84812

SHA1
09fbf9cfb636459cc4d54308b5b1c91d32a29f22

SHA256
277b0b668d401e4fcabdc18fbdde331b0db64f9b62bfa4b76b83b6179f3a57d2

SHA512
323023582fcc14c30aca827db68bb91204a5e6dc894bb1228370a3c925bb28559778f09a0b3d4581d462921630cede3ac1cd4c864357ee5b4928698e5bbdf082

Download Submit
C:\Driverruntimeperfdll\uPDozmlRKjrXNChMTgfGYis2.bat

Filesize
222B

MD5
132d5c788d06205db0e25a0b3c6bf78e

SHA1
d729095f4934409561af630b79c5ec3272d452b5

SHA256
ae76410765fd16a45a999b3a5a60a89a61c0edaa453144127664142fb360699c

SHA512
899f1ed8d047b5d9aad48239e78d7025d9aeb305514fa3c23e1d692a3a24f9358ebe98e9bdce8054df25c728d355260230b4d8858a4987030793dfd8f9f0597b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\surrogatesavesBrokerhost.exe.log

Filesize
1KB

MD5
af6acd95d59de87c04642509c30e81c1

SHA1
f9549ae93fdb0a5861a79a08f60aa81c4b32377b

SHA256
7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

SHA512
93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAF7A.tmp

Filesize
1KB

MD5
244ba16df5fda642bf9295d5357d2c79

SHA1
68715722a81611938950806a432778b726892a8e

SHA256
d96c19794dbad2a605186411e86389fb923241c047c25f48ba3bf3e91d919945

SHA512
a08e4c3ea4256dbd7065806da7d383886cbba4b4d9a1203d39ae4a34f15cbea9022145be24bf1ba0a9257696c5af7796904b24240cc15bc1615df2ad6be22f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vrylm42x.hnz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bi5f3Tlxap.bat

Filesize
228B

MD5
90032d34c9363ced79238935ba31940d

SHA1
24f5d026caaf69fe3c29b276b35c3809bc0628f1

SHA256
bbaadf2bcb40257008c66196e82d6a50b5c6cf8d8f58636b35565c755e5a80cf

SHA512
a5c297f9ef7a18d9ec472a9a05b33254f7bbc94f95b0c32708e6b081e0c03328b20d88fa78e5eccbd1fd80e7b073431e0a14670e806a40d6e372e618edd140af

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2tm41gmy\2tm41gmy.0.cs

Filesize
365B

MD5
f4bb89a9101ffafa95d05d61d38bf441

SHA1
4605239f9ce63c8af54d01c4ff696bc494d119e4

SHA256
ae935a45c84dc9b520f8dd6ade1c067e34546de3ae31b81b8ee3ffe19d5f08fc

SHA512
fd44cc2b5be24b91b4a7cf47cc886cca77aca34943bd9e39e9d1a2ebc94dcc28882d735df3bb48209ceb17fa6ab803ef431b1a09ab8ae176c8b62e4e21c636e8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2tm41gmy\2tm41gmy.cmdline

Filesize
235B

MD5
8d614b1b8dd94c0774f7554571e3e0dc

SHA1
d74183b4d0c94d9188d35b60f86a059003684754

SHA256
c2253f88f7cd405c8fb7cd0c51c2497c782911167d8be5b186f8649e318fdd0e

SHA512
c88cceabb07c487b0d510d8da5c15a6ca0aa076ffe85470441a1cd345331d23432e7c5f80587eea00f51648e954e9ab7dcb7d23a6cd23cd9116e7cf147143967

Download Submit
\??\c:\Windows\System32\CSC576C537C966044B4B34E7D57EB45B2B.TMP

Filesize
1KB

MD5
034b083b6729ade0b138a24cbdd66c6d

SHA1
299c5a9dd91498cfc4226a5fe6d52ea633c2d148

SHA256
8e3aa7a68c0bfea6cae11fe40e79aa1483bc2e43c4c3fd11fcebca1f7bcea0d2

SHA512
43f68ec3211f2d1eb3a095713b3988a5b45a6fb03136876431edd3b25b628f904079557cbb60d0107c0444551db274c8e6817d63a543e8a7e390206af64d1cc3

Download Submit
memory/960-263-0x000000001D5D0000-0x000000001D6E5000-memory.dmp

Filesize
1.1MB

Download
memory/1620-64-0x000001D1CD820000-0x000001D1CD842000-memory.dmp

Filesize
136KB

Download
memory/2488-25-0x000000001B350000-0x000000001B35C000-memory.dmp

Filesize
48KB

Download
memory/2488-21-0x000000001B2F0000-0x000000001B2FC000-memory.dmp

Filesize
48KB

Download
memory/2488-19-0x000000001B330000-0x000000001B348000-memory.dmp

Filesize
96KB

Download
memory/2488-17-0x000000001C110000-0x000000001C160000-memory.dmp

Filesize
320KB

Download
memory/2488-16-0x000000001B310000-0x000000001B32C000-memory.dmp

Filesize
112KB

Download
memory/2488-14-0x000000001B150000-0x000000001B15E000-memory.dmp

Filesize
56KB

Download
memory/2488-12-0x00000000004F0000-0x00000000006DE000-memory.dmp

Filesize
1.9MB

Download
memory/2488-23-0x000000001B300000-0x000000001B30E000-memory.dmp

Filesize
56KB

Download