dcrat | b4e0a7e5019643db5b46529c37c22173b1001d59030f1d711492aa3387445085

Resubmissions

30-10-2024 05:15

241030-fxr2haylfm 10

15-09-2024 10:03

240915-l3teeaxhld 10

30-07-2024 12:21

240730-pjcjbsybjr 10

Analysis

max time kernel
69s
max time network
71s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
30-10-2024 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SampCheat.exe
Size

6.6MB
MD5

73d7e637cd16f1f807930fa6442436df
SHA1

26c13b2c29065485ce1858d85d9dc792c06ed052
SHA256

cd0f7fb1020a931c98c7c258241f06292cb9b7cab8e9acdb4010f4d56f076ef6
SHA512

f3561a2090e70b6a2a7c4070daebce1b9ff269fef1a8ca6297c20eb28170675eec7c689d05a05a00b8ddb2d1c2c82639c5d53f63782c0460acd4d3aa95328922
SSDEEP

49152:AnsHyjtk2MYC5GDuBJIopGdJ3Rjl4eZK4qgTouABRCXO8DSTYa:Ansmtk2aTeo4dJhjieLq37z8mka

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Bridgesurrogate.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MsAgentBrowserdhcp\\Idle.exe\", \"C:\\Windows\\bcastdvr\\OfficeClickToRun.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MsAgentBrowserdhcp\\Idle.exe\", \"C:\\Windows\\bcastdvr\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\dllhost.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MsAgentBrowserdhcp\\Idle.exe\", \"C:\\Windows\\bcastdvr\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\dllhost.exe\", \"C:\\MsAgentBrowserdhcp\\wininit.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MsAgentBrowserdhcp\\Idle.exe\", \"C:\\Windows\\bcastdvr\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\dllhost.exe\", \"C:\\MsAgentBrowserdhcp\\wininit.exe\", \"C:\\Windows\\INF\\PERFLIB\\Synaptics.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MsAgentBrowserdhcp\\Idle.exe\", \"C:\\Windows\\bcastdvr\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\dllhost.exe\", \"C:\\MsAgentBrowserdhcp\\wininit.exe\", \"C:\\Windows\\INF\\PERFLIB\\Synaptics.exe\", \"C:\\MsAgentBrowserdhcp\\Bridgesurrogate.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MsAgentBrowserdhcp\\Idle.exe\""	Bridgesurrogate.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	1480	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	1480	schtasks.exe	86

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
3540	powershell.exe
2584	powershell.exe
3748	powershell.exe
1568	powershell.exe
4676	powershell.exe
4908	powershell.exe

Executes dropped EXE 6 IoCs

Processes:

._cache_SampCheat.exeSynaptics.exe._cache_Synaptics.exeBridgesurrogate.exeBridgesurrogate.exedllhost.exe

pid	Process
3128	._cache_SampCheat.exe
5108	Synaptics.exe
5020	._cache_Synaptics.exe
4804	Bridgesurrogate.exe
1748	Bridgesurrogate.exe
2400	dllhost.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Bridgesurrogate.exeSampCheat.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\dllhost.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\MsAgentBrowserdhcp\\wininit.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\MsAgentBrowserdhcp\\wininit.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Synaptics = "\"C:\\Windows\\INF\\PERFLIB\\Synaptics.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bridgesurrogate = "\"C:\\MsAgentBrowserdhcp\\Bridgesurrogate.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	SampCheat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\MsAgentBrowserdhcp\\Idle.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\MsAgentBrowserdhcp\\Idle.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\bcastdvr\\OfficeClickToRun.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\bcastdvr\\OfficeClickToRun.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\dllhost.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\Synaptics = "\"C:\\Windows\\INF\\PERFLIB\\Synaptics.exe\""	Bridgesurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bridgesurrogate = "\"C:\\MsAgentBrowserdhcp\\Bridgesurrogate.exe\""	Bridgesurrogate.exe

Drops file in System32 directory 2 IoCs

Processes:

csc.exe

description	ioc	Process
File created	\??\c:\Windows\System32\CSC70F6A006CEE1490595D1A6DCF238D6CF.TMP	csc.exe
File created	\??\c:\Windows\System32\dfm5rj.exe	csc.exe

Drops file in Program Files directory 2 IoCs

Processes:

Bridgesurrogate.exe

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\dllhost.exe	Bridgesurrogate.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\5940a34987c991	Bridgesurrogate.exe

Drops file in Windows directory 5 IoCs

Processes:

Bridgesurrogate.exe

description	ioc	Process
File created	C:\Windows\bcastdvr\OfficeClickToRun.exe	Bridgesurrogate.exe
File created	C:\Windows\bcastdvr\e6c9b481da804f	Bridgesurrogate.exe
File created	C:\Windows\INF\PERFLIB\Synaptics.exe	Bridgesurrogate.exe
File opened for modification	C:\Windows\INF\PERFLIB\Synaptics.exe	Bridgesurrogate.exe
File created	C:\Windows\INF\PERFLIB\c6f8bd924b61fb	Bridgesurrogate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WScript.execmd.execmd.exeSampCheat.exe._cache_SampCheat.exeSynaptics.exeWScript.exe._cache_Synaptics.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SampCheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_SampCheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 5 IoCs

Processes:

SampCheat.exe._cache_SampCheat.exeSynaptics.exe._cache_Synaptics.exeBridgesurrogate.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	SampCheat.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	._cache_SampCheat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	._cache_Synaptics.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	Bridgesurrogate.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
3992	schtasks.exe
2480	schtasks.exe
2400	schtasks.exe
1012	schtasks.exe
4024	schtasks.exe
1612	schtasks.exe
2276	schtasks.exe
4548	schtasks.exe
3236	schtasks.exe
4796	schtasks.exe
4476	schtasks.exe
2588	schtasks.exe
236	schtasks.exe
2096	schtasks.exe
3968	schtasks.exe
3068	schtasks.exe
2212	schtasks.exe
4636	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid	Process
3180	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Bridgesurrogate.exe

pid	Process
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe
4804	Bridgesurrogate.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

Bridgesurrogate.exeBridgesurrogate.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedllhost.exe

description	pid	Process
Token: SeDebugPrivilege	4804	Bridgesurrogate.exe
Token: SeDebugPrivilege	1748	Bridgesurrogate.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	2400	dllhost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXE

pid	Process
3180	EXCEL.EXE
3180	EXCEL.EXE
3180	EXCEL.EXE
3180	EXCEL.EXE

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

SampCheat.exe._cache_SampCheat.exeSynaptics.exe._cache_Synaptics.exeWScript.execmd.exeWScript.execmd.exeBridgesurrogate.execsc.execmd.exe

description	pid	Process	procid_target
PID 452 wrote to memory of 3128	452	SampCheat.exe	80
PID 452 wrote to memory of 3128	452	SampCheat.exe	80
PID 452 wrote to memory of 3128	452	SampCheat.exe	80
PID 452 wrote to memory of 5108	452	SampCheat.exe	81
PID 452 wrote to memory of 5108	452	SampCheat.exe	81
PID 452 wrote to memory of 5108	452	SampCheat.exe	81
PID 3128 wrote to memory of 2508	3128	._cache_SampCheat.exe	82
PID 3128 wrote to memory of 2508	3128	._cache_SampCheat.exe	82
PID 3128 wrote to memory of 2508	3128	._cache_SampCheat.exe	82
PID 5108 wrote to memory of 5020	5108	Synaptics.exe	83
PID 5108 wrote to memory of 5020	5108	Synaptics.exe	83
PID 5108 wrote to memory of 5020	5108	Synaptics.exe	83
PID 5020 wrote to memory of 3972	5020	._cache_Synaptics.exe	85
PID 5020 wrote to memory of 3972	5020	._cache_Synaptics.exe	85
PID 5020 wrote to memory of 3972	5020	._cache_Synaptics.exe	85
PID 2508 wrote to memory of 1716	2508	WScript.exe	87
PID 2508 wrote to memory of 1716	2508	WScript.exe	87
PID 2508 wrote to memory of 1716	2508	WScript.exe	87
PID 1716 wrote to memory of 4804	1716	cmd.exe	89
PID 1716 wrote to memory of 4804	1716	cmd.exe	89
PID 3972 wrote to memory of 1376	3972	WScript.exe	90
PID 3972 wrote to memory of 1376	3972	WScript.exe	90
PID 3972 wrote to memory of 1376	3972	WScript.exe	90
PID 1376 wrote to memory of 1748	1376	cmd.exe	92
PID 1376 wrote to memory of 1748	1376	cmd.exe	92
PID 4804 wrote to memory of 1532	4804	Bridgesurrogate.exe	96
PID 4804 wrote to memory of 1532	4804	Bridgesurrogate.exe	96
PID 1532 wrote to memory of 4888	1532	csc.exe	98
PID 1532 wrote to memory of 4888	1532	csc.exe	98
PID 4804 wrote to memory of 4676	4804	Bridgesurrogate.exe	114
PID 4804 wrote to memory of 4676	4804	Bridgesurrogate.exe	114
PID 4804 wrote to memory of 4908	4804	Bridgesurrogate.exe	115
PID 4804 wrote to memory of 4908	4804	Bridgesurrogate.exe	115
PID 4804 wrote to memory of 1568	4804	Bridgesurrogate.exe	116
PID 4804 wrote to memory of 1568	4804	Bridgesurrogate.exe	116
PID 4804 wrote to memory of 3748	4804	Bridgesurrogate.exe	117
PID 4804 wrote to memory of 3748	4804	Bridgesurrogate.exe	117
PID 4804 wrote to memory of 2584	4804	Bridgesurrogate.exe	118
PID 4804 wrote to memory of 2584	4804	Bridgesurrogate.exe	118
PID 4804 wrote to memory of 3540	4804	Bridgesurrogate.exe	119
PID 4804 wrote to memory of 3540	4804	Bridgesurrogate.exe	119
PID 4804 wrote to memory of 2176	4804	Bridgesurrogate.exe	126
PID 4804 wrote to memory of 2176	4804	Bridgesurrogate.exe	126
PID 2176 wrote to memory of 3144	2176	cmd.exe	128
PID 2176 wrote to memory of 3144	2176	cmd.exe	128
PID 2176 wrote to memory of 4920	2176	cmd.exe	129
PID 2176 wrote to memory of 4920	2176	cmd.exe	129
PID 2176 wrote to memory of 2400	2176	cmd.exe	130
PID 2176 wrote to memory of 2400	2176	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SampCheat.exe
"C:\Users\Admin\AppData\Local\Temp\SampCheat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\._cache_SampCheat.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_SampCheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\MsAgentBrowserdhcp\RJohyDXhI3BukXB8LZtFph4xzxsRiCFy2OHMYmU5wvokqlpzCh.vbe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\MsAgentBrowserdhcp\6tdiKxJ4vs339LB2ENkEUF6gwXbV.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1716
    - - C:\MsAgentBrowserdhcp\Bridgesurrogate.exe
        
        "C:\MsAgentBrowserdhcp/Bridgesurrogate.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4804
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2uuuxr4z\2uuuxr4z.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBBE.tmp" "c:\Windows\System32\CSC70F6A006CEE1490595D1A6DCF238D6CF.TMP"
        7⤵
        
        PID:4888
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MsAgentBrowserdhcp\Idle.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\bcastdvr\OfficeClickToRun.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\ja-JP\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MsAgentBrowserdhcp\wininit.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3748
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\PERFLIB\Synaptics.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MsAgentBrowserdhcp\Bridgesurrogate.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3540
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9eylyvpAgI.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3144
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4920
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\dllhost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\dllhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\MsAgentBrowserdhcp\RJohyDXhI3BukXB8LZtFph4xzxsRiCFy2OHMYmU5wvokqlpzCh.vbe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3972
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\MsAgentBrowserdhcp\6tdiKxJ4vs339LB2ENkEUF6gwXbV.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1376
      - C:\MsAgentBrowserdhcp\Bridgesurrogate.exe
        
        "C:\MsAgentBrowserdhcp/Bridgesurrogate.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\MsAgentBrowserdhcp\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MsAgentBrowserdhcp\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\MsAgentBrowserdhcp\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Windows\bcastdvr\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\bcastdvr\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Windows\bcastdvr\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\MsAgentBrowserdhcp\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MsAgentBrowserdhcp\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\MsAgentBrowserdhcp\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SynapticsS" /sc MINUTE /mo 10 /tr "'C:\Windows\INF\PERFLIB\Synaptics.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Synaptics" /sc ONLOGON /tr "'C:\Windows\INF\PERFLIB\Synaptics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SynapticsS" /sc MINUTE /mo 12 /tr "'C:\Windows\INF\PERFLIB\Synaptics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgesurrogateB" /sc MINUTE /mo 10 /tr "'C:\MsAgentBrowserdhcp\Bridgesurrogate.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Bridgesurrogate" /sc ONLOGON /tr "'C:\MsAgentBrowserdhcp\Bridgesurrogate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgesurrogateB" /sc MINUTE /mo 11 /tr "'C:\MsAgentBrowserdhcp\Bridgesurrogate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MsAgentBrowserdhcp\6tdiKxJ4vs339LB2ENkEUF6gwXbV.bat

Filesize
86B

MD5
f0817915454c14a131a03bb1e970a3d9

SHA1
40bba77a1b68a36053d1cfce4a8820eeef1108df

SHA256
9983f72ca78bee90d64610d7bd9bce46c075674f22307494ad40982ff760978d

SHA512
00a97f09edc0824207fe5bf10e6d7ab903740bfb507db085b912e58a62f8ec814f05940bcb263163bec71e71def1ff9868fedd7b0348b4146a70198a00606c66

Download Submit
C:\MsAgentBrowserdhcp\Bridgesurrogate.exe

Filesize
5.6MB

MD5
d5eb73597ed0a278e1a993ee15c5cdb1

SHA1
c0a88c5eb727b7e4eb38dd90e95cbb1c37de0341

SHA256
b6b9517b7429afea6d33ae62a1cff9ce8290b160f9f5544b1d9dd3ab0f620404

SHA512
538de4b61b35c7acead9e8c26bdf1a47e024e7dd78402b4dbeb5fe6afe6ec7c323f2700f12c6ed441c51b61b4b3884967df67db6ba4ac682fc32c616dca2c932

Download Submit
C:\MsAgentBrowserdhcp\RJohyDXhI3BukXB8LZtFph4xzxsRiCFy2OHMYmU5wvokqlpzCh.vbe

Filesize
224B

MD5
e6aa5a9a61e5a14929496cc623751fcb

SHA1
e5e193008aaf6155d8959d1f237297e134c8c69f

SHA256
4518eab1e079194970bee0b64f0dc5151e2208a48a94672e9a98fbe046e6a7d9

SHA512
45a4385a57d928587194313bd04ea42714619e2a3f35f8c7af0d930507f1e717dfd9c4d00c36514a826fb2e5090ed7e9b8a76f099798d2c468910c40e1d7cd0e

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
6.6MB

MD5
73d7e637cd16f1f807930fa6442436df

SHA1
26c13b2c29065485ce1858d85d9dc792c06ed052

SHA256
cd0f7fb1020a931c98c7c258241f06292cb9b7cab8e9acdb4010f4d56f076ef6

SHA512
f3561a2090e70b6a2a7c4070daebce1b9ff269fef1a8ca6297c20eb28170675eec7c689d05a05a00b8ddb2d1c2c82639c5d53f63782c0460acd4d3aa95328922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Bridgesurrogate.exe.log

Filesize
1KB

MD5
1126a1de0a15000f1687b171641ffea6

SHA1
dcc99b2446d05b8f0f970e3e9105198a20ca9e78

SHA256
b886b6c74da838e87b2cbc539ee657a2817d126b55c0cbd6d1ab91480261bcc7

SHA512
6cfb73ea43899ffa3cecd354cd76b0a1a67f57d9054c3e31cff43424491ed3bceae5aecd0f5c414ba92aab539eb7d55af3d40eedde80c9af8d34649bb1f8d4b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aa4f31835d07347297d35862c9045f4a

SHA1
83e728008935d30f98e5480fba4fbccf10cefb05

SHA256
99c83bc5c531e49d4240700142f3425aba74e18ebcc23556be32238ffde9cce0

SHA512
ec3a4bee8335007b8753ae8ac42287f2b3bcbb258f7fc3fb15c9f8d3e611cb9bf6ae2d3034953286a34f753e9ec33f7495e064bab0e8c7fcedd75d6e5eb66629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e3840d9bcedfe7017e49ee5d05bd1c46

SHA1
272620fb2605bd196df471d62db4b2d280a363c6

SHA256
3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

SHA512
76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6903d57eed54e89b68ebb957928d1b99

SHA1
fade011fbf2e4bc044d41e380cf70bd6a9f73212

SHA256
36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52

SHA512
c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_SampCheat.exe

Filesize
5.9MB

MD5
885383199b4458661a083d690adec52f

SHA1
7f3a0cdbf4f14e71fe0061f35c121ce087918a99

SHA256
7e1fbcc206aed09ff42684b9dcdac876e2a1f7c068463430b1bfb21564af1252

SHA512
dbe796e5c8caf1de33ddfc499c86f3a2d289ab6f1e1f89ecabef7403c70e2ea18da72897184988f12024e01e159276dc6f70b09266102bb542517d08bf41d31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9eylyvpAgI.bat

Filesize
237B

MD5
daf5fc7eef056904e20e35bbc15c3e53

SHA1
5cfa827ed25c842cf4cb9928b83913cd051cd336

SHA256
b153229858ff2a38d5537bc8b4bb79367750813bb0e2a70eb156b4bc23b078e0

SHA512
7c299f14b99f1575d7606b47d8cc66b60d5767f8300c1fd4a6febf2f00bae63baa587cecd75a5efbe640f96990ea8154a4d84a5b7a278b76423d33a0d36d26ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\EOxJ6bGK.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBBBE.tmp

Filesize
1KB

MD5
b6742f2079af30dd1ef9a07369af30ed

SHA1
4fdf48d95a4c70043e68c6044b45872eac3764be

SHA256
f69a3fe8e2a5cff59843fd4e33d95e34b7e2b12164e622854504e7303ea7df46

SHA512
1eb64a06fa689c9a5d1a95a1211700450c338e639129149ee1372f17fe191f7a7f358552bd45ccf6f5251c3db622ed57e684c4186d9526e2d52c88f6295786b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vxjx3cjx.y3k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2uuuxr4z\2uuuxr4z.0.cs

Filesize
362B

MD5
f272cf77749f5958a413dcfde83aa7de

SHA1
f98195cf0c7fd8246928b1c176a2e803e7bddb83

SHA256
2400f18e471232430c90d657ff59bc8289b33106d5ca14779e0333a6c8512483

SHA512
bb7b42947b6ae6590f76ed0eb097581f15c1a007b71184525894d9d26a93cad1358303ea422b8a9919308f794297f73088ab637bf828aad419d7c4932956d24b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2uuuxr4z\2uuuxr4z.cmdline

Filesize
235B

MD5
9b12dcf7dc972a4c480358488db76c95

SHA1
67c387a4a08c2a2443d6e9a11fef92771e60cd08

SHA256
0534c2caa19bff26bf724e159e7064162d04e2763df543d4ecd4e94145f68fdf

SHA512
03ca0b6aa76302574b6f98457af00a230a6f87bd2148c05e8792d51e0465778f332a7097b8b1c84374d9a7861256c2a3b408a850f2eef9cbe04be3514431c7fa

Download Submit
\??\c:\Windows\System32\CSC70F6A006CEE1490595D1A6DCF238D6CF.TMP

Filesize
1KB

MD5
d89c8eda5ccd9b9600f2962d9a95e453

SHA1
e5d9f7603b9bc8339c9bc451e8ad7c67b1916d95

SHA256
9b274ee8615f4208df254a0fc6abb2b0d8be71defecba04292fcc69cef64387b

SHA512
9c4f365e362069a6256c8d7691f217e1ae01a3af2218cdc400f77d7dc9af9d3634b234338b9cc562fd146ebcc8034dfd313cd9d3aa2df2e20876e6641c6d9055

Download Submit
memory/452-108-0x0000000000400000-0x0000000000AAC000-memory.dmp

Filesize
6.7MB

Download
memory/452-0-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download
memory/2584-208-0x0000024C72070000-0x0000024C72092000-memory.dmp

Filesize
136KB

Download
memory/3180-144-0x00007FFB1DAB0000-0x00007FFB1DAC0000-memory.dmp

Filesize
64KB

Download
memory/3180-145-0x00007FFB1DAB0000-0x00007FFB1DAC0000-memory.dmp

Filesize
64KB

Download
memory/3180-147-0x00007FFB1DAB0000-0x00007FFB1DAC0000-memory.dmp

Filesize
64KB

Download
memory/3180-146-0x00007FFB1DAB0000-0x00007FFB1DAC0000-memory.dmp

Filesize
64KB

Download
memory/3180-143-0x00007FFB1DAB0000-0x00007FFB1DAC0000-memory.dmp

Filesize
64KB

Download
memory/3180-148-0x00007FFB1B200000-0x00007FFB1B210000-memory.dmp

Filesize
64KB

Download
memory/3180-149-0x00007FFB1B200000-0x00007FFB1B210000-memory.dmp

Filesize
64KB

Download
memory/4804-162-0x0000000000F30000-0x000000000110A000-memory.dmp

Filesize
1.9MB

Download
memory/4804-165-0x0000000003200000-0x000000000320E000-memory.dmp

Filesize
56KB

Download
memory/4804-167-0x000000001C0C0000-0x000000001C0DC000-memory.dmp

Filesize
112KB

Download
memory/4804-172-0x000000001BD80000-0x000000001BD8C000-memory.dmp

Filesize
48KB

Download
memory/4804-168-0x000000001C130000-0x000000001C180000-memory.dmp

Filesize
320KB

Download
memory/4804-170-0x000000001C0E0000-0x000000001C0F8000-memory.dmp

Filesize
96KB

Download
memory/5108-264-0x0000000000400000-0x0000000000AAC000-memory.dmp

Filesize
6.7MB

Download