Overview

overview

10

Static

static

10

078a6edfe7...cd.exe

windows7-x64

10

078a6edfe7...cd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2024 02:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe

  • Size

    3.6MB

  • MD5

    646a50d060ae1b649f0ca735aabf5744

  • SHA1

    a666932e153ef1d2c2463009e0df4de9bdf73322

  • SHA256

    078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd

  • SHA512

    0872641f90557c8ab8dd015b9486061b85a48ab7db06a74f6787ab87685f2bb6358eda822ba16757a7b6fc8fe1744a831ea76f47d6130225596a285bf9dd1f4c

  • SSDEEP

    98304:EbRxeIaNRcgnk9MO32RzRpAH267w3adH2fte4I/Bu:E+IoREF32B67wuH2I5/M

Score
10/10
dcratdiscoveryevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 61 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 20 IoCs
    persistence
  • Process spawned unexpected child process 60 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 48 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 18 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Adds Run key to start application 2 TTPs 38 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 32 IoCs
    evasiontrojan
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 17 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 60 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 48 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe
    "C:\Users\Admin\AppData\Local\Temp\078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd.exe"
    1⤵
    • DcRat
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4392
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\fontMonitor\GFcBidplGj1mDhuTvzK8nh.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\fontMonitor\B6f2SnQ47.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\fontMonitor\chainagent.exe
          "C:\fontMonitor\chainagent.exe"
          4⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2824
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lQa6YaxVpO.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4640
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:3952
              • C:\fontMonitor\chainagent.exe
                "C:\fontMonitor\chainagent.exe"
                6⤵
                • Modifies WinLogon for persistence
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Checks whether UAC is enabled
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1548
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xqes9JcvBP.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3184
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:3504
                    • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                      "C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe"
                      8⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4876
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea559014-d6ca-4faa-bca0-568b3c11531d.vbs"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2888
                        • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                          C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                          10⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:376
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0af1a9d5-9978-41af-87f8-ac0d831d7407.vbs"
                            11⤵
                            • Suspicious use of WriteProcessMemory
                            PID:224
                            • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                              C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                              12⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:1300
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b62302e-6a90-441f-9304-65b07a078510.vbs"
                                13⤵
                                • Suspicious use of WriteProcessMemory
                                PID:628
                                • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                  C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                  14⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:2260
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad3235bf-f141-47a7-b575-5d44039b3790.vbs"
                                    15⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3572
                                    • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                      C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                      16⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:2712
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ac0a4cb-bf37-4596-9a4a-b3222d6a6495.vbs"
                                        17⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3740
                                        • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                          C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                          18⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:4480
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b388e35-0e37-4beb-9dd1-e61e707c6968.vbs"
                                            19⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4540
                                            • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                              C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                              20⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:2584
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c47772c-9e7f-49dd-9d1e-0610affb712e.vbs"
                                                21⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:4116
                                                • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                  C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                  22⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  • System policy modification
                                                  PID:3256
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6287ce2f-c152-4d47-96db-e1dbc13692af.vbs"
                                                    23⤵
                                                      PID:4260
                                                      • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                        C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                        24⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:1840
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7f86ed6-443e-4344-9da3-dee273ab6bff.vbs"
                                                          25⤵
                                                            PID:3404
                                                            • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                              C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                              26⤵
                                                              • UAC bypass
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:2436
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e0b9524-b48e-408b-8a67-1c34f70df11f.vbs"
                                                                27⤵
                                                                  PID:1968
                                                                  • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                                    28⤵
                                                                    • UAC bypass
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • System policy modification
                                                                    PID:4516
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\038c0f3e-ea40-4319-8426-ae9fa724c68f.vbs"
                                                                      29⤵
                                                                        PID:4056
                                                                        • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                                          30⤵
                                                                          • UAC bypass
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Checks whether UAC is enabled
                                                                          • Modifies registry class
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • System policy modification
                                                                          PID:2736
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75e04b06-6725-4e3a-96e2-92f361d7df55.vbs"
                                                                            31⤵
                                                                              PID:1844
                                                                              • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                                                32⤵
                                                                                • UAC bypass
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Checks whether UAC is enabled
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • System policy modification
                                                                                PID:2816
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\869df521-297a-4f17-824a-784b41458415.vbs"
                                                                                  33⤵
                                                                                    PID:4204
                                                                                    • C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe
                                                                                      34⤵
                                                                                      • UAC bypass
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Checks whether UAC is enabled
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • System policy modification
                                                                                      PID:2152
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6009f227-822b-4d97-b08a-bd8d728c5a7a.vbs"
                                                                                        35⤵
                                                                                          PID:2312
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa2d9729-d642-450e-947c-68b920615fad.vbs"
                                                                                          35⤵
                                                                                            PID:4840
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a858efc-7a17-4baa-8a62-b176cc4cc0b2.vbs"
                                                                                        33⤵
                                                                                          PID:2012
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0f8d62a-8660-431e-9bb4-b3271c2f18e0.vbs"
                                                                                      31⤵
                                                                                        PID:1468
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb17c288-cae7-47d8-a364-cc0b94aa7d0d.vbs"
                                                                                    29⤵
                                                                                      PID:4796
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef20c7c3-11eb-4e43-948c-7c761d8800b9.vbs"
                                                                                  27⤵
                                                                                    PID:1344
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe32db08-0e48-4dce-a422-59e97ebeae89.vbs"
                                                                                25⤵
                                                                                  PID:3016
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1b22bd0-ab75-4896-9ef3-2255f6512a36.vbs"
                                                                              23⤵
                                                                                PID:4216
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ac50fbd-ccab-40f4-9cde-b119eeb07e22.vbs"
                                                                            21⤵
                                                                              PID:1368
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae2a550b-cb4c-427d-9add-b24fc16e8859.vbs"
                                                                          19⤵
                                                                            PID:1056
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\518b0239-f5dd-44c5-8fac-4389e7e06110.vbs"
                                                                        17⤵
                                                                          PID:4100
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4bdc64b-459d-4117-8e3b-b3951243fab1.vbs"
                                                                      15⤵
                                                                        PID:4944
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44ff3a40-a60c-4a65-aff0-574240a97681.vbs"
                                                                    13⤵
                                                                      PID:4184
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\257bdb54-8138-4ee2-9dda-93ae2dfdb672.vbs"
                                                                  11⤵
                                                                    PID:3192
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6da8653-2c7d-4f8b-a9a1-1329a6f48660.vbs"
                                                                9⤵
                                                                  PID:3540
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4228
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2528
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4724
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\upfc.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3068
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\upfc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:628
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\upfc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2732
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\fontMonitor\dwm.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1812
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\fontMonitor\dwm.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:416
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\fontMonitor\dwm.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4484
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3160
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1308
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4236
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3284
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3108
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1636
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\Configuration\services.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1976
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\services.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3924
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\Configuration\services.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2240
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2312
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:376
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4648
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\System.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4512
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\System.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4072
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\System.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3128
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2544
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2232
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\Framework64\1041\spoolsv.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1520
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\fontMonitor\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2992
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\fontMonitor\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3740
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\fontMonitor\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1072
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\AppReadiness\services.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4200
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\AppReadiness\services.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:100
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\AppReadiness\services.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3704
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\fontMonitor\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1464
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\fontMonitor\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4856
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\fontMonitor\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:640
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3896
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4396
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1840
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2468
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3188
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2692
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2968
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3220
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1016
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2724
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1516
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3500
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\es-ES\TextInputHost.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5064
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\TextInputHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2352
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\es-ES\TextInputHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1484
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\dwm.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4596
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\dwm.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2480
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\dwm.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:3360
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2564
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1264
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2124
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "chainagentc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\chainagent.exe'" /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:4184
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "chainagent" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\chainagent.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1812
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "chainagentc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\chainagent.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • DcRat
                                                  • Process spawned unexpected child process
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1860

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Winlogon Helper DLL

                                                1
                                                T1547.004

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Privilege Escalation

                                                Abuse Elevation Control Mechanism

                                                1
                                                T1548

                                                Bypass User Account Control

                                                1
                                                T1548.002

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Winlogon Helper DLL

                                                1
                                                T1547.004

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Defense Evasion

                                                Abuse Elevation Control Mechanism

                                                1
                                                T1548

                                                Bypass User Account Control

                                                1
                                                T1548.002

                                                Impair Defenses

                                                1
                                                T1562

                                                Disable or Modify Tools

                                                1
                                                T1562.001

                                                Modify Registry

                                                4
                                                T1112

                                                Credential Access

                                                Discovery

                                                Query Registry

                                                2
                                                T1012

                                                System Information Discovery

                                                3
                                                T1082

                                                System Location Discovery

                                                1
                                                T1614

                                                System Language Discovery

                                                1
                                                T1614.001

                                                Lateral Movement

                                                Collection

                                                Command and Control

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Recovery\WindowsRE\e1ef82546f0b02
                                                  Filesize

                                                  504B

                                                  MD5

                                                  1b49140a62605719e710c8a19d6f01c2

                                                  SHA1

                                                  df42458a9d2a40febe94baaf7968d3a90f8ff9c2

                                                  SHA256

                                                  62509ea4847755cb5a6ba15a4312b317bbb544b171618dc5ea947d4f2eefd25f

                                                  SHA512

                                                  0f479bcb7665c89e535576c56c87071abbdf10fc35fb1c815c9136da6cd9feeeb547d46e023ff00a037518007f412f7daee21f56a801b08b757732365e6e2b2b

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\chainagent.exe.log
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  655010c15ea0ca05a6e5ddcd84986b98

                                                  SHA1

                                                  120bf7e516aeed462c07625fbfcdab5124ad05d3

                                                  SHA256

                                                  2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14

                                                  SHA512

                                                  e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  49b64127208271d8f797256057d0b006

                                                  SHA1

                                                  b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                                                  SHA256

                                                  2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                                                  SHA512

                                                  f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\038c0f3e-ea40-4319-8426-ae9fa724c68f.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  9b72e6c0008fb5e7d7e1c6b50470b5df

                                                  SHA1

                                                  f4a7a1ff9186ac036df37f22ab8bfa71a092091e

                                                  SHA256

                                                  44d71f0d18970826da004928288370f06931ea7a260898f1ba231633b642453f

                                                  SHA512

                                                  b116e87bbf2ed4f4fdce4262f7e5154e539178c85d24d76548cebd785d8e338077d1c8d108c4441e51846a5cb3905dcbf235ddc77ae174e4b59a901ae348484d

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\0af1a9d5-9978-41af-87f8-ac0d831d7407.vbs
                                                  Filesize

                                                  728B

                                                  MD5

                                                  d0d0930d663fc792c7de3ade4a2597bf

                                                  SHA1

                                                  055339720396e2b30efe320dc58ae3af128b47d0

                                                  SHA256

                                                  73bdd36590c4da7bfe324b5de52a645774eba64cc98dd1e133e9dc698b5d9a37

                                                  SHA512

                                                  0550120e7a8a1c5b9b2e35200dac20ac65ff254a934f9b9c3160a7a1405c5d34b09bec6ff21374b6b17a718aeb3fe5beae88834b10d0fbed3e8113a41564452c

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\0b388e35-0e37-4beb-9dd1-e61e707c6968.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  c50056958deaf6f4929b885fbe3c8f83

                                                  SHA1

                                                  5f6ada66f4180f59e333791c7be9017ca98da1a2

                                                  SHA256

                                                  99cfca98adc8e4416feb185439b0f84cb68b0165c7bd6eda9a6f14205ba948e4

                                                  SHA512

                                                  f5b0409328f9144b2877b524f5242f4f06b4deb95debc8d41d9fb0f2fc8de06424f6afb42d9a9ef63029555c9b62360189a96bec65343b55873b52e17affae65

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\2c47772c-9e7f-49dd-9d1e-0610affb712e.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  c9da57676cc40b6aca4f4581b75456d7

                                                  SHA1

                                                  c061e8d618d7548f84c6ad1d66486e3c941236ae

                                                  SHA256

                                                  2d84d7dd2fa72be15a85e137d55b5546360b7e8dbdd47136b53e785b62e2941d

                                                  SHA512

                                                  83826b917a701a6c1f5de81f7fa61046605395c20ac411cad3a7172f52f0d2c91160cb34f7d56e5df7abbbb32414edea170ff05b00772312c1fbf2b6651fa91c

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\2e0b9524-b48e-408b-8a67-1c34f70df11f.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  0992fd26e82b80e848451ca907d2a404

                                                  SHA1

                                                  96023a955fac014ebea23ae2995f58436ffbd6f1

                                                  SHA256

                                                  835592d114e30dbfd1bdaf196e6910b90865dcf5bf8954288998c2f47ae02f8d

                                                  SHA512

                                                  03a0b66d77eb29b92578e6733cd0a6f23f1b975001aba04dd8a54717cda9305e8f6b5b34bb3a5fb70d3b1555995117c4cb025a36d189d1112d9ccfed007fa9ec

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\4ac0a4cb-bf37-4596-9a4a-b3222d6a6495.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  9df6c83de4c048d922711671b5e91ed9

                                                  SHA1

                                                  f4f1775674b5427e011089b61e48eff08bd332ce

                                                  SHA256

                                                  58743be59f27f3785e37e881d1c8900a4540027a70330651022e887df71b98d0

                                                  SHA512

                                                  7465bfef3b7861162741d1108111c70bc34a31b15fe269a63abd56b42d4bcf11198aa8ff92d4b4efec0b9656fbcb5e408c98aa5b407eb2fecbccdd871e78ff80

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\6287ce2f-c152-4d47-96db-e1dbc13692af.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  3c6eecd46fcf9d75b49511cf1c26c3ee

                                                  SHA1

                                                  1e750f326847807e3fe0a1cbc5a3fdf7ba59cb17

                                                  SHA256

                                                  36e1e0a7ae5960c3517a4ad4c60a6ca2cf71d1ed14ec458d21b1219a9aa47260

                                                  SHA512

                                                  a9b35d1e29fd57b11e5ae0ea8aa1ee34442f8f3d08e639d0c25f02cb44e134861c8951c240fa56eb45cf38e930e0833122c2c08d80f706490c04410a643ef953

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\6b62302e-6a90-441f-9304-65b07a078510.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  f29c53ddf8ff645292428ac5cc6d6c7b

                                                  SHA1

                                                  8c68f9445bc9edb002b0546653dcdb2f3eedd2f9

                                                  SHA256

                                                  cc7b74968818e0c60105b204c0ad7ec75ce3b52c3e3481794dd2489ed197a786

                                                  SHA512

                                                  7611347a6c575c0e384b9ce5c6efb64c50df1cb2b1a75cfc7c1c1f3b9ff8ab1a00bf13b8beaced7a2153a7de1c9a11c9be5601873af5f3d1b78faeccfe2c77ff

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\75e04b06-6725-4e3a-96e2-92f361d7df55.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  434be426b0f3c7692f61e7e3a9560d54

                                                  SHA1

                                                  eddacf4482e40abdb81099a72021b72004c02848

                                                  SHA256

                                                  acb0764ef8d0efea9dbfeccc3094acdb0a9eb6569f578921a1297429c4260862

                                                  SHA512

                                                  eca200c698fcddd25933c4cc579cf7207c7c249cfdc5399a9ca07cdaf0550987658cb082c792f73bc611a8163b5ac1ccad7d45cad969de24891c1e8943267a2d

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\869df521-297a-4f17-824a-784b41458415.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  0c162767c75b0a2df55bc0e14a6cde98

                                                  SHA1

                                                  517ce7a2aaf0b50255028a8cb2daf1eadce33984

                                                  SHA256

                                                  0e87c386a9f6d23b41f3fe121d69fa2beba5cd484c12a4263cccf88586de1f31

                                                  SHA512

                                                  27f05afe35d3b7814de301d5359f4dbb19ca7606ae85c3c3f1f74b7e4b3b010a8c359a2985cdaf6489c192bc92466c1f2ef80be612c25491cf0ec37a9ca0e48d

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\ad3235bf-f141-47a7-b575-5d44039b3790.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  be9be27b6d0b909bf3fcdf5e93004095

                                                  SHA1

                                                  6301830c784401e44835376b647cdd400479d2bf

                                                  SHA256

                                                  1524f5cf19089e58c8274ce0140086c6517551e2f18c7fa0b2cc5223b9980443

                                                  SHA512

                                                  8f68ac45e647453564cd9d047e503f02fcb77b667af95ba251eaae9bbe637050f574198a2190ab553380525c0c054a82f4a3562072bb1e213801859541a4ea0d

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\b7f86ed6-443e-4344-9da3-dee273ab6bff.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  183401f5ed1bd8813e9e9dad3681677f

                                                  SHA1

                                                  1a7482255bb696f99f47dc8c7c550e26cbe3af43

                                                  SHA256

                                                  67222c1248f86e6066cba09bd1f260d709f52fe0d5c8b849041222592e0bcfdf

                                                  SHA512

                                                  7b36dbb6cadb2ae8c09d55b953dbed6f411436993884f61a0a7689180ef782468393e4172fdbf90837c03cecc35e41354fa4ea2b145611c05172da5494bc15fe

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\e6da8653-2c7d-4f8b-a9a1-1329a6f48660.vbs
                                                  Filesize

                                                  505B

                                                  MD5

                                                  0e2d53f22f44767acfb3695446a42fdf

                                                  SHA1

                                                  af6803d40ae74916a19eeddb26a3015fb034f51e

                                                  SHA256

                                                  ec4d7b53dea5232287188b1d5f22830ccd6dc06583da462bd8649bb6200a49c2

                                                  SHA512

                                                  5bb16e75eba0855c09f8dfbe0ecffd8ca82ee88e2a22b5d6a6ccaba722a575135526e943506941289aa35d3247dd7f5990a81e16f63ce7961ef1ccf0021ae1cb

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\ea559014-d6ca-4faa-bca0-568b3c11531d.vbs
                                                  Filesize

                                                  729B

                                                  MD5

                                                  4a938ce28e29483973ceccceb0339f64

                                                  SHA1

                                                  c42249b58d84a970c5672f9eef5d4b43a7e04863

                                                  SHA256

                                                  59582b95cff3eb1c10ac3edb58a72026c5f0f707e202c2634f022115d124d208

                                                  SHA512

                                                  5ed0201d6f87527386433946d52ad778e7640161e317c703c2b53f0c0010df57c60a701dbed2bcb2cf717196c877889a940eeddfcd5b3de2a4fe8dc6482ffec8

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\lQa6YaxVpO.bat
                                                  Filesize

                                                  194B

                                                  MD5

                                                  151937499948935873645e1193f58178

                                                  SHA1

                                                  eb11bee2de8bbfbfcef734e5385813d3139b64d4

                                                  SHA256

                                                  ef9a02bb26fcceac932c1c4c94f36019dcad0ec6f467ca494ec1e97cd95ac9b8

                                                  SHA512

                                                  0e45126143fe8c7db30d725eff557a3a44c2e42ab96a2b44147d32056e3e1b5df5648bd766b1d0e97078a7bce072037b2104970bbdbc07c294a580020f71cc14

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Temp\xqes9JcvBP.bat
                                                  Filesize

                                                  218B

                                                  MD5

                                                  7b000ee9f68c0754fc61316be0f79850

                                                  SHA1

                                                  2dc6c3036037d34b9ad82ade751ba27d40c0f6ba

                                                  SHA256

                                                  b92ed271dbc45891047755b3fbc5fe99d151aad32079162b26e8d092468e3346

                                                  SHA512

                                                  c7d31f120b084c0f979b019eef8af1eeb38f40ee80c46ebe8a700448466a91b102cafed9317cc2c6a9dbcd33b5a47410d9f823e4cbcac455766f2c5e27993464

                                                  Download Submit

                                                • C:\fontMonitor\B6f2SnQ47.bat
                                                  Filesize

                                                  31B

                                                  MD5

                                                  d919292d76ba6af3f0a7c88b2d07c4fa

                                                  SHA1

                                                  0fa76a1456603b525f53d9e787d1a800172afdf8

                                                  SHA256

                                                  52bde46534a8a1ea436617040c311631ce470e0e60875585921e2b3fbde3809c

                                                  SHA512

                                                  3a39f5a6a544634841f20d26dcbc3b2f875639e38eb1f5db1d243517ed87e8df542459e3b65d3336c69293a37e8f3ac03fd4a11330163fbf9eb8bc2218e7a9b5

                                                  Download Submit

                                                • C:\fontMonitor\GFcBidplGj1mDhuTvzK8nh.vbe
                                                  Filesize

                                                  197B

                                                  MD5

                                                  692908a9fe7461b9736233b4b217f221

                                                  SHA1

                                                  b3bb8803bba51dd7c622d2a1e4f2c8e4b1c4184d

                                                  SHA256

                                                  d3be77c2e695644f8dfbc8342c806f5f48c3074f5ea1000aa300b6c7061e591f

                                                  SHA512

                                                  f38138284e905c6c877dd67de0858ce6d80403c712249b6e353c51389aa86c67ca29ba4f455d4ab4f1b5f5c6e3c8e1fccbdf01b8d0766aa93b35fb8da5230788

                                                  Download Submit

                                                • C:\fontMonitor\chainagent.exe
                                                  Filesize

                                                  3.3MB

                                                  MD5

                                                  e74be6bbac3ea0713506397d5d6ef541

                                                  SHA1

                                                  dc4c91d512cb544c5c458e1aecc6bd8a7fab61f9

                                                  SHA256

                                                  58440f3b4db0b30ffa0001857bd2cf329d470c518895ac668ab2eb25a10499f7

                                                  SHA512

                                                  09f31ce980869b6e2d53ee391a62150fdec456ceafa22879f4268094eec03614e77def0dc1adea064e59982838286020e6af45e78c7db3c4cdc1da965c1cd185

                                                  Download Submit

                                                • memory/376-121-0x000000001B1E0000-0x000000001B1F2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/1300-133-0x00000000028D0000-0x00000000028E2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/1548-65-0x0000000003340000-0x0000000003352000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/2152-257-0x000000001BD40000-0x000000001BD52000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/2584-178-0x00000000033F0000-0x0000000003402000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/2816-245-0x000000001B310000-0x000000001B322000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/2824-25-0x00000000027C0000-0x00000000027C8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/2824-31-0x000000001B250000-0x000000001B25C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/2824-39-0x000000001BCB0000-0x000000001BCB8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/2824-44-0x000000001BCD0000-0x000000001BCDE000-memory.dmp

                                                  Filesize

                                                  56KB

                                                  Download

                                                • memory/2824-45-0x000000001BC70000-0x000000001BC7C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/2824-47-0x000000001BC90000-0x000000001BC9A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/2824-46-0x000000001BC80000-0x000000001BC88000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/2824-48-0x000000001BCA0000-0x000000001BCAC000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/2824-43-0x000000001BCC0000-0x000000001BCC8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/2824-42-0x000000001BB60000-0x000000001BB6E000-memory.dmp

                                                  Filesize

                                                  56KB

                                                  Download

                                                • memory/2824-41-0x000000001BB50000-0x000000001BB5A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/2824-40-0x000000001BB40000-0x000000001BB4C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/2824-38-0x000000001BA30000-0x000000001BA3C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/2824-36-0x000000001BA10000-0x000000001BA18000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/2824-35-0x000000001BA00000-0x000000001BA0C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/2824-34-0x000000001BF30000-0x000000001C458000-memory.dmp

                                                  Filesize

                                                  5.2MB

                                                  Download

                                                • memory/2824-33-0x000000001B9D0000-0x000000001B9E2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/2824-12-0x00007FFE57993000-0x00007FFE57995000-memory.dmp

                                                  Filesize

                                                  8KB

                                                  Download

                                                • memory/2824-32-0x000000001B260000-0x000000001B268000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/2824-37-0x000000001BA20000-0x000000001BA2C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/2824-30-0x000000001B240000-0x000000001B248000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/2824-29-0x000000001B230000-0x000000001B23C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/2824-28-0x000000001B980000-0x000000001B9D6000-memory.dmp

                                                  Filesize

                                                  344KB

                                                  Download

                                                • memory/2824-27-0x000000001B220000-0x000000001B22A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                  Download

                                                • memory/2824-26-0x000000001B210000-0x000000001B220000-memory.dmp

                                                  Filesize

                                                  64KB

                                                  Download

                                                • memory/2824-24-0x00000000027B0000-0x00000000027BC000-memory.dmp

                                                  Filesize

                                                  48KB

                                                  Download

                                                • memory/2824-21-0x0000000002780000-0x0000000002796000-memory.dmp

                                                  Filesize

                                                  88KB

                                                  Download

                                                • memory/2824-23-0x00000000027D0000-0x00000000027E2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/2824-22-0x00000000027A0000-0x00000000027A8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/2824-19-0x0000000002760000-0x0000000002768000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/2824-20-0x0000000002770000-0x0000000002780000-memory.dmp

                                                  Filesize

                                                  64KB

                                                  Download

                                                • memory/2824-18-0x000000001B1C0000-0x000000001B210000-memory.dmp

                                                  Filesize

                                                  320KB

                                                  Download

                                                • memory/2824-17-0x0000000002740000-0x000000000275C000-memory.dmp

                                                  Filesize

                                                  112KB

                                                  Download

                                                • memory/2824-16-0x0000000002730000-0x0000000002738000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/2824-15-0x0000000000CD0000-0x0000000000CDE000-memory.dmp

                                                  Filesize

                                                  56KB

                                                  Download

                                                • memory/2824-14-0x0000000000CC0000-0x0000000000CCE000-memory.dmp

                                                  Filesize

                                                  56KB

                                                  Download

                                                • memory/2824-13-0x0000000000190000-0x00000000004EC000-memory.dmp

                                                  Filesize

                                                  3.4MB

                                                  Download

                                                • memory/4876-108-0x000000001C120000-0x000000001C132000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download