Overview

overview

10

Static

static

10

d2196c5c35...c5.exe

windows7-x64

10

d2196c5c35...c5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2024 12:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5.exe

  • Size

    1.0MB

  • MD5

    aea3d4caf079e299eea0b385a4dbbedd

  • SHA1

    74b93127a847e2e2f2af6baa6b4ad6431c02ac63

  • SHA256

    d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5

  • SHA512

    8df72070ac43ee5b3e0ba8e958b0b5132229be9c6b1ed07bc0d26cbaeb27199fda53ca0cbe80c39f6af878db84d06206f59cb9bf97b64dc61b7f47237e1edbd9

  • SSDEEP

    12288:sP2N7DeTXX5qeIeLsdxv/xedn6IwyMbfhC6hQs3uUbG6ddD7HFPMmXgAff+75LMF:sP28z7IeYxvJeKHdZH3OacV3d9CE4

Score
10/10
dcratevasionexecutioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 53 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 17 IoCs
    persistence
  • Process spawned unexpected child process 51 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 42 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Adds Run key to start application 2 TTPs 34 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 28 IoCs
    evasiontrojan
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 42 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5.exe
    "C:\Users\Admin\AppData\Local\Temp\d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2940
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4412
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4640
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3428
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:392
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4360
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1992
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1248
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1084
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4364
    • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
      "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:464
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2142deb-4eed-483f-90f9-c8f0c7fdceea.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3116
        • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
          "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4180
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31df94fc-4652-4c9a-8ef7-b42574867734.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2068
            • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
              "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4364
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f8bbda4-e5eb-4293-a76c-cec24177cd98.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4012
                • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
                  "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:532
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee42f3d6-026f-478f-aabb-0093404c42d9.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5024
                    • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
                      "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:1324
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6a1b471-0d31-406e-a432-983965dc5436.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1924
                        • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
                          "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:3348
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27c8a2c9-aff0-4a5e-ace5-6632a55fc76f.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2436
                            • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
                              "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:5116
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c4980df-1dd0-429c-8881-924a1cc00b7f.vbs"
                                15⤵
                                  PID:2068
                                  • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
                                    "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
                                    16⤵
                                    • UAC bypass
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • System policy modification
                                    PID:2080
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77a6bb11-9e60-43a4-866d-ab88262a48e6.vbs"
                                      17⤵
                                        PID:1896
                                        • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
                                          "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
                                          18⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • System policy modification
                                          PID:1308
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c56cfde7-48e0-4810-aa14-1dc85e13898a.vbs"
                                            19⤵
                                              PID:1616
                                              • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
                                                "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
                                                20⤵
                                                • UAC bypass
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • System policy modification
                                                PID:4176
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\521edc55-4b3c-4abb-9d45-238b8370e901.vbs"
                                                  21⤵
                                                    PID:4504
                                                    • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
                                                      "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
                                                      22⤵
                                                      • UAC bypass
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • System policy modification
                                                      PID:4120
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d86daa1-bfbc-48c0-8c7c-36e485257879.vbs"
                                                        23⤵
                                                          PID:1120
                                                          • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
                                                            "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
                                                            24⤵
                                                            • UAC bypass
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Checks whether UAC is enabled
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • System policy modification
                                                            PID:2852
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1794a8d2-f8f3-4e1e-aefe-6f2e8d721f8e.vbs"
                                                              25⤵
                                                                PID:3344
                                                                • C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe
                                                                  "C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe"
                                                                  26⤵
                                                                  • UAC bypass
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • System policy modification
                                                                  PID:3688
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27d6c1a2-5206-4cf2-875a-7fb34b0582da.vbs"
                                                                    27⤵
                                                                      PID:3360
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f08f1c2-c6c6-4a32-8951-798c44e2d003.vbs"
                                                                      27⤵
                                                                        PID:2196
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c65748cf-94eb-4846-9814-6c04ca64bd40.vbs"
                                                                    25⤵
                                                                      PID:5004
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\edec1240-b2a9-430e-b4f1-80f996c491a5.vbs"
                                                                  23⤵
                                                                    PID:3036
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1b5528d-fd9b-438d-92f1-be44354b416f.vbs"
                                                                21⤵
                                                                  PID:4700
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11b606f8-0d85-411f-93b7-2fb2ee2a2d7d.vbs"
                                                              19⤵
                                                                PID:4032
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d50fc67-bfbb-4935-93dc-1f7141b545d1.vbs"
                                                            17⤵
                                                              PID:4632
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\680b1928-1c70-4d13-8223-3e52389263cd.vbs"
                                                          15⤵
                                                            PID:3648
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a742440-fd77-4ec7-a803-be25d68e35f0.vbs"
                                                        13⤵
                                                          PID:208
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\942a20a7-0205-4da2-a372-ba42cf811103.vbs"
                                                      11⤵
                                                        PID:1392
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6c5a7f3-b30c-4b5a-b827-ee3f7ee0cfe0.vbs"
                                                    9⤵
                                                      PID:1420
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88c6461f-51b0-4cf5-ad7d-b038c1536a95.vbs"
                                                  7⤵
                                                    PID:2516
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\095de039-2e78-4a2f-8bc2-7bbace6f6ea8.vbs"
                                                5⤵
                                                  PID:860
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f956f2b7-a8cc-403a-89d6-81702b42b0ff.vbs"
                                              3⤵
                                                PID:1540
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemResources\Windows.UI.BlockedShutdown\pris\dwm.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1464
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\SystemResources\Windows.UI.BlockedShutdown\pris\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2076
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemResources\Windows.UI.BlockedShutdown\pris\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3716
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\it-IT\SearchApp.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1280
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\SearchApp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3024
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\it-IT\SearchApp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3576
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Default\PrintHood\lsass.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3580
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:988
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Default\PrintHood\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4308
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2252
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4780
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\Registry.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3900
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Oracle\TextInputHost.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1944
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\TextInputHost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4400
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Oracle\TextInputHost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2380
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Videos\dllhost.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:5024
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Videos\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4460
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Videos\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1960
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\uk-UA\taskhostw.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2372
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\uk-UA\taskhostw.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2148
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\uk-UA\taskhostw.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3380
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4292
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4576
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3508
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\System.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2800
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows NT\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2512
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2200
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\upfc.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4572
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\upfc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1528
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\upfc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:5012
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\Registry.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3076
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\Registry.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3948
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\Registry.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2872
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\Themes\sppsvc.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:964
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\sppsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3044
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\Resources\Themes\sppsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2308
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre-1.8\legal\dllhost.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:864
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\legal\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4016
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre-1.8\legal\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1236
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2384
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2952
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3088
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5d" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:368
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5" /sc ONLOGON /tr "'C:\Users\Default User\d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4148
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5d" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3304
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3688
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4316
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1384
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\SoftwareDistribution\explorer.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2136
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3068
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\SoftwareDistribution\explorer.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4080

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Execution

                                          Command and Scripting Interpreter

                                          1
                                          T1059

                                          PowerShell

                                          1
                                          T1059.001

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          2
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Winlogon Helper DLL

                                          1
                                          T1547.004

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Privilege Escalation

                                          Abuse Elevation Control Mechanism

                                          1
                                          T1548

                                          Bypass User Account Control

                                          1
                                          T1548.002

                                          Boot or Logon Autostart Execution

                                          2
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Winlogon Helper DLL

                                          1
                                          T1547.004

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Defense Evasion

                                          Abuse Elevation Control Mechanism

                                          1
                                          T1548

                                          Bypass User Account Control

                                          1
                                          T1548.002

                                          Impair Defenses

                                          1
                                          T1562

                                          Disable or Modify Tools

                                          1
                                          T1562.001

                                          Modify Registry

                                          4
                                          T1112

                                          Credential Access

                                          Discovery

                                          Query Registry

                                          2
                                          T1012

                                          System Information Discovery

                                          3
                                          T1082

                                          Lateral Movement

                                          Collection

                                          Command and Control

                                          Exfiltration

                                          Impact

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Program Files (x86)\Common Files\Oracle\TextInputHost.exe
                                            Filesize

                                            1.0MB

                                            MD5

                                            aea3d4caf079e299eea0b385a4dbbedd

                                            SHA1

                                            74b93127a847e2e2f2af6baa6b4ad6431c02ac63

                                            SHA256

                                            d2196c5c358f43597a318e032bfd158b9c0ef318be6a2323acd2508bd6d23dc5

                                            SHA512

                                            8df72070ac43ee5b3e0ba8e958b0b5132229be9c6b1ed07bc0d26cbaeb27199fda53ca0cbe80c39f6af878db84d06206f59cb9bf97b64dc61b7f47237e1edbd9

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log
                                            Filesize

                                            1KB

                                            MD5

                                            3690a1c3b695227a38625dcf27bd6dac

                                            SHA1

                                            c2ed91e98b120681182904fa2c7cd504e5c4b2f5

                                            SHA256

                                            2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

                                            SHA512

                                            15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                            Filesize

                                            2KB

                                            MD5

                                            d85ba6ff808d9e5444a4b369f5bc2730

                                            SHA1

                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                            SHA256

                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                            SHA512

                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            d28a889fd956d5cb3accfbaf1143eb6f

                                            SHA1

                                            157ba54b365341f8ff06707d996b3635da8446f7

                                            SHA256

                                            21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                            SHA512

                                            0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            77d622bb1a5b250869a3238b9bc1402b

                                            SHA1

                                            d47f4003c2554b9dfc4c16f22460b331886b191b

                                            SHA256

                                            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                            SHA512

                                            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            bd5940f08d0be56e65e5f2aaf47c538e

                                            SHA1

                                            d7e31b87866e5e383ab5499da64aba50f03e8443

                                            SHA256

                                            2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                            SHA512

                                            c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            3a6bad9528f8e23fb5c77fbd81fa28e8

                                            SHA1

                                            f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                            SHA256

                                            986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                            SHA512

                                            846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\1794a8d2-f8f3-4e1e-aefe-6f2e8d721f8e.vbs
                                            Filesize

                                            750B

                                            MD5

                                            52d96bb586c98414ab3374282a74b212

                                            SHA1

                                            e68cec60eeb5f39f504ee442f3d746b2f79ea380

                                            SHA256

                                            134a470518d52b8b01e5fc209e9067e868d2cc7eec324caba668c0c7b07f4c7a

                                            SHA512

                                            4b76f8a0f69a66e7c55e0aadb6bf9a2fd486641a094b4d6e26c9e821e8b64c2c1e6d0be2603b9a1411065b46051268b59c196dfe76001cc8b6ba0f0b3f9e0410

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\27c8a2c9-aff0-4a5e-ace5-6632a55fc76f.vbs
                                            Filesize

                                            750B

                                            MD5

                                            407fa68818952027fcfd1ba309f274f5

                                            SHA1

                                            d40e151f5c27f82aa3a85925f9be021cd4d9fffa

                                            SHA256

                                            62e1744f38e514cacfb681e47261fd69ee0be9ceef19ec9d222883e6b511cfdf

                                            SHA512

                                            f98a0ec173a87a4e0e524ca288027eac9d267d88c158ae9f44cf6a883d8bc8e4ff559cc3c6e84e3915344d7d8078eb89bdcbe607221034e58fe735579d41cd78

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\27d6c1a2-5206-4cf2-875a-7fb34b0582da.vbs
                                            Filesize

                                            750B

                                            MD5

                                            0768f68621cf43bf581213c70b76f6e6

                                            SHA1

                                            91a0261834dd8619f747ff597a49b8837706737a

                                            SHA256

                                            c16d9d68a1b14fb5d7ccc74a24a17a05be5c08c497bb6a01cc2e30729c8249af

                                            SHA512

                                            75dca817d9ed35ac11f2d906d0e912c5afa6b358ab1d0203de5eeaf190dc699d7f0e396f1f02e32f5f64ae2c7fe3be0e2566207d138f3d8e30ba4fd2ae0978b8

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\2d86daa1-bfbc-48c0-8c7c-36e485257879.vbs
                                            Filesize

                                            750B

                                            MD5

                                            8d6c1c40986afcfb60b5993708a67085

                                            SHA1

                                            cd35634a587c6ba6d3a6b8f7679e61e867b45d5a

                                            SHA256

                                            31a25181d63c123efaf1dd71a8c277ebb8adbc925b5419e7a4b90712a9dc3ab5

                                            SHA512

                                            5923ff59011c223010516eb48b4329d7f54281b68ec16ff2c8e887bd58f987a976747562529bbe8df0583daf8e172e0050385be018cdfc7d31415b4ccdf97470

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\2f8bbda4-e5eb-4293-a76c-cec24177cd98.vbs
                                            Filesize

                                            750B

                                            MD5

                                            f0a13a0ee7d542fc850edb5b39a08594

                                            SHA1

                                            7032cad2120febf61935c7b0aa85e3e11eaa6046

                                            SHA256

                                            fdd100cfc89da88e949e3a49ab13d61433ff507f5cbbcc0767f3dd094162c64d

                                            SHA512

                                            635fb74ed76199da2fade02ce7fd544f18ad37198deebcb726004f3ffa10c5fed32406c93be15f054fa6270534dd1369422aedc0a544136bd1c99c49cacd87e3

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\31df94fc-4652-4c9a-8ef7-b42574867734.vbs
                                            Filesize

                                            750B

                                            MD5

                                            b814eed3a6af54cbf58bc7b86baeb20a

                                            SHA1

                                            ffbf1189238122b2d3de6c9ed32f579903425266

                                            SHA256

                                            8693c80b325b7c57aef21429add5e8bdbeb4e5f894e66c1200af76b5485c41be

                                            SHA512

                                            5ce1e10ac4a37314ce8cd6a72cae5473bd8951b5550ef967f7a659149a18ad66adedd375b8db21d1933f9af130a21e0f50f969f49d60fb03cce9745f497e12be

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\521edc55-4b3c-4abb-9d45-238b8370e901.vbs
                                            Filesize

                                            750B

                                            MD5

                                            73b6ddf71770a9bbd7731de98f7ebedb

                                            SHA1

                                            b71aa39f68805d49f635a82524fa98389459c3ec

                                            SHA256

                                            04cc36650285d3119190ea4cc55b1be2d7ff24c22fca5ac5b582816cbcd4faa1

                                            SHA512

                                            99105146e0667f9970c1c08cd03e76d6d9dc8ace6ed681ce359f7e5f9be8f60a0ba6cf21bc23728fdb299d3b65cf174664f36b06003abd10c2c12247113f43e2

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\5c4980df-1dd0-429c-8881-924a1cc00b7f.vbs
                                            Filesize

                                            750B

                                            MD5

                                            579a0636a65248c97ddd864a8a0e1a57

                                            SHA1

                                            05c03d1e6c49a0d9a7ef971a7b36e5a3d64f00e3

                                            SHA256

                                            42c01dddf3ca94ed78405b8de374a1bc49434fe8992ba85a1a112bde0508c739

                                            SHA512

                                            0ed8207b178e82379a86380d442343152f8f64cf7e8c5d62052107f68147ef941ef9bd6274eea28e8ad997e231cc1e94f823383af102555a36bab953f5ff74cf

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\77a6bb11-9e60-43a4-866d-ab88262a48e6.vbs
                                            Filesize

                                            750B

                                            MD5

                                            d716c64f66376d0a17356ec2367507a9

                                            SHA1

                                            de9947646b650d0024a71a70748ed05f87ce26b6

                                            SHA256

                                            5f2d4b0c7a9e6f98971c7da9e6e14f19d0911dd63da5536bff93e1e0a7dc4b67

                                            SHA512

                                            5ee8321f482f9af79781ed7b56b74deb807126a61f6007e810af0faf0df134bd800446f82e5c754e57f6bde44d9b41266f8f7fd923a9754330557b4362767f04

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gnhw21px.izf.ps1
                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\c56cfde7-48e0-4810-aa14-1dc85e13898a.vbs
                                            Filesize

                                            750B

                                            MD5

                                            3dcf07ff57f841e50780da94d52f837e

                                            SHA1

                                            4a3faca2bbf33eaa16ff96fcb07ecbd24f884f21

                                            SHA256

                                            bea585220acc851efcbfe461bd1bfa26f37d7a0aad0f9349611a5cee43667283

                                            SHA512

                                            bd32e8886052b627b281a3cff7e3c52e8255aa5610ddb3e39a743306f82e108ed0eb979b0dea0592562127e77ffd73c75c87fc95045edbbbcb357cdba35c5e14

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\d2142deb-4eed-483f-90f9-c8f0c7fdceea.vbs
                                            Filesize

                                            749B

                                            MD5

                                            569bc6a3309dfcd9e0c770ca0d867343

                                            SHA1

                                            836acb8689baebb2747b51508f2529127df7a737

                                            SHA256

                                            759ef11ded065ff0418f11d51980036457a033318aac6f19539b9a5ddeaa054d

                                            SHA512

                                            4fb73a949fc6250442c9aa47e799700b7e3b8b74e9f4eec34aff99d78fbbac3671bc5e5d3fdf1c2ad948545a9c445142d5d44cda4e4b075fb9657ef15a06d152

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\ee42f3d6-026f-478f-aabb-0093404c42d9.vbs
                                            Filesize

                                            749B

                                            MD5

                                            cc09bf04f7f687ad7a41118eb5b50efb

                                            SHA1

                                            e8b2fba725be3144730b0de2e7faabd515c8b895

                                            SHA256

                                            06529162cd9d627ba5ba907e48f40241d6259478ec4129dc0003670d9a834b89

                                            SHA512

                                            9047fe2d9996375595cff2010c9a1cdec735aca189c5058832938c0fae377fe5769c992e910a7729285b68dd2f4f7490156284c304572a5cde1532298267aeac

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\f6a1b471-0d31-406e-a432-983965dc5436.vbs
                                            Filesize

                                            750B

                                            MD5

                                            ed3ffcd1cfe3e93b3c6f833fd9ba1fa5

                                            SHA1

                                            2b5998da9eb7203024284f935ea564f0836b232f

                                            SHA256

                                            b18cca730f1128e495cd501cd85db4f7ab4d85ee7333c0bf1a6bcc7efe0c04f7

                                            SHA512

                                            79696cf80ea82d986278422248b8ccd0d17af74b4a01b5848c59642b3765befa206f0cab147806268a8f1b272ec3da97ee1dfe8966f26b989a1cafaddae1ebcb

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\f956f2b7-a8cc-403a-89d6-81702b42b0ff.vbs
                                            Filesize

                                            526B

                                            MD5

                                            3c885eaa9296b0594fc10a6046d5d014

                                            SHA1

                                            ec7ddd095882a57249191d693666971c0ad758ac

                                            SHA256

                                            82f5d98d5cd473280f1cd5ece4e9c8865cb2ad413cd1060250c980b2c8caf050

                                            SHA512

                                            0d9e6d420ae4675ab4f59584dcf2acfc871d5d8ad39d6236cdd2fde5f1cd579ba582d412eaff1a91808a70cec375fe078548325494445719d984e5093dc69111

                                            Download Submit

                                          • memory/2940-11-0x000000001B230000-0x000000001B238000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2940-64-0x00007FF8DBAB0000-0x00007FF8DC571000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/2940-16-0x000000001B8D0000-0x000000001B8DE000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2940-15-0x000000001B8B0000-0x000000001B8B8000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2940-14-0x000000001B8A0000-0x000000001B8AE000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2940-8-0x000000001B200000-0x000000001B20C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/2940-18-0x000000001BA00000-0x000000001BA0C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/2940-9-0x000000001B210000-0x000000001B218000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2940-1-0x00000000003C0000-0x00000000004CE000-memory.dmp

                                            Filesize

                                            1.1MB

                                            Download

                                          • memory/2940-13-0x000000001B8C0000-0x000000001B8CA000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/2940-0-0x00007FF8DBAB3000-0x00007FF8DBAB5000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/2940-17-0x000000001B9F0000-0x000000001B9FA000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/2940-12-0x000000001B240000-0x000000001B248000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2940-10-0x000000001B220000-0x000000001B22C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/2940-6-0x000000001B1D0000-0x000000001B1E6000-memory.dmp

                                            Filesize

                                            88KB

                                            Download

                                          • memory/2940-7-0x000000001B1F0000-0x000000001B1FA000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/2940-4-0x000000001B180000-0x000000001B1D0000-memory.dmp

                                            Filesize

                                            320KB

                                            Download

                                          • memory/2940-5-0x0000000002700000-0x0000000002708000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2940-3-0x00000000026E0000-0x00000000026FC000-memory.dmp

                                            Filesize

                                            112KB

                                            Download

                                          • memory/2940-2-0x00007FF8DBAB0000-0x00007FF8DC571000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/4360-70-0x0000024F9BFC0000-0x0000024F9BFE2000-memory.dmp

                                            Filesize

                                            136KB

                                            Download