Overview

overview

10

Static

static

10

99bae4effd...8N.exe

windows7-x64

10

99bae4effd...8N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    116s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 05:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    99bae4effd7113b7decd48c23ea5cc6626a9b4f222ec9ad862d00a5a03cbb498N.exe

  • Size

    1.0MB

  • MD5

    80de5279605dda35d99f32d926d6d600

  • SHA1

    4126656e487d6e427a7e279dcae123a36906e2ea

  • SHA256

    99bae4effd7113b7decd48c23ea5cc6626a9b4f222ec9ad862d00a5a03cbb498

  • SHA512

    e328d7e90b57b081a771e969a25cc7f9ec91d62c5ef716bef71861b2dda70779c906f7c76d0403deba25e0650b27467ab719a411c90b4f9f66ef230eb1d7a990

  • SSDEEP

    12288:sP2N7DeTXX5qeIeLsdxv/xedn6IwyMbfhC6hQs3uUbG6ddD7HFPMmXgAff+75LMS:sP28z7IeYxvJeKHdZH3OacV3d9CE

Score
10/10
dcratevasionexecutioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 50 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
    persistence
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 39 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Adds Run key to start application 2 TTPs 30 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 26 IoCs
    evasiontrojan
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 39 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\99bae4effd7113b7decd48c23ea5cc6626a9b4f222ec9ad862d00a5a03cbb498N.exe
    "C:\Users\Admin\AppData\Local\Temp\99bae4effd7113b7decd48c23ea5cc6626a9b4f222ec9ad862d00a5a03cbb498N.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:632
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2692
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:396
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:760
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3680
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:232
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:212
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4232
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2940
    • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
      "C:\Recovery\WindowsRE\StartMenuExperienceHost.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4660
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aeeee9a2-84f0-48f9-9ea4-4bc782bc7663.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
          C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1640
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7d8d971-3bff-490b-860d-60408805cbda.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:452
            • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
              C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4244
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90f7c2c0-e2aa-4ac7-a539-249bd87d796a.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:5052
                • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                  C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:1036
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2da8d7fd-b680-4259-8162-5eccb7654811.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2064
                    • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                      C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4276
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c55376a4-46e3-412e-8d37-f274041a4026.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:464
                        • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                          C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:3968
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fef5a9b-63e0-45f4-9591-1a9c6115deaa.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1492
                            • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                              C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:2448
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71917471-b7d7-4fb5-9d47-77a8b9440620.vbs"
                                15⤵
                                  PID:1336
                                  • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                    C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                    16⤵
                                    • UAC bypass
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • System policy modification
                                    PID:2420
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eafaf737-13a1-457c-ae37-39d3c3fed7a8.vbs"
                                      17⤵
                                        PID:1436
                                        • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                          C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                          18⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • System policy modification
                                          PID:3756
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea372628-5d66-4e2a-8e76-c2dcd401fabd.vbs"
                                            19⤵
                                              PID:5096
                                              • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                                C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                                20⤵
                                                • UAC bypass
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • System policy modification
                                                PID:3892
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\92c5ddf5-6327-4bbf-884d-02a8ff345011.vbs"
                                                  21⤵
                                                    PID:2404
                                                    • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                                      C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                                      22⤵
                                                      • UAC bypass
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • System policy modification
                                                      PID:228
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32a39d31-d0a6-4a2a-8817-a92d000b3657.vbs"
                                                        23⤵
                                                          PID:3784
                                                          • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                                            C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
                                                            24⤵
                                                            • UAC bypass
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Checks whether UAC is enabled
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • System policy modification
                                                            PID:1272
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4eba09c8-641d-4b1d-aa88-a07c06ee3a7c.vbs"
                                                              25⤵
                                                                PID:312
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0e19076-eda1-4666-bc53-0e300df0315b.vbs"
                                                                25⤵
                                                                  PID:3760
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\899a5145-97ee-4dec-9dc0-862370e7f695.vbs"
                                                              23⤵
                                                                PID:848
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7782d4d1-84c4-436a-b0a6-940b38a63f35.vbs"
                                                            21⤵
                                                              PID:2940
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dcfc4d98-4073-46ac-90c3-677725679e0c.vbs"
                                                          19⤵
                                                            PID:2400
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6bdd519c-1344-4d5c-ba42-95071ea48857.vbs"
                                                        17⤵
                                                          PID:732
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5cced88f-0ce2-46d0-98b0-34801d54c8b1.vbs"
                                                      15⤵
                                                        PID:1640
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7c87f5f-39f4-434d-be7d-78867aa9aa12.vbs"
                                                    13⤵
                                                      PID:3908
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c56a24f-b9b6-4225-8aef-d77aa96e6e35.vbs"
                                                  11⤵
                                                    PID:2360
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3aef4e9c-1576-45b0-9878-e4c3440daeac.vbs"
                                                9⤵
                                                  PID:2864
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da0293ab-dd99-49a3-8283-52813d759bb2.vbs"
                                              7⤵
                                                PID:4556
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\689562de-300b-4ab0-89dc-e601ae086abe.vbs"
                                            5⤵
                                              PID:1348
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c1b60ae-0f2f-4f96-a7db-6a24f4a626db.vbs"
                                          3⤵
                                            PID:4480
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Registry.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4120
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Registry.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2060
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Registry.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4268
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\lsass.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3356
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\Libraries\lsass.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2612
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Libraries\lsass.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1644
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1684
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:764
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1168
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\taskhostw.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1000
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\taskhostw.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4152
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\taskhostw.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3396
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\LiveKernelReports\dllhost.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3556
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\dllhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2600
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\LiveKernelReports\dllhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2368
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2796
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1712
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1492
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4572
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1728
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1992
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Windows\AppReadiness\SearchApp.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:5004
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\AppReadiness\SearchApp.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1952
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\AppReadiness\SearchApp.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1260
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1364
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3456
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\lsass.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2292
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2748
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4948
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3776
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\Registration\CRMLog\dwm.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1968
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\dwm.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1904
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Registration\CRMLog\dwm.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2284
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:748
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1464
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3316
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:5040
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2068
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:5036
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4296
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4824
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2036
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\spoolsv.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:412
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\spoolsv.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2972
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\spoolsv.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4356
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\RuntimeBroker.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1784
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1448
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2196

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      1
                                      T1059

                                      PowerShell

                                      1
                                      T1059.001

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Winlogon Helper DLL

                                      1
                                      T1547.004

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Privilege Escalation

                                      Abuse Elevation Control Mechanism

                                      1
                                      T1548

                                      Bypass User Account Control

                                      1
                                      T1548.002

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Winlogon Helper DLL

                                      1
                                      T1547.004

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Defense Evasion

                                      Abuse Elevation Control Mechanism

                                      1
                                      T1548

                                      Bypass User Account Control

                                      1
                                      T1548.002

                                      Impair Defenses

                                      1
                                      T1562

                                      Disable or Modify Tools

                                      1
                                      T1562.001

                                      Modify Registry

                                      4
                                      T1112

                                      Credential Access

                                      Discovery

                                      Query Registry

                                      2
                                      T1012

                                      System Information Discovery

                                      3
                                      T1082

                                      Lateral Movement

                                      Collection

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\StartMenuExperienceHost.exe.log
                                        Filesize

                                        1KB

                                        MD5

                                        3690a1c3b695227a38625dcf27bd6dac

                                        SHA1

                                        c2ed91e98b120681182904fa2c7cd504e5c4b2f5

                                        SHA256

                                        2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

                                        SHA512

                                        15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                        Filesize

                                        2KB

                                        MD5

                                        d85ba6ff808d9e5444a4b369f5bc2730

                                        SHA1

                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                        SHA256

                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                        SHA512

                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        944B

                                        MD5

                                        62623d22bd9e037191765d5083ce16a3

                                        SHA1

                                        4a07da6872672f715a4780513d95ed8ddeefd259

                                        SHA256

                                        95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                        SHA512

                                        9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        944B

                                        MD5

                                        2e907f77659a6601fcc408274894da2e

                                        SHA1

                                        9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                        SHA256

                                        385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                        SHA512

                                        34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        944B

                                        MD5

                                        bd5940f08d0be56e65e5f2aaf47c538e

                                        SHA1

                                        d7e31b87866e5e383ab5499da64aba50f03e8443

                                        SHA256

                                        2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                        SHA512

                                        c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        944B

                                        MD5

                                        d28a889fd956d5cb3accfbaf1143eb6f

                                        SHA1

                                        157ba54b365341f8ff06707d996b3635da8446f7

                                        SHA256

                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                        SHA512

                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        944B

                                        MD5

                                        3a6bad9528f8e23fb5c77fbd81fa28e8

                                        SHA1

                                        f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                        SHA256

                                        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                        SHA512

                                        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\2da8d7fd-b680-4259-8162-5eccb7654811.vbs
                                        Filesize

                                        725B

                                        MD5

                                        f862b11178d9ba7e9eab2068b7c631e8

                                        SHA1

                                        bff873de6bb444c849d082e1023583df96090fd1

                                        SHA256

                                        d07cfd9dae62606948db00cd4702201139ec922ec99955c88de893e3057b44e7

                                        SHA512

                                        5398fd3ed29232a8262b71d96cedcded6168241157d7a35d1e48f1df179e09c9f8051c9d434d0321624b690b4c7307e436a39ad0e602995393802e009717ea8c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\32a39d31-d0a6-4a2a-8817-a92d000b3657.vbs
                                        Filesize

                                        724B

                                        MD5

                                        2e688e926532bf3d5a6afa92605f81b9

                                        SHA1

                                        f795e8add9cf41da5756ed2eb585ca8edca95ed7

                                        SHA256

                                        7b7467e3e4ace02b574455e183e6960a3f6160f75deccc032efd4b84debe5d8d

                                        SHA512

                                        e9a873f2c54efd2128e209998dc6d654f1373b3d34103cd335903b3732ff65c22fbbb82ee604d02da9a79ee795b38b78978052a46e7c069bbbbf07be387beb8a

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\4eba09c8-641d-4b1d-aa88-a07c06ee3a7c.vbs
                                        Filesize

                                        725B

                                        MD5

                                        b97a458a3f9e2e7b53222f0e31ffd71c

                                        SHA1

                                        81d7e176085a2646805c5547c739b9d992ca96a8

                                        SHA256

                                        6e78de98ba756d870ebf55c04f7b753351f5e0735fa7c558a15fc7a7e0dfe6fb

                                        SHA512

                                        de98211e333de48a6511c9be9aab441aede29066459a29c75fb4d641f4a5cf2a2de281555a7d009c725b29bd56dc7b719011a7e2bff96c60f4d993236b053d3c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\71917471-b7d7-4fb5-9d47-77a8b9440620.vbs
                                        Filesize

                                        725B

                                        MD5

                                        9702f8dffec25bd44bed8a367b949534

                                        SHA1

                                        ed30c9414906c673449b175cefaa1ce9e31f58da

                                        SHA256

                                        00ca604fe6735bdd45be93202f35a3fea816c0222b9abda94339ea53ded97caf

                                        SHA512

                                        b7ff8874606c49ff917a0210e651ce579511a957edaba955ef2f11f3eaaea8dd4a3c970fd3a05fefdb4006a1ec2f1797ecbc1580bd8e5e7e5635aa68390cd5d5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\90f7c2c0-e2aa-4ac7-a539-249bd87d796a.vbs
                                        Filesize

                                        725B

                                        MD5

                                        fa607f96b1cc9b48fe31e0779d1dbaa1

                                        SHA1

                                        fd8cf58d90a80609478528a86229b7d8524aad13

                                        SHA256

                                        b5642822f07cd2894f8d196f8612e5c6bc8bfa3a35b844c6e0a2fc1af8143199

                                        SHA512

                                        42947dcb91deea704eb49d499f827ab6a66ee2fb4ca2adbc13971ac472bed9d7c85d06b1d4d7ee862baf7ed006a55c350d717a3fc684ad8e9e04527a733e52a6

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\92c5ddf5-6327-4bbf-884d-02a8ff345011.vbs
                                        Filesize

                                        725B

                                        MD5

                                        c7171be17d0fce0e7951a08e8a68cd97

                                        SHA1

                                        30631dd886665314d05827b83990fbdc5f805e57

                                        SHA256

                                        b12e057de954afc81d5774334903f334547cf4bc8079b25ba41c8326be31afde

                                        SHA512

                                        4d0e1b9eb83de44c0d3d594c65f6b5a080815fe5125787adbe8b9fe1decad593dfa0dc623a226cfe8d13a14e2e6c7d025f65c83b01f4c51088dcb95052735217

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\9c1b60ae-0f2f-4f96-a7db-6a24f4a626db.vbs
                                        Filesize

                                        501B

                                        MD5

                                        9b3c39235bcce29d95d854481aacdeb7

                                        SHA1

                                        abddf196ea7c72e6133856cfbbe88d5cd69008ec

                                        SHA256

                                        e794f3ecce29ff8d48a4cf23605ac243789d29d27bacf67dd9721fb0e76017dd

                                        SHA512

                                        3bb34327e825c7980e7f3f55071519bc7d57fe5e4dd458ea70b70645c7c04a5bef275aada8ab1765b5f1cb5ba4e1640cde6ecb5bc665f0eb686d197055fac448

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\9fef5a9b-63e0-45f4-9591-1a9c6115deaa.vbs
                                        Filesize

                                        725B

                                        MD5

                                        e8724e4c8c49eedb0ebb6a3f83e36964

                                        SHA1

                                        d43bc3e963ca40d42d533b81d464b926005934f4

                                        SHA256

                                        42b45029fa4dd295ae5f0118d036e5109988ab183305abbaa00b8b12b326fd50

                                        SHA512

                                        8a938633bbf80d4f3eacf9326ea0224d5225c7924c76e3f1266e10732ff744bfd0341686d211477736dcd540b9a9c0cfe65248c47978bf99b6150fd863a0a457

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ymhviand.bur.ps1
                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\a7d8d971-3bff-490b-860d-60408805cbda.vbs
                                        Filesize

                                        725B

                                        MD5

                                        d5c90515f0b18c97d7add1d87bdc8039

                                        SHA1

                                        408afe5b86ee4d6ae836b4656a463bada8f57108

                                        SHA256

                                        f661b5bfa50cf49325ca38994cf137c1957a9b94333dc1f943e492de341375db

                                        SHA512

                                        3517d4a69a0ad7642f8d882f1c668acf93d2fb31642734bc13e7f6c01c9a6d0abd5d89c1d257d1e85ccbc0032154c5eaa7e4d602af81caf5d0c3c4a7be43a859

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\aeeee9a2-84f0-48f9-9ea4-4bc782bc7663.vbs
                                        Filesize

                                        725B

                                        MD5

                                        bb214c8771f17838132418b9e8b68122

                                        SHA1

                                        f269e29a6cf205dc22f58ff7a9176d3f2120a867

                                        SHA256

                                        5fe231397b01b1fd8be459cb0d69a21ea772e9a2159906a15a24ca809e3804cc

                                        SHA512

                                        033545cc4e1803d0129ceb7612868f7f65203fe09e634e42fd55daf0295237823d2478d09379b004989d2794d2e010d13e29234a0dcf127434b14852ffca637c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\c55376a4-46e3-412e-8d37-f274041a4026.vbs
                                        Filesize

                                        725B

                                        MD5

                                        d8e25ed727a534e9e98ffb0e1d986a8a

                                        SHA1

                                        9d95d2e88d5db72c95b2c0bb1d398d56e749bde5

                                        SHA256

                                        0c3d58071875171f4cea3d0340e4eb067ddc6d28b24f83868d9d69e70ef6e70d

                                        SHA512

                                        e0f522874f01c240d2392cac8ea76284e23e9813f5ccbe6e8ef4d372dfcdccb34eada4123220499242896f6b40d864bec3f1e3d94374995a45bbe4312830739e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\ea372628-5d66-4e2a-8e76-c2dcd401fabd.vbs
                                        Filesize

                                        725B

                                        MD5

                                        2e30def89bf5717b364dde66d3689252

                                        SHA1

                                        f786e5da9d3273b8ae7a7f375a8854e899dd4f2f

                                        SHA256

                                        63357ca9754be9170b2f1ab3f5001f607e8eb807a341967514b02367e4879355

                                        SHA512

                                        1c05caac8d9b31fc2a1d381016ba13b9892357d86b554123cdfe286c8dac1b3e0e0d2e5bf106bf6c64f93ec643e3dd12fddf68f8ddb583ee45b36a78702e830b

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\eafaf737-13a1-457c-ae37-39d3c3fed7a8.vbs
                                        Filesize

                                        725B

                                        MD5

                                        109fb87603d2f237ce479b1ccb2913fc

                                        SHA1

                                        650a97b96ef5df8853f1b3d9651e659d9c26764f

                                        SHA256

                                        f2e6e5abad1a72aee71e8abb5b52afad42d212aec140f90aa481bb807b76dc45

                                        SHA512

                                        e9c8422ff45bfa1def00cccb7f28ff9aa8454998398ad5cab5a8dc56549c821a64954ed91e0a59ffb5991bed3b7c433ddc7e145eb28bc7f1869abebb743510f7

                                        Download Submit

                                      • C:\Windows\LiveKernelReports\dllhost.exe
                                        Filesize

                                        1.0MB

                                        MD5

                                        80de5279605dda35d99f32d926d6d600

                                        SHA1

                                        4126656e487d6e427a7e279dcae123a36906e2ea

                                        SHA256

                                        99bae4effd7113b7decd48c23ea5cc6626a9b4f222ec9ad862d00a5a03cbb498

                                        SHA512

                                        e328d7e90b57b081a771e969a25cc7f9ec91d62c5ef716bef71861b2dda70779c906f7c76d0403deba25e0650b27467ab719a411c90b4f9f66ef230eb1d7a990

                                        Download Submit

                                      • memory/632-12-0x000000001B390000-0x000000001B398000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/632-4-0x00000000022A0000-0x00000000022F0000-memory.dmp

                                        Filesize

                                        320KB

                                        Download

                                      • memory/632-15-0x000000001B3A0000-0x000000001B3A8000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/632-0-0x00007FF865413000-0x00007FF865415000-memory.dmp

                                        Filesize

                                        8KB

                                        Download

                                      • memory/632-13-0x000000001B6E0000-0x000000001B6EA000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/632-11-0x000000001AF00000-0x000000001AF08000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/632-8-0x0000000002290000-0x000000000229C000-memory.dmp

                                        Filesize

                                        48KB

                                        Download

                                      • memory/632-9-0x00000000022F0000-0x00000000022F8000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/632-1-0x0000000000010000-0x000000000011E000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/632-77-0x00007FF865410000-0x00007FF865ED1000-memory.dmp

                                        Filesize

                                        10.8MB

                                        Download

                                      • memory/632-16-0x000000001B3B0000-0x000000001B3BE000-memory.dmp

                                        Filesize

                                        56KB

                                        Download

                                      • memory/632-14-0x000000001B6F0000-0x000000001B6FE000-memory.dmp

                                        Filesize

                                        56KB

                                        Download

                                      • memory/632-7-0x0000000002280000-0x000000000228A000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/632-18-0x000000001B3E0000-0x000000001B3EC000-memory.dmp

                                        Filesize

                                        48KB

                                        Download

                                      • memory/632-6-0x0000000002260000-0x0000000002276000-memory.dmp

                                        Filesize

                                        88KB

                                        Download

                                      • memory/632-5-0x0000000002250000-0x0000000002258000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/632-17-0x000000001B3D0000-0x000000001B3DA000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/632-10-0x000000001AEF0000-0x000000001AEFC000-memory.dmp

                                        Filesize

                                        48KB

                                        Download

                                      • memory/632-3-0x00000000021E0000-0x00000000021FC000-memory.dmp

                                        Filesize

                                        112KB

                                        Download

                                      • memory/632-2-0x00007FF865410000-0x00007FF865ED1000-memory.dmp

                                        Filesize

                                        10.8MB

                                        Download

                                      • memory/760-72-0x0000026CE8600000-0x0000026CE8622000-memory.dmp

                                        Filesize

                                        136KB

                                        Download