dcrat | 97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3e

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
Size

1.7MB
MD5

f8d95a8e29563bbdfe9bd258da9b8da0
SHA1

65a0879ce2667b911c2208c29aafaec6be143ac7
SHA256

97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3e
SHA512

7e6e78bf6d5fcc29f3f373a511da1e44a393b5ff9dab787c7935cf815f189abfaca78239b66c156de9cdccbf97f32c2439cf29ca295316e41ee3cc1b7633bdde
SSDEEP

49152:j+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKv:OTHUxUoh1IF9gl2

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2916	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2916	schtasks.exe	30

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2980-1-0x0000000000050000-0x0000000000210000-memory.dmp	dcrat
behavioral1/files/0x0005000000019228-27.dat	dcrat
behavioral1/files/0x00060000000194da-56.dat	dcrat
behavioral1/memory/892-129-0x0000000001140000-0x0000000001300000-memory.dmp	dcrat
behavioral1/files/0x000a000000019228-201.dat	dcrat
behavioral1/memory/2972-220-0x00000000003A0000-0x0000000000560000-memory.dmp	dcrat
behavioral1/memory/2604-232-0x0000000001000000-0x00000000011C0000-memory.dmp	dcrat
behavioral1/memory/2700-244-0x00000000012F0000-0x00000000014B0000-memory.dmp	dcrat
behavioral1/memory/448-256-0x0000000000230000-0x00000000003F0000-memory.dmp	dcrat
behavioral1/memory/1612-268-0x0000000000950000-0x0000000000B10000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1324	powershell.exe
1432	powershell.exe
2324	powershell.exe
1124	powershell.exe
740	powershell.exe
1660	powershell.exe
1816	powershell.exe
2200	powershell.exe
2012	powershell.exe
448	powershell.exe
2376	powershell.exe
2320	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe

Executes dropped EXE 9 IoCs

pid	Process
892	audiodg.exe
2500	audiodg.exe
664	audiodg.exe
3044	audiodg.exe
2972	audiodg.exe
2604	audiodg.exe
2700	audiodg.exe
448	audiodg.exe
1612	audiodg.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\RCX8856.tmp	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\RCX9145.tmp	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\c5b4cb5e9653cc	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RCX8652.tmp	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\audiodg.exe	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\taskhost.exe	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\services.exe	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File created	C:\Program Files (x86)\Common Files\System\audiodg.exe	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\RCX88C4.tmp	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\RCX8AC8.tmp	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\dllhost.exe	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\RCX9144.tmp	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\taskhost.exe	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File created	C:\Program Files\Common Files\SpeechEngines\dllhost.exe	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File created	C:\Program Files (x86)\Common Files\System\42af1c969fbb7b	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RCX8651.tmp	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\services.exe	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\RCX8AC9.tmp	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\b75386f1303e64	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
File created	C:\Program Files\Common Files\SpeechEngines\5940a34987c991	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2520	schtasks.exe
848	schtasks.exe
2804	schtasks.exe
2952	schtasks.exe
824	schtasks.exe
1080	schtasks.exe
2932	schtasks.exe
2160	schtasks.exe
1636	schtasks.exe
2420	schtasks.exe
2168	schtasks.exe
2772	schtasks.exe
2004	schtasks.exe
2032	schtasks.exe
2680	schtasks.exe
2648	schtasks.exe
2624	schtasks.exe
2676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
1432	powershell.exe
2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
1124	powershell.exe
1816	powershell.exe
2324	powershell.exe
1660	powershell.exe
2200	powershell.exe
2012	powershell.exe
2376	powershell.exe
2320	powershell.exe
1324	powershell.exe
740	powershell.exe
448	powershell.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe
892	audiodg.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	740	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	892	audiodg.exe
Token: SeDebugPrivilege	2500	audiodg.exe
Token: SeDebugPrivilege	664	audiodg.exe
Token: SeDebugPrivilege	3044	audiodg.exe
Token: SeDebugPrivilege	2972	audiodg.exe
Token: SeDebugPrivilege	2604	audiodg.exe
Token: SeDebugPrivilege	2700	audiodg.exe
Token: SeDebugPrivilege	448	audiodg.exe
Token: SeDebugPrivilege	1612	audiodg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1816	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	49
PID 2980 wrote to memory of 1816	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	49
PID 2980 wrote to memory of 1816	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	49
PID 2980 wrote to memory of 2200	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	50
PID 2980 wrote to memory of 2200	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	50
PID 2980 wrote to memory of 2200	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	50
PID 2980 wrote to memory of 1324	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	51
PID 2980 wrote to memory of 1324	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	51
PID 2980 wrote to memory of 1324	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	51
PID 2980 wrote to memory of 1432	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	53
PID 2980 wrote to memory of 1432	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	53
PID 2980 wrote to memory of 1432	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	53
PID 2980 wrote to memory of 1660	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	55
PID 2980 wrote to memory of 1660	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	55
PID 2980 wrote to memory of 1660	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	55
PID 2980 wrote to memory of 740	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	57
PID 2980 wrote to memory of 740	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	57
PID 2980 wrote to memory of 740	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	57
PID 2980 wrote to memory of 448	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	58
PID 2980 wrote to memory of 448	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	58
PID 2980 wrote to memory of 448	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	58
PID 2980 wrote to memory of 1124	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	59
PID 2980 wrote to memory of 1124	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	59
PID 2980 wrote to memory of 1124	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	59
PID 2980 wrote to memory of 2012	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	60
PID 2980 wrote to memory of 2012	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	60
PID 2980 wrote to memory of 2012	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	60
PID 2980 wrote to memory of 2320	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	61
PID 2980 wrote to memory of 2320	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	61
PID 2980 wrote to memory of 2320	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	61
PID 2980 wrote to memory of 2324	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	62
PID 2980 wrote to memory of 2324	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	62
PID 2980 wrote to memory of 2324	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	62
PID 2980 wrote to memory of 2376	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	63
PID 2980 wrote to memory of 2376	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	63
PID 2980 wrote to memory of 2376	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	63
PID 2980 wrote to memory of 892	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	73
PID 2980 wrote to memory of 892	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	73
PID 2980 wrote to memory of 892	2980	97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe	73
PID 892 wrote to memory of 1620	892	audiodg.exe	74
PID 892 wrote to memory of 1620	892	audiodg.exe	74
PID 892 wrote to memory of 1620	892	audiodg.exe	74
PID 892 wrote to memory of 1628	892	audiodg.exe	75
PID 892 wrote to memory of 1628	892	audiodg.exe	75
PID 892 wrote to memory of 1628	892	audiodg.exe	75
PID 1620 wrote to memory of 2500	1620	WScript.exe	77
PID 1620 wrote to memory of 2500	1620	WScript.exe	77
PID 1620 wrote to memory of 2500	1620	WScript.exe	77
PID 2500 wrote to memory of 1676	2500	audiodg.exe	78
PID 2500 wrote to memory of 1676	2500	audiodg.exe	78
PID 2500 wrote to memory of 1676	2500	audiodg.exe	78
PID 2500 wrote to memory of 2144	2500	audiodg.exe	79
PID 2500 wrote to memory of 2144	2500	audiodg.exe	79
PID 2500 wrote to memory of 2144	2500	audiodg.exe	79
PID 1676 wrote to memory of 664	1676	WScript.exe	80
PID 1676 wrote to memory of 664	1676	WScript.exe	80
PID 1676 wrote to memory of 664	1676	WScript.exe	80
PID 664 wrote to memory of 920	664	audiodg.exe	81
PID 664 wrote to memory of 920	664	audiodg.exe	81
PID 664 wrote to memory of 920	664	audiodg.exe	81
PID 664 wrote to memory of 820	664	audiodg.exe	82
PID 664 wrote to memory of 820	664	audiodg.exe	82
PID 664 wrote to memory of 820	664	audiodg.exe	82
PID 920 wrote to memory of 3044	920	WScript.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe
"C:\Users\Admin\AppData\Local\Temp\97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3eN.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Program Files (x86)\Common Files\System\audiodg.exe
  "C:\Program Files (x86)\Common Files\System\audiodg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f721d7fe-e1c1-4e7f-8775-b73ca08fc48d.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Program Files (x86)\Common Files\System\audiodg.exe
      "C:\Program Files (x86)\Common Files\System\audiodg.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b66b14a-4975-489f-9650-cc5345bb065d.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1676
      - C:\Program Files (x86)\Common Files\System\audiodg.exe
        
        "C:\Program Files (x86)\Common Files\System\audiodg.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2f68f65-bedc-4978-ab71-1594d0518c37.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Program Files (x86)\Common Files\System\audiodg.exe
        
        "C:\Program Files (x86)\Common Files\System\audiodg.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69ecaa36-3f93-4076-9191-ec7756140ab8.vbs"
        9⤵
        
        PID:1768
        
        C:\Program Files (x86)\Common Files\System\audiodg.exe
        
        "C:\Program Files (x86)\Common Files\System\audiodg.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\777ad0a7-851e-4221-a7d4-c8ed253fbe84.vbs"
        11⤵
        
        PID:1512
        
        C:\Program Files (x86)\Common Files\System\audiodg.exe
        
        "C:\Program Files (x86)\Common Files\System\audiodg.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a02ec802-2810-47d7-8bb1-90816e1faa3b.vbs"
        13⤵
        
        PID:2060
        
        C:\Program Files (x86)\Common Files\System\audiodg.exe
        
        "C:\Program Files (x86)\Common Files\System\audiodg.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da590d58-4057-44ab-b4b2-a9aa346b822d.vbs"
        15⤵
        
        PID:2876
        
        C:\Program Files (x86)\Common Files\System\audiodg.exe
        
        "C:\Program Files (x86)\Common Files\System\audiodg.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\859cbbe2-bd84-4fba-aa18-0be37a1ce0ce.vbs"
        17⤵
        
        PID:2496
        
        C:\Program Files (x86)\Common Files\System\audiodg.exe
        
        "C:\Program Files (x86)\Common Files\System\audiodg.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bb4d8a9-69ee-4e0f-902b-b54d815568ef.vbs"
        19⤵
        
        PID:1784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cdea0f60-70ff-4b97-aaaf-7785de91d9f5.vbs"
        19⤵
        
        PID:2456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61eea547-d6ae-41eb-b78e-c3bcd9ff50e9.vbs"
        17⤵
        
        PID:112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26842b14-2a92-4500-9c55-3e5afcbc2db9.vbs"
        15⤵
        
        PID:1660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6e644ea-7f7d-41a7-be3c-6f0133fbb4ae.vbs"
        13⤵
        
        PID:2908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0102c79a-96ce-4067-bbba-4e1b0dd3a043.vbs"
        11⤵
        
        PID:832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61a6e22d-4de1-4d6b-8abc-b12273365036.vbs"
        9⤵
        
        PID:1356
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d9b2137-80eb-4b36-83ed-09eec4543256.vbs"
        7⤵
        
        PID:820
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0cbc561-3c23-44d3-af56-f2c72b68cce9.vbs"
        5⤵
        
        PID:2144
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9afdd6c5-0e1c-4b60-b55a-3bddccd775b9.vbs"
    3⤵
    PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\SpeechEngines\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\SpeechEngines\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\SpeechEngines\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\System\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\System\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\sppsvc.exe

Filesize
1.7MB

MD5
f8d95a8e29563bbdfe9bd258da9b8da0

SHA1
65a0879ce2667b911c2208c29aafaec6be143ac7

SHA256
97e69e5c30e097e9634b010db2332ec53b7f81348d8d0edf429215ed265fda3e

SHA512
7e6e78bf6d5fcc29f3f373a511da1e44a393b5ff9dab787c7935cf815f189abfaca78239b66c156de9cdccbf97f32c2439cf29ca295316e41ee3cc1b7633bdde

Download Submit
C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\services.exe

Filesize
1.7MB

MD5
abd64d554ced835d10c61709f086537a

SHA1
8ebddf8078b57fc077b017866207520620e237d4

SHA256
99d80cda81e7e5017f98eac8f24b48a2c665be53be85bfe9ce8c387c4b7ecba2

SHA512
d865d3a536cbdb861454d666655d5f8456946a77141f995b3c1f5eb9736421a96f478b6240054532d9d0afcda1a955c027c01498bd46f18696c728e290e9c33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b66b14a-4975-489f-9650-cc5345bb065d.vbs

Filesize
730B

MD5
14697defd95d0b10cd694618c5cdf96d

SHA1
5b59ba73bd65303e076d75ea22d5d9008edbac0a

SHA256
eba1dc27d858960b0e354808f147ed6f20865e527e77d0ed1c8de7f741fefc12

SHA512
2b236e7f58bd984c2a05e8962bb927c9f2851ce3a0ac6f26c06500a2cedd0b428747710040758d06421999b7ae0fb2527c04e13de78f1bc82f0f4f9b1e955799

Download Submit
C:\Users\Admin\AppData\Local\Temp\69ecaa36-3f93-4076-9191-ec7756140ab8.vbs

Filesize
730B

MD5
ee7f5ee7e3ee847e9414342aa7bb5a8b

SHA1
35da9fdcaed886ec07d37b49497caa2a45f42489

SHA256
42b14309c556e1a4d789dd7fc01b8337060967b1f5b77fabddd2c555bfe6afe6

SHA512
9439a29225114c140695b9738f0952dc3f55c897e624301dcd4e0f5b56d67884e3c49f7399f1d32e675d6305e5ad6371ba2925653150d36f6ac5957a9256988d

Download Submit
C:\Users\Admin\AppData\Local\Temp\777ad0a7-851e-4221-a7d4-c8ed253fbe84.vbs

Filesize
730B

MD5
98e4b1ce55e230dd0ca921615d2f763d

SHA1
4f9960db1ec43cd87e62d5ce9e6ed58ae4528695

SHA256
1a5cb6afd62d9ce04888c2885ba6cae1f5a6fc762658ab26379998f70c6d310e

SHA512
ca9477ef4cf11c3c21f29405c0f7df044fb0e6ba2ba8cce5556a1c6b590fb527ff1ff41a2bc8c375b64a696a77a94a4c2fe99e6c74f04577dfcdd1cd07b34666

Download Submit
C:\Users\Admin\AppData\Local\Temp\7d3d60c5d7deacb4e9e19d1679c4c2c1842c59c0.exe

Filesize
1.7MB

MD5
bac2e566ba1887f5a7410b8a3823a548

SHA1
b13e5682e4ffebae7dd94b85eed0bbe80a68ac66

SHA256
a6735fbae25053b79cedef8f8a6cabc9451fb834a36e3d4e866758ddf6fff53c

SHA512
aa1fa213825180536678445476d7ea262528924461eeba38743e678cb091231cbca3c7555da3ca4f0b3d77ecd8343a1ffa4398b28bee56726feef2ae2d429e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\859cbbe2-bd84-4fba-aa18-0be37a1ce0ce.vbs

Filesize
729B

MD5
ec51f3c3f84062a7b590c3cac7ff5f0c

SHA1
3510d5097f78feb0682114f4c8f7fc0bff9f3c07

SHA256
534f6acfd87c7b22c5bfbe9891c1179cfa07d895c95f344e7e6e2755f8431767

SHA512
916dc152a04fbfc67e6a79da7722a07f1644f1f919f879c639dc22ad49fc18df7556d7c20c966c93d3d0bda24edea60209f3a654e61ae4be49897d6c7e7703ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\8bb4d8a9-69ee-4e0f-902b-b54d815568ef.vbs

Filesize
730B

MD5
a9435a6d17a46c80a94026e4cd9e8e44

SHA1
8ee07dbb4da2b0136f19d0077408c58b78cc7e68

SHA256
8e6ab6549bf44a0ec85949ecab1410f7fe67e499c12ea42d85decd57bf0480b8

SHA512
e1288ae4c739cd6a46519015a08e61c431ef015db9f041f8bf8fc6e82da9714a1eb141ef2fe9e1443992615d34db3f7bfa4f070d196f8b7e5336f7c32f27737d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9afdd6c5-0e1c-4b60-b55a-3bddccd775b9.vbs

Filesize
506B

MD5
134a5e1eb30cfadba05d6a8d4691d040

SHA1
ae724ae9312e9fac1ca28958b78145ed32833893

SHA256
a805ad832185296f6f1931daa33c6befb73916bbea6af9894ebb305b61d45528

SHA512
bd6a4ed1534f90981721d1efcddbecae90050052b9d8c9ce9a32b826c3fa5edb724c9c498424794114c382f9b99b7983a5036f6131941e78719d5a8c9f4e1f24

Download Submit
C:\Users\Admin\AppData\Local\Temp\a02ec802-2810-47d7-8bb1-90816e1faa3b.vbs

Filesize
730B

MD5
466c1f36ebf75cc50cc36118998d7a7c

SHA1
a84873cbe236bfa298bd7c85965ded715c570efd

SHA256
2fbd35daad5534ac5889138b015fc6abe3e3da38144421f17cfe3ff918a228d6

SHA512
ac8cb1088c99ab4d02ff3917a5b13c0a9dee3d8401490d84dc5a3142c4b22472770ce092fced3a98dd4befda37506ce85097289ea81cd8354cf25f9e79e00a78

Download Submit
C:\Users\Admin\AppData\Local\Temp\da590d58-4057-44ab-b4b2-a9aa346b822d.vbs

Filesize
730B

MD5
693b2f0775a62a3fd1dbf21c10176d7f

SHA1
65218b29c66a4f176e81d465316427c6b4d4b462

SHA256
1f07aaba6b5716eb96514da90ba61c8c45a5bebb7f7269455772ddca0aec57d2

SHA512
c72434adbfa10a250d4aa86a6b48556d9f59668d0e3a310f33a37e1a57e3f55e9de123086c17f324e81202c066b886910d05d54d65bd42a45242389a5ba03edd

Download Submit
C:\Users\Admin\AppData\Local\Temp\f2f68f65-bedc-4978-ab71-1594d0518c37.vbs

Filesize
729B

MD5
d71784145590a1bca76e17c2a49995ac

SHA1
3448611142e98f7565655cbcb09f7659b4fef28b

SHA256
ceb9568701dba61be4e28915f388251856dd9e79d885e6543e62895914b60456

SHA512
52a387162ca9d98b8e959389aac10a4087f2a7573d46844c9a4d33bb21dae65cf440a7bf19d49ce96d87432dc9768fe0cd334c0b0349f8ebcdae11176d2841d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\f721d7fe-e1c1-4e7f-8775-b73ca08fc48d.vbs

Filesize
729B

MD5
e2cb26bec640cd5cf4f88cd16bcfb25f

SHA1
2e028ed50ee07eb220fc4d2ea300e0087eb465fb

SHA256
2bcb3548b2f5f769d3be5823bbe7041e62ea2eec6951cf8dcfea5c135a4cdf9a

SHA512
3cbae6b6212116f7f0df59454c9a462970df63f02060a1fbcf673174775d40e958d42548ebe1d56ccfa94dd406d8cf9913a58e362e43fa3f6996b45a931ed527

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
9cd977f7cef5edc6971c49bd6ab54876

SHA1
ca60e9d9e7fc38bfc5f92778800ea0910a481cc3

SHA256
a0127ddf2174dfd6ad57b3ee75241f004063cffd52462af76a9a5352992c75b8

SHA512
0e9a65742175a9a47cc33b5b4d1858bbe59f49de825294551fb5807da60be489280588c0be38662f17690c2fb8637103d37f56d95714d236493268df62730f55

Download Submit
memory/448-256-0x0000000000230000-0x00000000003F0000-memory.dmp

Filesize
1.8MB

Download
memory/892-176-0x00000000004F0000-0x0000000000502000-memory.dmp

Filesize
72KB

Download
memory/892-129-0x0000000001140000-0x0000000001300000-memory.dmp

Filesize
1.8MB

Download
memory/1432-116-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/1432-117-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/1612-268-0x0000000000950000-0x0000000000B10000-memory.dmp

Filesize
1.8MB

Download
memory/2604-232-0x0000000001000000-0x00000000011C0000-memory.dmp

Filesize
1.8MB

Download
memory/2700-244-0x00000000012F0000-0x00000000014B0000-memory.dmp

Filesize
1.8MB

Download
memory/2972-220-0x00000000003A0000-0x0000000000560000-memory.dmp

Filesize
1.8MB

Download
memory/2980-150-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2980-15-0x00000000007F0000-0x00000000007F8000-memory.dmp

Filesize
32KB

Download
memory/2980-14-0x00000000007E0000-0x00000000007EE000-memory.dmp

Filesize
56KB

Download
memory/2980-13-0x00000000007D0000-0x00000000007DA000-memory.dmp

Filesize
40KB

Download
memory/2980-12-0x00000000007C0000-0x00000000007CC000-memory.dmp

Filesize
48KB

Download
memory/2980-11-0x0000000000790000-0x00000000007A2000-memory.dmp

Filesize
72KB

Download
memory/2980-9-0x0000000000670000-0x0000000000678000-memory.dmp

Filesize
32KB

Download
memory/2980-8-0x0000000000660000-0x000000000066C000-memory.dmp

Filesize
48KB

Download
memory/2980-7-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/2980-20-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2980-6-0x00000000004B0000-0x00000000004C6000-memory.dmp

Filesize
88KB

Download
memory/2980-16-0x0000000000800000-0x000000000080C000-memory.dmp

Filesize
48KB

Download
memory/2980-4-0x0000000000320000-0x0000000000328000-memory.dmp

Filesize
32KB

Download
memory/2980-0-0x000007FEF5883000-0x000007FEF5884000-memory.dmp

Filesize
4KB

Download
memory/2980-5-0x00000000004A0000-0x00000000004B0000-memory.dmp

Filesize
64KB

Download
memory/2980-3-0x0000000000300000-0x000000000031C000-memory.dmp

Filesize
112KB

Download
memory/2980-2-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2980-17-0x0000000000810000-0x000000000081C000-memory.dmp

Filesize
48KB

Download
memory/2980-1-0x0000000000050000-0x0000000000210000-memory.dmp

Filesize
1.8MB

Download