Overview

overview

10

Static

static

10

0bc68db77e...6f.exe

windows7-x64

10

0bc68db77e...6f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-12-2024 02:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0bc68db77e687fa52b2f367994c5bc6f.exe

  • Size

    2.5MB

  • MD5

    0bc68db77e687fa52b2f367994c5bc6f

  • SHA1

    ecf69c28aa53920f6279ad29d5bc9bb02542e841

  • SHA256

    3055d261f05a0656b1b92d9fa8ed3a72111a3a5c6d036d13d3d3a304ca99b987

  • SHA512

    fdb5c57a9a86961e895159543196c9b59c810827d82d7610ab8f9e220125f25c1867eae376c2f2aa1ae19b7899cd746dc18f6a56486cd4449766325a135421a1

  • SSDEEP

    49152:ubA3jUx4QdTmxnMJUh+pDY92IXc3Mx+HqXQJc2cv1TDlHz:ubVdPpDYbNiIP2cvxZHz

Score
10/10
dcratdiscoveryevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 58 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 19 IoCs
    persistence
  • Process spawned unexpected child process 57 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 48 IoCs
    evasiontrojan
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Adds Run key to start application 2 TTPs 38 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 32 IoCs
    evasiontrojan
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 48 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0bc68db77e687fa52b2f367994c5bc6f.exe
    "C:\Users\Admin\AppData\Local\Temp\0bc68db77e687fa52b2f367994c5bc6f.exe"
    1⤵
    • DcRat
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\comSurrogatecontainercomponentRef\4Vp3r4P.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4588
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\comSurrogatecontainercomponentRef\QZY1IZ9a6YLs5.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1104
        • C:\comSurrogatecontainercomponentRef\SavesintoHost.exe
          "C:\comSurrogatecontainercomponentRef\SavesintoHost.exe"
          4⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4800
          • C:\comSurrogatecontainercomponentRef\SavesintoHost.exe
            "C:\comSurrogatecontainercomponentRef\SavesintoHost.exe"
            5⤵
            • Modifies WinLogon for persistence
            • UAC bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3276
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e1o2c1JpZz.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2400
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:3944
                • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                  "C:\Recovery\WindowsRE\OfficeClickToRun.exe"
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:436
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8590b6f5-f6dd-4805-8bea-194ada6cf8a5.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2972
                    • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                      C:\Recovery\WindowsRE\OfficeClickToRun.exe
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4756
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74acfc54-34d7-4ddb-ba45-09aaf95af4ee.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:400
                        • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                          C:\Recovery\WindowsRE\OfficeClickToRun.exe
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:1492
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ab81ed9-f49d-4019-97e5-4957e10d9f56.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:856
                            • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                              C:\Recovery\WindowsRE\OfficeClickToRun.exe
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:2604
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a70acb3-add1-4b07-9eee-6b7f71a2c562.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4732
                                • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                  C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:2680
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4fcf11aa-6a30-45b4-ac86-e254b820455d.vbs"
                                    16⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4068
                                    • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                      C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                      17⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:2288
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05f96f33-efb2-425b-b853-6947b52c1e6a.vbs"
                                        18⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1748
                                        • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                          C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                          19⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:3268
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7933e2be-940d-409f-94a5-55c3a22cf727.vbs"
                                            20⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4200
                                            • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                              C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                              21⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:400
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6588c03-3003-4bff-afc8-395e2799a149.vbs"
                                                22⤵
                                                  PID:2180
                                                  • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                    C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                    23⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:2748
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62ede110-a4dc-4232-b362-d5f2b62c32b5.vbs"
                                                      24⤵
                                                        PID:1668
                                                        • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                          C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                          25⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:4144
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80ff9cf4-144a-41a5-94e9-89eca6a7cb3b.vbs"
                                                            26⤵
                                                              PID:3600
                                                              • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                                C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                                27⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:3324
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96918904-7047-472a-9988-564a3ef003f8.vbs"
                                                                  28⤵
                                                                    PID:4480
                                                                    • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                                      C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                                      29⤵
                                                                      • UAC bypass
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:2876
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04c63d63-a74e-4d05-97c4-09055aa9dec1.vbs"
                                                                        30⤵
                                                                          PID:4448
                                                                          • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                                            C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                                            31⤵
                                                                            • UAC bypass
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • System policy modification
                                                                            PID:2300
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54f0898b-2562-498c-96df-cab99157ce8c.vbs"
                                                                              32⤵
                                                                                PID:856
                                                                                • C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                                                  C:\Recovery\WindowsRE\OfficeClickToRun.exe
                                                                                  33⤵
                                                                                  • UAC bypass
                                                                                  • Executes dropped EXE
                                                                                  • Checks whether UAC is enabled
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • System policy modification
                                                                                  PID:3208
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc3af9c0-ef55-43f4-8709-1dc38dfbfb2d.vbs"
                                                                                    34⤵
                                                                                      PID:4336
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc9aebca-e7d3-4be0-b0ec-b5807c1fa03a.vbs"
                                                                                      34⤵
                                                                                        PID:4008
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c8a3b16-c2c1-4109-ba59-b9f1c8c48d70.vbs"
                                                                                    32⤵
                                                                                      PID:1496
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3699ee93-4ebf-46e4-818d-7c8358806883.vbs"
                                                                                  30⤵
                                                                                    PID:4972
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bcda2aa7-1ee3-4013-bb3b-59cd4f51881e.vbs"
                                                                                28⤵
                                                                                  PID:4564
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\254aee40-5ba0-43dd-b7f0-26e04007433c.vbs"
                                                                              26⤵
                                                                                PID:1084
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f36a063-be09-4118-871f-b0692e9ce5b4.vbs"
                                                                            24⤵
                                                                              PID:4424
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d335502-5c52-4371-a424-75bd52835d62.vbs"
                                                                          22⤵
                                                                            PID:5012
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02d85805-e9d2-4c6a-9874-52a74d39f807.vbs"
                                                                        20⤵
                                                                          PID:4716
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70f5b99c-91ac-40fe-941c-09ca04467823.vbs"
                                                                      18⤵
                                                                        PID:5044
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b3fae8a-e1dc-45b1-8624-8b66306d2356.vbs"
                                                                    16⤵
                                                                      PID:1124
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b87b13f-43e8-4cb4-a773-8431f33e2445.vbs"
                                                                  14⤵
                                                                    PID:1880
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7b99b9b-f91e-4a7b-966a-432673c41128.vbs"
                                                                12⤵
                                                                  PID:1808
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4ec7830-a6ba-4473-8252-5524d4dd3776.vbs"
                                                              10⤵
                                                                PID:3592
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0b63798-bf6f-430a-a345-645effe0907c.vbs"
                                                            8⤵
                                                              PID:4984
                                                • C:\Windows\SysWOW64\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\comSurrogatecontainercomponentRef\file.vbs"
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1992
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3140
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4964
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:228
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\System\ja-JP\sysmon.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2948
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\ja-JP\sysmon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4248
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\System\ja-JP\sysmon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4596
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\comSurrogatecontainercomponentRef\csrss.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1396
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\comSurrogatecontainercomponentRef\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3000
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\comSurrogatecontainercomponentRef\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3220
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-3442511616-637977696-3186306149-1000\spoolsv.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2436
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-3442511616-637977696-3186306149-1000\spoolsv.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4752
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-3442511616-637977696-3186306149-1000\spoolsv.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2860
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\explorer.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1928
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:5028
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3516
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4872
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1524
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1200
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "SavesintoHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\SavesintoHost.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4344
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "SavesintoHost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\SavesintoHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:400
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "SavesintoHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\SavesintoHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2000
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Idle.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4056
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3320
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4476
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3196
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3644
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:756
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\comSurrogatecontainercomponentRef\winlogon.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1164
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\comSurrogatecontainercomponentRef\winlogon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4636
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\comSurrogatecontainercomponentRef\winlogon.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4940
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2336
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4040
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RuntimeBroker.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3744
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\spoolsv.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3996
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\spoolsv.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1492
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\spoolsv.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3456
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\IMEKR\smss.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2360
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\IME\IMEKR\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4652
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\IMEKR\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4656
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\comSurrogatecontainercomponentRef\taskhostw.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:5080
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\comSurrogatecontainercomponentRef\taskhostw.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:372
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\comSurrogatecontainercomponentRef\taskhostw.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2396
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\TextInputHost.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2284
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:732
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1680
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4808
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2388
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4388
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\comSurrogatecontainercomponentRef\Idle.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:672
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\comSurrogatecontainercomponentRef\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4928
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\comSurrogatecontainercomponentRef\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2944
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2604
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2080
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3584
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\WmiPrvSE.exe'" /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2180
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\WmiPrvSE.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1936
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\WmiPrvSE.exe'" /rl HIGHEST /f
                                                1⤵
                                                • DcRat
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:4392

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Winlogon Helper DLL

                                              1
                                              T1547.004

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Privilege Escalation

                                              Abuse Elevation Control Mechanism

                                              1
                                              T1548

                                              Bypass User Account Control

                                              1
                                              T1548.002

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Winlogon Helper DLL

                                              1
                                              T1547.004

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Defense Evasion

                                              Abuse Elevation Control Mechanism

                                              1
                                              T1548

                                              Bypass User Account Control

                                              1
                                              T1548.002

                                              Impair Defenses

                                              1
                                              T1562

                                              Disable or Modify Tools

                                              1
                                              T1562.001

                                              Modify Registry

                                              4
                                              T1112

                                              Credential Access

                                              Discovery

                                              Query Registry

                                              2
                                              T1012

                                              System Information Discovery

                                              3
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              Lateral Movement

                                              Collection

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Recovery\WindowsRE\22eafd247d37c3
                                                Filesize

                                                842B

                                                MD5

                                                af78c11b42bf09d38843ddfbc4057371

                                                SHA1

                                                d4ee2ac46153eb4d174f6d67e82a46292492ee24

                                                SHA256

                                                2c286dbdbaf683f52e65ab0e7c5419892d253e61590bf925a6c9d983ba51d63d

                                                SHA512

                                                9502221391ca09ec27d398f565660724a8cd52cc24ff70df2c2c05ca46788ba8f72e7eff4ed5fb31dd96244f0dc16879e1007951ae294c4ce49fffc3bde280aa

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OfficeClickToRun.exe.log
                                                Filesize

                                                1KB

                                                MD5

                                                49b64127208271d8f797256057d0b006

                                                SHA1

                                                b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                                                SHA256

                                                2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                                                SHA512

                                                f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SavesintoHost.exe.log
                                                Filesize

                                                1KB

                                                MD5

                                                655010c15ea0ca05a6e5ddcd84986b98

                                                SHA1

                                                120bf7e516aeed462c07625fbfcdab5124ad05d3

                                                SHA256

                                                2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14

                                                SHA512

                                                e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\04c63d63-a74e-4d05-97c4-09055aa9dec1.vbs
                                                Filesize

                                                718B

                                                MD5

                                                ee8cba88d4b8f28e2b81c8279774f0cd

                                                SHA1

                                                195f956daa44f195ba5509d632f4488983910811

                                                SHA256

                                                a36039e98be53a9be919ff808f7f7dea951140d20d4d3f8dd8b0f91162ab6130

                                                SHA512

                                                fdd5afd4ccf6c377fcb011c77e52d52613bc69f4daf22455ecd1a4df3d6d60229f30f84351ff099c9a4f46ae938ebf43d075ffcb30f0897836cb21c0fcf7f880

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\05f96f33-efb2-425b-b853-6947b52c1e6a.vbs
                                                Filesize

                                                718B

                                                MD5

                                                426eb71e0460aa1e19d3d407e14e66a4

                                                SHA1

                                                a87dfd060a0f2080a8be5b87fa3e8d305fee12a8

                                                SHA256

                                                ff87b3c943bc1fcc0d338921e7b1f8702b6056fcea397318711daaabc1419b67

                                                SHA512

                                                5828a12a56066d2b9ddb7286cd7c488861f70fd05b05ddf299d4c05da53dfd84defda687589d616eead296ceed86ca85ef0ecaed78ad42eac75082180f6a301b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\39d4f26cbef86018a0c8b03b05652f8dcef8e2f0.exe
                                                Filesize

                                                2.2MB

                                                MD5

                                                ab1c6b008870531b6c4de136962b5716

                                                SHA1

                                                6b6bdcfe3d4efa006148652bc7efef584ac8a7cc

                                                SHA256

                                                bcdd7572587a9f9d5d56eb5d6f8e76fffb852e42b78425de3fb0d53c1ac9630e

                                                SHA512

                                                bb859f0e45c4cc2f6189b02521d0dba4b11998e1560896cd32e455d581d114c5d63bef3e9bb464ff8a602f970daecec838a7e6e804282391278f229c691df9a4

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\4fcf11aa-6a30-45b4-ac86-e254b820455d.vbs
                                                Filesize

                                                718B

                                                MD5

                                                daa4d8fbc4c11168ff53ebe43e8012f7

                                                SHA1

                                                410b66b8ee12980607840430e8d61583ea7f353d

                                                SHA256

                                                c2f17605c61f658fbddc653b5e1a0dd0cee7cfd777356f7772c859482c443cf8

                                                SHA512

                                                69fbcf48cf3af24e611b74102a939e87f892edd3537b12342e6a9dd12fc6523cb3f7086c7d73f6de768aa0d0e48be405cb05ea737e32e343a0b06f4f749cafd5

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\54f0898b-2562-498c-96df-cab99157ce8c.vbs
                                                Filesize

                                                718B

                                                MD5

                                                f7bbe07284e6ac5ca3a3e401514803d8

                                                SHA1

                                                ebe4446224efa345b11f3b079c9e564bfa2b674b

                                                SHA256

                                                dc556a249c9c71b15d0e09c85b6133e916dedd7980f419cb057e8cee33d14d26

                                                SHA512

                                                e5e112ad26765e217af6c7cdb62453b6b4dfbf38cc5e1a60159cc08e24da92f6a6f447b78a1035c16d56343d64144eb3b127648a1bcc0736db88ede80cec921c

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\62ede110-a4dc-4232-b362-d5f2b62c32b5.vbs
                                                Filesize

                                                718B

                                                MD5

                                                219cb49c10b1359125263d7a606a9f5c

                                                SHA1

                                                85ca987ba6fcd2e2ce4d43cced9c71c0b7fce519

                                                SHA256

                                                0c858cb49172e55c2b8db52c6515ecbf05007105a069600941100898e8a0864e

                                                SHA512

                                                14baf2d88fd023b49b73a50a488f0b69df9cff1aefcceaf05b69d8fbaf7f69f6700c9ffc5a4958096bcbc7750c817defc6036357bb8aa7c07a4731039b38e272

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\74acfc54-34d7-4ddb-ba45-09aaf95af4ee.vbs
                                                Filesize

                                                718B

                                                MD5

                                                efbd8ada08e1ea80fa9fd0c45f3ded80

                                                SHA1

                                                96ea42d466578cf5525069fa1b5b01fd3a94625a

                                                SHA256

                                                f64c575182dedd934ab2b2e67a51abb467ae9c47ba033c8b5be648754c672b71

                                                SHA512

                                                d73d7795ee9dda747120d60204b62c9573b7f826b714033d3279b9157242563996ae6764ae0eb636166ca78676ee142424c3639babe30d215b894e494fde2e86

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\7933e2be-940d-409f-94a5-55c3a22cf727.vbs
                                                Filesize

                                                718B

                                                MD5

                                                21c51d408b1a98f4cfd1131eca77b842

                                                SHA1

                                                60e8c34739a647c23e00d1a73b0ddc8b981e55bc

                                                SHA256

                                                8415d18a387ab7f7410bfe60ecb579eac912f227fda3f622434b796af7a75a9d

                                                SHA512

                                                1e5d93402fdd17294edb39c2925416222da650fad2c46c418328165ce4984a13055d7db741b16b8f77eb1a99f6d74d2d244181d7e3cca3666c974942536647d8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\80ff9cf4-144a-41a5-94e9-89eca6a7cb3b.vbs
                                                Filesize

                                                718B

                                                MD5

                                                963847708425fb03afea03aac1c23f58

                                                SHA1

                                                a50d61dbf2a7eacca0b3ba52a4e57a74ad8044ef

                                                SHA256

                                                59830b5ec511d78d8823fa9e83db31c1e252ce62617fc2bd9af680273932b14c

                                                SHA512

                                                e8fc4c550b9e70e477be0e00296baf410a1901124c8527eaf69e138113ee29efdcfbd3fd64c884a91cc55e7c618372f280faffe584350edbaf91ac9ce2a2d03c

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\8590b6f5-f6dd-4805-8bea-194ada6cf8a5.vbs
                                                Filesize

                                                717B

                                                MD5

                                                abdbf06cd124e61117e92e1a0b66e4fa

                                                SHA1

                                                5d42eb817ddd30c6313970ea9b4e860540933bb2

                                                SHA256

                                                8e16b14bf6e7cd5ddc61c0dba121551c2861f6365c964da59befe8cc18f71d0f

                                                SHA512

                                                d083d0a44730bef095af8f1f6fbe2a09f9077a57b0370b32858f9fb806aef66a0f899ed3fbd9f425ab1d633787969748b6b5fbe0b60050db9e09adcc03b85454

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\8a70acb3-add1-4b07-9eee-6b7f71a2c562.vbs
                                                Filesize

                                                718B

                                                MD5

                                                683f947cac89e72491c68850b80a8d76

                                                SHA1

                                                933e35aa90fefe3a5ca8e03283ef8ca28390cb61

                                                SHA256

                                                55f9c4f5dbd3a8a54f492ac5405cae641228957dfdf26da173c554a52c00542d

                                                SHA512

                                                b17c842b387867b7041beb311953812d5c7928c1aa7b1a3cdd67b9c5e9d67b9d695dbdb12e06aea9b81709794264188543def17d68ca0693bbd5991eef909672

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\96918904-7047-472a-9988-564a3ef003f8.vbs
                                                Filesize

                                                718B

                                                MD5

                                                cee31ffa554a3f010938435e7fa31896

                                                SHA1

                                                79a5ac05a78b90435141a12850dfdd9e396aecfa

                                                SHA256

                                                dcd2f8d043972bd0646ab7606d82a8c401f08a2bea097e5458d9ad65666adfcc

                                                SHA512

                                                58f78d6fcabe5c5d4909b3cbd9450331dd6a15e4254aeb5f1a84537086139371832ff8e18818bca370db8fb9df1a5f301fdae266d3b4bceb8169329c3d22c82c

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\9ab81ed9-f49d-4019-97e5-4957e10d9f56.vbs
                                                Filesize

                                                718B

                                                MD5

                                                c78b04c77c6d3f0f458552810da65a2c

                                                SHA1

                                                380cc47e08a03b7619bf0dc90b00e930aefaec5e

                                                SHA256

                                                927f9e044ee230ab081832b1f8d65d3cd21e7cf7f89523437fd62c4c7ca68e2c

                                                SHA512

                                                085cb3dabf8b92013cec451cdae4428fbfa856cdccb8e0ec1d8ec87769655c7d71d6a74ccbf475cfaef1d82869ec720c180524be56524912739cce1cbdf720f2

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\b0b63798-bf6f-430a-a345-645effe0907c.vbs
                                                Filesize

                                                494B

                                                MD5

                                                b6c79a02e963bb66df7cb5fdf5b953ff

                                                SHA1

                                                de7bb234bb0393e7327fc699b1a0920dace793d1

                                                SHA256

                                                c4d51b656247b6afbba38050ac1b85d5d7cbb96592c582361dbee0417a2fdbd6

                                                SHA512

                                                acca3fde5f2758090cdf22cf9fe2bb8f1db0fe1c09674a04e7fc44556c2d7276b749861858126118c1c59ac202c6dfbce2c62a1a95debb02463207d808efe692

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\e1o2c1JpZz.bat
                                                Filesize

                                                207B

                                                MD5

                                                aedc134013cc5836bd898342bb8a0b44

                                                SHA1

                                                ec632af838a61a3a66296b2bbc4a2ba886915b22

                                                SHA256

                                                fff4ad2553d5d87cd309d04f0c17857107df79508ad8dfe190947e13f3cfd5e2

                                                SHA512

                                                88442ff855e697c41b46bb92e4b2e8fc955748a51743429fdb515d96c055d1b222db2b19eae641634873108f5dfed51d44a453cd4694df9937d3634c28c91b8d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\f6588c03-3003-4bff-afc8-395e2799a149.vbs
                                                Filesize

                                                717B

                                                MD5

                                                df4b33feefdca5b97c820726fa37c4bf

                                                SHA1

                                                7cd40bf533f4ac2bf60f9e0141fc977dcc197b16

                                                SHA256

                                                9374d520fe91354e93615ed1a33b5ce08a9d5a172056feff88732fa03598a8cc

                                                SHA512

                                                1c65da9d5fd390d4779280b5249b733975d669c74e3a54d34ffd7933aab60224cc006c6b0b7c4f825d52a4ebffd5de6e1546be845ff19b9b32cffa834903f59f

                                                Download Submit

                                              • C:\comSurrogatecontainercomponentRef\4Vp3r4P.vbe
                                                Filesize

                                                223B

                                                MD5

                                                5d646684debbc53c0c7ec5fa65f23216

                                                SHA1

                                                c161dec715fcc4156442fc30eaf6b3d0caddfb17

                                                SHA256

                                                cddd4a030f867acb39a0e7697732cbd57bb2e5e9f0d81fc1e7d752d57c1ee195

                                                SHA512

                                                e6518ff37848e7e92d9b820b3eecea2a0d0d85fd6804a8b4f4adf56154aa1a1d5433c3333d469bc8e2ffb9f4ebb4445f979467f970f9155774a670fe5446c19a

                                                Download Submit

                                              • C:\comSurrogatecontainercomponentRef\QZY1IZ9a6YLs5.bat
                                                Filesize

                                                56B

                                                MD5

                                                cbba91293fed3dfb5a3a0cd0ec53b505

                                                SHA1

                                                6d66eaa19e366c386d006b8b782cda171c359c43

                                                SHA256

                                                062cff19b7be8c7d9c9941f75b9225982eb3799a766ee73659251f7d0c0b299d

                                                SHA512

                                                a97640da0d86256b3512d84c9a5120e41cb7ed47f3a61f8f4f6212804034a8e19a99fc35a3b91804734c93279b74b23737e31e224152d3e6a17e113fd4bca0f4

                                                Download Submit

                                              • C:\comSurrogatecontainercomponentRef\SavesintoHost.exe
                                                Filesize

                                                2.2MB

                                                MD5

                                                3aa1bbd17d68b0b67b7423f1fe09b05b

                                                SHA1

                                                61c43b8f31a51d772fd39d5caa87699d74971a43

                                                SHA256

                                                7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474

                                                SHA512

                                                7ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014

                                                Download Submit

                                              • C:\comSurrogatecontainercomponentRef\file.vbs
                                                Filesize

                                                34B

                                                MD5

                                                677cc4360477c72cb0ce00406a949c61

                                                SHA1

                                                b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

                                                SHA256

                                                f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

                                                SHA512

                                                7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

                                                Download Submit

                                              • memory/2300-238-0x000000001B780000-0x000000001B792000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2748-192-0x00000000030C0000-0x00000000030D2000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/3276-58-0x000000001B7D0000-0x000000001B7E2000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/3324-215-0x000000001B540000-0x000000001B552000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/4800-28-0x00000000027C0000-0x00000000027C8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-34-0x000000001AFF0000-0x000000001AFF8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-42-0x000000001B070000-0x000000001B07C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/4800-43-0x000000001B080000-0x000000001B08A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/4800-44-0x000000001B090000-0x000000001B09E000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/4800-47-0x000000001BBD0000-0x000000001BBDC000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/4800-46-0x000000001B0B0000-0x000000001B0B8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-45-0x000000001B0A0000-0x000000001B0A8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-48-0x000000001BBE0000-0x000000001BBE8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-49-0x000000001BD00000-0x000000001BD0A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/4800-50-0x000000001BC00000-0x000000001BC0C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/4800-40-0x000000001B060000-0x000000001B06C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/4800-39-0x000000001B050000-0x000000001B05C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/4800-38-0x000000001B040000-0x000000001B048000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-37-0x000000001B030000-0x000000001B03C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/4800-36-0x000000001BF00000-0x000000001C428000-memory.dmp

                                                Filesize

                                                5.2MB

                                                Download

                                              • memory/4800-35-0x000000001B000000-0x000000001B012000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/4800-41-0x000000001BBF0000-0x000000001BBF8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-33-0x000000001AFE0000-0x000000001AFEC000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/4800-32-0x000000001AFD0000-0x000000001AFD8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-31-0x00000000027F0000-0x00000000027FC000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/4800-30-0x00000000027E0000-0x00000000027EA000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/4800-29-0x00000000027D0000-0x00000000027E0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/4800-27-0x0000000002750000-0x000000000275C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/4800-26-0x0000000002760000-0x0000000002772000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/4800-25-0x0000000002740000-0x0000000002748000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-24-0x0000000002720000-0x0000000002736000-memory.dmp

                                                Filesize

                                                88KB

                                                Download

                                              • memory/4800-23-0x00000000025F0000-0x0000000002600000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/4800-22-0x00000000025E0000-0x00000000025E8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-21-0x0000000002770000-0x00000000027C0000-memory.dmp

                                                Filesize

                                                320KB

                                                Download

                                              • memory/4800-20-0x00000000025C0000-0x00000000025DC000-memory.dmp

                                                Filesize

                                                112KB

                                                Download

                                              • memory/4800-19-0x00000000025B0000-0x00000000025B8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/4800-18-0x00000000025A0000-0x00000000025AE000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/4800-17-0x0000000000250000-0x000000000048E000-memory.dmp

                                                Filesize

                                                2.2MB

                                                Download