dcrat | e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
Size

1.7MB
MD5

d337a1cc8b6b0d9f1c16ec727b3197e2
SHA1

01dbeb18baa4efb70b3a30930e08d89e2e25c05a
SHA256

e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345
SHA512

d20493b21aceb61d5e8c49afa8cd0cdd14234b9b3d94d4f8af92f0b64cb4542fc154cd29339b1f56abae14c97b752f8f6b81d6e86e301c3576117fa510879285
SSDEEP

49152:z+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKvV:eTHUxUoh1IF9gl2e

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	3676	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	3676	schtasks.exe	83

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1336-1-0x0000000000420000-0x00000000005E0000-memory.dmp	dcrat
behavioral2/files/0x000b000000023b7b-32.dat	dcrat
behavioral2/files/0x000c000000023b7b-41.dat	dcrat
behavioral2/files/0x000d000000023b6d-52.dat	dcrat
behavioral2/memory/116-227-0x00000000001A0000-0x0000000000360000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3696	powershell.exe
2380	powershell.exe
2036	powershell.exe
3120	powershell.exe
4756	powershell.exe
2472	powershell.exe
2572	powershell.exe
4996	powershell.exe
3536	powershell.exe
1960	powershell.exe
3612	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MusNotification.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MusNotification.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MusNotification.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MusNotification.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MusNotification.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MusNotification.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MusNotification.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MusNotification.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MusNotification.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	MusNotification.exe

Executes dropped EXE 10 IoCs

pid	Process
116	MusNotification.exe
3052	MusNotification.exe
4756	MusNotification.exe
692	MusNotification.exe
2908	MusNotification.exe
2296	MusNotification.exe
1404	MusNotification.exe
4936	MusNotification.exe
1492	MusNotification.exe
1020	MusNotification.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	MusNotification.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	MusNotification.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	MusNotification.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	MusNotification.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	MusNotification.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	MusNotification.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	MusNotification.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	MusNotification.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	MusNotification.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	MusNotification.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2940	schtasks.exe
2184	schtasks.exe
752	schtasks.exe
1224	schtasks.exe
2764	schtasks.exe
2636	schtasks.exe
3100	schtasks.exe
2468	schtasks.exe
4448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
2572	powershell.exe
2572	powershell.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1960	powershell.exe
1960	powershell.exe
2036	powershell.exe
2036	powershell.exe
3696	powershell.exe
3696	powershell.exe
3612	powershell.exe
3612	powershell.exe
4996	powershell.exe
4996	powershell.exe
4756	powershell.exe
4756	powershell.exe
2472	powershell.exe
2472	powershell.exe
3536	powershell.exe
3536	powershell.exe
2380	powershell.exe
2380	powershell.exe
3120	powershell.exe
3120	powershell.exe
2380	powershell.exe
3536	powershell.exe
2572	powershell.exe
2036	powershell.exe
1960	powershell.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
3696	powershell.exe
4756	powershell.exe
2472	powershell.exe
4996	powershell.exe
3612	powershell.exe
3120	powershell.exe
1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
116	MusNotification.exe
116	MusNotification.exe
116	MusNotification.exe
116	MusNotification.exe
116	MusNotification.exe
116	MusNotification.exe
116	MusNotification.exe
116	MusNotification.exe
116	MusNotification.exe
116	MusNotification.exe
116	MusNotification.exe
116	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	116	MusNotification.exe
Token: SeDebugPrivilege	3052	MusNotification.exe
Token: SeDebugPrivilege	4756	MusNotification.exe
Token: SeDebugPrivilege	692	MusNotification.exe
Token: SeDebugPrivilege	2908	MusNotification.exe
Token: SeDebugPrivilege	2296	MusNotification.exe
Token: SeDebugPrivilege	1404	MusNotification.exe
Token: SeDebugPrivilege	4936	MusNotification.exe
Token: SeDebugPrivilege	1492	MusNotification.exe
Token: SeDebugPrivilege	1020	MusNotification.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 3120	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	94
PID 1336 wrote to memory of 3120	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	94
PID 1336 wrote to memory of 1960	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	95
PID 1336 wrote to memory of 1960	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	95
PID 1336 wrote to memory of 3612	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	96
PID 1336 wrote to memory of 3612	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	96
PID 1336 wrote to memory of 2572	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	97
PID 1336 wrote to memory of 2572	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	97
PID 1336 wrote to memory of 2472	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	98
PID 1336 wrote to memory of 2472	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	98
PID 1336 wrote to memory of 2036	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	100
PID 1336 wrote to memory of 2036	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	100
PID 1336 wrote to memory of 3536	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	103
PID 1336 wrote to memory of 3536	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	103
PID 1336 wrote to memory of 2380	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	104
PID 1336 wrote to memory of 2380	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	104
PID 1336 wrote to memory of 3696	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	105
PID 1336 wrote to memory of 3696	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	105
PID 1336 wrote to memory of 4756	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	106
PID 1336 wrote to memory of 4756	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	106
PID 1336 wrote to memory of 4996	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	107
PID 1336 wrote to memory of 4996	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	107
PID 1336 wrote to memory of 116	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	116
PID 1336 wrote to memory of 116	1336	e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe	116
PID 116 wrote to memory of 228	116	MusNotification.exe	118
PID 116 wrote to memory of 228	116	MusNotification.exe	118
PID 116 wrote to memory of 4664	116	MusNotification.exe	119
PID 116 wrote to memory of 4664	116	MusNotification.exe	119
PID 228 wrote to memory of 3052	228	WScript.exe	131
PID 228 wrote to memory of 3052	228	WScript.exe	131
PID 3052 wrote to memory of 4824	3052	MusNotification.exe	133
PID 3052 wrote to memory of 4824	3052	MusNotification.exe	133
PID 3052 wrote to memory of 1480	3052	MusNotification.exe	134
PID 3052 wrote to memory of 1480	3052	MusNotification.exe	134
PID 4824 wrote to memory of 4756	4824	WScript.exe	135
PID 4824 wrote to memory of 4756	4824	WScript.exe	135
PID 4756 wrote to memory of 1632	4756	MusNotification.exe	139
PID 4756 wrote to memory of 1632	4756	MusNotification.exe	139
PID 4756 wrote to memory of 3120	4756	MusNotification.exe	140
PID 4756 wrote to memory of 3120	4756	MusNotification.exe	140
PID 1632 wrote to memory of 692	1632	WScript.exe	142
PID 1632 wrote to memory of 692	1632	WScript.exe	142
PID 692 wrote to memory of 2924	692	MusNotification.exe	144
PID 692 wrote to memory of 2924	692	MusNotification.exe	144
PID 692 wrote to memory of 4152	692	MusNotification.exe	145
PID 692 wrote to memory of 4152	692	MusNotification.exe	145
PID 2924 wrote to memory of 2908	2924	WScript.exe	148
PID 2924 wrote to memory of 2908	2924	WScript.exe	148
PID 2908 wrote to memory of 212	2908	MusNotification.exe	150
PID 2908 wrote to memory of 212	2908	MusNotification.exe	150
PID 2908 wrote to memory of 464	2908	MusNotification.exe	151
PID 2908 wrote to memory of 464	2908	MusNotification.exe	151
PID 212 wrote to memory of 2296	212	WScript.exe	152
PID 212 wrote to memory of 2296	212	WScript.exe	152
PID 2296 wrote to memory of 1092	2296	MusNotification.exe	154
PID 2296 wrote to memory of 1092	2296	MusNotification.exe	154
PID 2296 wrote to memory of 2292	2296	MusNotification.exe	155
PID 2296 wrote to memory of 2292	2296	MusNotification.exe	155
PID 1092 wrote to memory of 1404	1092	WScript.exe	156
PID 1092 wrote to memory of 1404	1092	WScript.exe	156
PID 1404 wrote to memory of 2256	1404	MusNotification.exe	158
PID 1404 wrote to memory of 2256	1404	MusNotification.exe	158
PID 1404 wrote to memory of 2252	1404	MusNotification.exe	159
PID 1404 wrote to memory of 2252	1404	MusNotification.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe
"C:\Users\Admin\AppData\Local\Temp\e218369280704cdfefe3390d90b8f1918dd4c215879b6ad12f1fee1b40550345.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Users\Default\MusNotification.exe
  "C:\Users\Default\MusNotification.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2856403-1724-4619-b91a-393ed8e320e5.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Users\Default\MusNotification.exe
      C:\Users\Default\MusNotification.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55581fde-8edd-4e9a-95f1-e716cca58b1c.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4824
      - C:\Users\Default\MusNotification.exe
        
        C:\Users\Default\MusNotification.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27d06191-442b-4bb0-b818-12a5cdd7e6c0.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Users\Default\MusNotification.exe
        
        C:\Users\Default\MusNotification.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\285d51e8-2e6c-44cd-862b-b6a44bcde8b1.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Users\Default\MusNotification.exe
        
        C:\Users\Default\MusNotification.exe
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72e45e0b-0421-4268-8dce-c9ae304f3b6c.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Users\Default\MusNotification.exe
        
        C:\Users\Default\MusNotification.exe
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e899804-692c-43c8-a5b0-96eb1e059033.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Users\Default\MusNotification.exe
        
        C:\Users\Default\MusNotification.exe
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e18167b1-d830-4d80-8e0c-4371efe2c5a1.vbs"
        15⤵
        
        PID:2256
        
        C:\Users\Default\MusNotification.exe
        
        C:\Users\Default\MusNotification.exe
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89fac1ee-b77d-45e5-a0b4-02f16c2e272a.vbs"
        17⤵
        
        PID:2980
        
        C:\Users\Default\MusNotification.exe
        
        C:\Users\Default\MusNotification.exe
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2da65a5e-ad51-45ca-aa49-d1a407b5ada8.vbs"
        19⤵
        
        PID:3308
        
        C:\Users\Default\MusNotification.exe
        
        C:\Users\Default\MusNotification.exe
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a4e9b98-d2c3-41b7-bd8b-b983e4199c10.vbs"
        21⤵
        
        PID:3612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6575d3f-49fd-4d2a-8cfa-1a2750450f41.vbs"
        21⤵
        
        PID:4544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\304116c5-1038-47e0-b521-0ed43a3709ac.vbs"
        19⤵
        
        PID:2548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f803d717-502b-452c-aa7d-ddf9869a33e2.vbs"
        17⤵
        
        PID:996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2529975f-41fa-4b79-bcb8-f20324d0b675.vbs"
        15⤵
        
        PID:2252
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1677e5db-7953-43b1-9612-0b439f973faa.vbs"
        13⤵
        
        PID:2292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b72e932f-b216-42ee-9468-f67e45de0392.vbs"
        11⤵
        
        PID:464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cce4cae1-2851-4c2a-912f-2e2988abdb67.vbs"
        9⤵
        
        PID:4152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\693afa99-b748-4477-98fb-58f9ecba806b.vbs"
        7⤵
        
        PID:3120
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0987d44-c742-4bf0-82c8-52d7ea914894.vbs"
        5⤵
        
        PID:1480
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8ea8e62-2156-4912-8265-b1f519c1061e.vbs"
    3⤵
    PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 7 /tr "'C:\Users\Default\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Users\Default\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 13 /tr "'C:\Users\Default\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Application Data\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Application Data\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\sysmon.exe

Filesize
1.7MB

MD5
39c21f686343e62298e2cbc61e694ed4

SHA1
b4cd7b6e080b6ba91b198858bbd65bc377c2d8e6

SHA256
b7de563490c83e0f5848af8e63d14b3fff68fd18076c85e7b01e0a90b2825332

SHA512
cbf7d92819d7513092edd5ad9f36eee34e703098c9a5c4aede0e882a2138ebc8903c00cc5d16d9f463342c763be373fb9b734657f3832b272f680778502fa47b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MusNotification.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e899804-692c-43c8-a5b0-96eb1e059033.vbs

Filesize
712B

MD5
ba7af1ec3ec71e73880eacae214fe303

SHA1
20cf53542f7b7c5860b90afb87919c7f2bd61f23

SHA256
6a450a0217fdc8473dc7416e8f7b19722179c5481daa2abd5dca7102aaadfdba

SHA512
fa9787cebecf9d30f14a91d8bd2cf22419e06dcabaa11f4ea3228d6c55d162014afcd019843c0bbb659270c5b3193de42ee34efa288d56ef20d61783c37ff9ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\27d06191-442b-4bb0-b818-12a5cdd7e6c0.vbs

Filesize
712B

MD5
9614426a4c67222c4a72303105733b48

SHA1
09426cfb150299f3173f5a3dd2d07edb4c0277de

SHA256
0e7fb1151088bc0cd5289450fb142c00c9c0c57baf569622e0c24909c6ec1dfd

SHA512
e2925db723d60de4cd9b1534b76b071bcaf83b6041271eef734dc76a859643f61b2efed85aeb17a606d5bf770a5b52ea03e5cc659ff1070bef2e10a17b32eb7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\285d51e8-2e6c-44cd-862b-b6a44bcde8b1.vbs

Filesize
711B

MD5
6c077f24c2e1b2c06821f0dd0ce463dd

SHA1
b5d2cdc60c9453c7d545270149c84dac56b4e412

SHA256
3ad033c78fd95d23e4dc5ad4f9aad092e0a3002e648e2c19b2c3bb5e1edadf3b

SHA512
59e3d61479a14190244fbb0308ff128ded9a99bb8b96e7ae27fb860e92c52adf9a24173eee8465c672a1d4ed3e017e1fb5551e2124dd5566e3d11b7297c9e2d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2da65a5e-ad51-45ca-aa49-d1a407b5ada8.vbs

Filesize
712B

MD5
79c570ef6e517c6051dc2ae3da36b9ed

SHA1
6714cceef501635579072a553bdf06a3310ae1cd

SHA256
698d5858711eb26a0e449dcbd7756489330401098130c483db089520965f814b

SHA512
cfe187900d4a736013b4f36598db1562e59e18f004d8f0bcb1eb16d0b838e008548a1252a1d9839021efd579129179fa9bf6743d9e4537f6ce1cfcfbdf08f398

Download Submit
C:\Users\Admin\AppData\Local\Temp\3a4e9b98-d2c3-41b7-bd8b-b983e4199c10.vbs

Filesize
712B

MD5
e26d2ca5c59524ba65051938b9b5aa33

SHA1
fbd76b31f4ef168982a0d27656efe55460831de5

SHA256
36c36cd905df47eca2e2b916348fa988f8870b142472da854b96dd3931950ebf

SHA512
4bbe59a41cb8ec9aa0ba40882bba0c6f09e164cb4afb46d0a30331f5a2ed920c6ec61154d6ef1761aaec71cc991bcd29a9a4822f8535a909c2f67a25608d88dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\55581fde-8edd-4e9a-95f1-e716cca58b1c.vbs

Filesize
712B

MD5
5703ef2d39bc108b853f1f6f486b8153

SHA1
fed0f00c969df79a8753950ec24780a32943ef49

SHA256
69e4351d73717feab9aa23334ae2dbc9e4b4c9c89e270cbc2f8305a7affcc442

SHA512
e1895054eaa0ffd876c237e20d8009c8301c789bb7c4727581b90f40bab13f3a61836972a579b2881ae3d8b4bc0fe0d5af453f6459cb928c3119f9f250ad6554

Download Submit
C:\Users\Admin\AppData\Local\Temp\72e45e0b-0421-4268-8dce-c9ae304f3b6c.vbs

Filesize
712B

MD5
ce53469159febd924cc1f4e9042ee728

SHA1
8c9f106c363126522d19960e8d41bb93a307a11b

SHA256
c40f0bfcba1f6859b125a5701a167b5927b7013f8078bbbf70adbf4831d9965a

SHA512
d19e96368bd2592fda66f244c62f9f590a3d6432b78854a8ea1f3e8f2d2b0a7b06c7da6bf7aac054c1dd8f00c8cb6f48f06a9270bcf37d5d75386e3919d14560

Download Submit
C:\Users\Admin\AppData\Local\Temp\89fac1ee-b77d-45e5-a0b4-02f16c2e272a.vbs

Filesize
712B

MD5
e7e9e958e8188a55615ceb464f189524

SHA1
fdadb06a646225c02a5adec7ec85e76d0b537a53

SHA256
fabf424f6a1684ac7bd6b71a1e4b11a61b724342efe9aa89db0beeabd1308342

SHA512
92c15dde4b8f0b7528b6ba4a4c29c04097cb05f9792bed701deb94e522dffd5dc5e74d13de60bfdb581c61c456b173534c11bfbe01ffc205b6c4c123bb528562

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCX9319.tmp

Filesize
1.7MB

MD5
9d6fd4119977f8cbcc627015ec074b70

SHA1
3a08d83ca46e9ecbf3fd883b63937ea794aef410

SHA256
7ab53d9063a99fe6b38d630bc1c7bc333827d3db4bef404881208c95f4397cea

SHA512
8d68579ad5299a5f9a57d535e749606dd21851c1fa670fa0820efc21d431d25ea6977c54a3cdea9f243663852a6043c988848cc73748b85473509d09fa2f7760

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g2xc03r1.fok.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e18167b1-d830-4d80-8e0c-4371efe2c5a1.vbs

Filesize
712B

MD5
eb2b06ca1c781654295722afdd1b4570

SHA1
0bf3d98c91c28e24a8964c37ec4780f807209a9f

SHA256
d6a77ca8b0e476a2e431d7f44f5b24a5d41db9814b8f5a3a8bee73d2131f7c6b

SHA512
b6a5c3bbab6582fe5886d86a8a8434df0156e1a4745d5a7b9ce9ff05007f69424c0dcae47b82b89f296cd9dfece1780d01be1e84913abb7e78082056021538cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\e2856403-1724-4619-b91a-393ed8e320e5.vbs

Filesize
711B

MD5
f3b00d33161b1b3a3761fac1620b9abf

SHA1
ba71e75eb0e0bb26a206f78e33e08b8b0b2754b3

SHA256
2ad5ee78cb8f28aaa9d09f7357fd9b9ee4ae44572d5abd46d91cfd21ca1ac1c0

SHA512
2b8b6f0fdf66ee288f6723c25a7959031d003710ff09e8e48d3c4bedfe6eb9c16c39a6a4a6870fb9b2b086674541da8f5d747f8969791b766b94fd4dff326386

Download Submit
C:\Users\Admin\AppData\Local\Temp\f8ea8e62-2156-4912-8265-b1f519c1061e.vbs

Filesize
488B

MD5
b08a38258a7c2b1d12985af4a42cc97e

SHA1
b1ea81c79b400b7aebd795c8378d37a76cb6af27

SHA256
65d51cc49435f6e9c11d5338f1c9d8a9b3a0b902dfcbbee139a3847099d1b364

SHA512
de52ce8b0787dbf6ed2f8a65b19dfb38ab18f3737369f5200326bcf30a036e07c8fd130df8f9640517d1d855bcda02392903fe5a2b2f152ca5eb0769ab9e7c49

Download Submit
C:\Users\Default\MusNotification.exe

Filesize
1.7MB

MD5
d80c604a5966146e2ed9596480808fc5

SHA1
0660205c3d753f2b9d6de81685962c491cf8100c

SHA256
7949f8d9bb5cdffc2346b60ca75fe7e8f6b6e15d2746e7853eabb54f48d7ca00

SHA512
7b355f074c389583fa635453c40f6872cc9abeb41e4000a095bdac9b2d377dad42596548e9990480434d2595b2021dd62d9468a116a70bfbbef37ace13b17e93

Download Submit
memory/116-227-0x00000000001A0000-0x0000000000360000-memory.dmp

Filesize
1.8MB

Download
memory/1336-13-0x000000001BEF0000-0x000000001C418000-memory.dmp

Filesize
5.2MB

Download
memory/1336-3-0x0000000000F60000-0x0000000000F7C000-memory.dmp

Filesize
112KB

Download
memory/1336-22-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

Filesize
10.8MB

Download
memory/1336-228-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

Filesize
10.8MB

Download
memory/1336-15-0x000000001B300000-0x000000001B30A000-memory.dmp

Filesize
40KB

Download
memory/1336-19-0x000000001B340000-0x000000001B34C000-memory.dmp

Filesize
48KB

Download
memory/1336-16-0x000000001B310000-0x000000001B31E000-memory.dmp

Filesize
56KB

Download
memory/1336-17-0x000000001B320000-0x000000001B328000-memory.dmp

Filesize
32KB

Download
memory/1336-18-0x000000001B330000-0x000000001B33C000-memory.dmp

Filesize
48KB

Download
memory/1336-14-0x000000001B2F0000-0x000000001B2FC000-memory.dmp

Filesize
48KB

Download
memory/1336-1-0x0000000000420000-0x00000000005E0000-memory.dmp

Filesize
1.8MB

Download
memory/1336-23-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

Filesize
10.8MB

Download
memory/1336-9-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

Filesize
48KB

Download
memory/1336-10-0x0000000000FD0000-0x0000000000FD8000-memory.dmp

Filesize
32KB

Download
memory/1336-0-0x00007FF8A8573000-0x00007FF8A8575000-memory.dmp

Filesize
8KB

Download
memory/1336-2-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp

Filesize
10.8MB

Download
memory/1336-8-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/1336-7-0x0000000000F90000-0x0000000000FA6000-memory.dmp

Filesize
88KB

Download
memory/1336-6-0x0000000000F80000-0x0000000000F90000-memory.dmp

Filesize
64KB

Download
memory/1336-5-0x0000000000F40000-0x0000000000F48000-memory.dmp

Filesize
32KB

Download
memory/1336-4-0x0000000002890000-0x00000000028E0000-memory.dmp

Filesize
320KB

Download
memory/1336-12-0x000000001B2C0000-0x000000001B2D2000-memory.dmp

Filesize
72KB

Download
memory/2572-116-0x0000019B0E430000-0x0000019B0E452000-memory.dmp

Filesize
136KB

Download
memory/4756-275-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download