dcrat | 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Size

827KB
MD5

c847a23633e81d799fba45bde7cc9951
SHA1

090035126cabb2fb574175c271097042025202de
SHA256

18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c
SHA512

6b057e15133fe58bc1d105a90b761d2f3558e8a8d3a901d9892905dd75f6be569a4bff4a02d919623305c4d524d96b7f902ef3dded6782cc237b1a47807f34bb
SSDEEP

12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files\\Windows Mail\\taskhostw.exe\", \"C:\\Program Files\\Windows Security\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\csrss.exe\", \"C:\\Users\\Default User\\upfc.exe\", \"C:\\Program Files\\Windows Sidebar\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\MusNotification.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files\\Windows Mail\\taskhostw.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files\\Windows Mail\\taskhostw.exe\", \"C:\\Program Files\\Windows Security\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\csrss.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files\\Windows Mail\\taskhostw.exe\", \"C:\\Program Files\\Windows Security\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\csrss.exe\", \"C:\\Users\\Default User\\upfc.exe\", \"C:\\Program Files\\Windows Sidebar\\StartMenuExperienceHost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files\\Windows Mail\\taskhostw.exe\", \"C:\\Program Files\\Windows Security\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\csrss.exe\", \"C:\\Users\\Default User\\upfc.exe\", \"C:\\Program Files\\Windows Sidebar\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files\\Windows Mail\\taskhostw.exe\", \"C:\\Program Files\\Windows Security\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\csrss.exe\", \"C:\\Users\\Default User\\upfc.exe\", \"C:\\Program Files\\Windows Sidebar\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\MusNotification.exe\", \"C:\\Windows\\security\\dllhost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files\\Windows Mail\\taskhostw.exe\", \"C:\\Program Files\\Windows Security\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files\\Windows Mail\\taskhostw.exe\", \"C:\\Program Files\\Windows Security\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\csrss.exe\", \"C:\\Users\\Default User\\upfc.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files\\Windows Mail\\taskhostw.exe\", \"C:\\Program Files\\Windows Security\\csrss.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\sihost.exe\", \"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files\\Windows Mail\\taskhostw.exe\", \"C:\\Program Files\\Windows Security\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Users\\Admin\\Templates\\csrss.exe\", \"C:\\Users\\Default User\\upfc.exe\", \"C:\\Program Files\\Windows Sidebar\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\StartMenuExperienceHost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4112	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	3112	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	3112	schtasks.exe	83

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3096-1-0x0000000000800000-0x00000000008D6000-memory.dmp	dcrat
behavioral2/files/0x0007000000023ccc-11.dat	dcrat

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sihost.exe

Executes dropped EXE 12 IoCs

pid	Process
684	sihost.exe
548	sihost.exe
924	sihost.exe
2348	sihost.exe
1388	sihost.exe
4216	sihost.exe
2332	sihost.exe
4480	sihost.exe
1676	sihost.exe
4380	sihost.exe
3704	sihost.exe
4636	sihost.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Public\\Documents\\sihost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Security\\csrss.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Recovery\\WindowsRE\\MusNotification.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Windows Defender\\it-IT\\StartMenuExperienceHost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Recovery\\WindowsRE\\MusNotification.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Windows Mail\\taskhostw.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Security\\csrss.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Users\\Default User\\upfc.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Windows Mail\\taskhostw.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\Templates\\csrss.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Sidebar\\StartMenuExperienceHost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\MusNotification.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Public\\Documents\\sihost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\Public\\Libraries\\SppExtComObj.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Users\\Default User\\upfc.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\security\\dllhost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\security\\dllhost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\Templates\\csrss.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Sidebar\\StartMenuExperienceHost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\MusNotification.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Windows Defender\\it-IT\\StartMenuExperienceHost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
53	pastebin.com
54	pastebin.com
56	pastebin.com
25	pastebin.com
43	pastebin.com
47	pastebin.com
52	pastebin.com
44	pastebin.com
55	pastebin.com
17	pastebin.com
18	pastebin.com
39	pastebin.com
40	pastebin.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\55b276f4edf653	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\StartMenuExperienceHost.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\55b276f4edf653	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\MusNotification.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
File created	C:\Program Files\Windows Security\886983d96e3d3e	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
File created	C:\Program Files\Windows Sidebar\StartMenuExperienceHost.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
File created	C:\Program Files\Windows Security\csrss.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\aa97147c4c782d	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
File created	C:\Program Files\Windows Mail\taskhostw.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
File created	C:\Program Files\Windows Mail\ea9f0e6c9e2dcd	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\security\dllhost.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
File created	C:\Windows\security\5940a34987c991	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sihost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4088	schtasks.exe
2332	schtasks.exe
4224	schtasks.exe
4660	schtasks.exe
1928	schtasks.exe
3936	schtasks.exe
348	schtasks.exe
4888	schtasks.exe
4216	schtasks.exe
2112	schtasks.exe
1540	schtasks.exe
4632	schtasks.exe
3100	schtasks.exe
372	schtasks.exe
4220	schtasks.exe
2652	schtasks.exe
2240	schtasks.exe
1608	schtasks.exe
3472	schtasks.exe
4392	schtasks.exe
1624	schtasks.exe
1680	schtasks.exe
1948	schtasks.exe
1656	schtasks.exe
4776	schtasks.exe
2360	schtasks.exe
2152	schtasks.exe
4808	schtasks.exe
2264	schtasks.exe
428	schtasks.exe
3420	schtasks.exe
3680	schtasks.exe
3460	schtasks.exe
4160	schtasks.exe
736	schtasks.exe
668	schtasks.exe
3648	schtasks.exe
4968	schtasks.exe
1676	schtasks.exe
4112	schtasks.exe
1776	schtasks.exe
4652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
684	sihost.exe
548	sihost.exe
924	sihost.exe
2348	sihost.exe
1388	sihost.exe
4216	sihost.exe
2332	sihost.exe
4480	sihost.exe
1676	sihost.exe
4380	sihost.exe
3704	sihost.exe
4636	sihost.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
Token: SeDebugPrivilege	684	sihost.exe
Token: SeDebugPrivilege	548	sihost.exe
Token: SeDebugPrivilege	924	sihost.exe
Token: SeDebugPrivilege	2348	sihost.exe
Token: SeDebugPrivilege	1388	sihost.exe
Token: SeDebugPrivilege	4216	sihost.exe
Token: SeDebugPrivilege	2332	sihost.exe
Token: SeDebugPrivilege	4480	sihost.exe
Token: SeDebugPrivilege	1676	sihost.exe
Token: SeDebugPrivilege	4380	sihost.exe
Token: SeDebugPrivilege	3704	sihost.exe
Token: SeDebugPrivilege	4636	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 4800	3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe	126
PID 3096 wrote to memory of 4800	3096	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe	126
PID 4800 wrote to memory of 5024	4800	cmd.exe	128
PID 4800 wrote to memory of 5024	4800	cmd.exe	128
PID 4800 wrote to memory of 684	4800	cmd.exe	129
PID 4800 wrote to memory of 684	4800	cmd.exe	129
PID 684 wrote to memory of 4140	684	sihost.exe	139
PID 684 wrote to memory of 4140	684	sihost.exe	139
PID 4140 wrote to memory of 2524	4140	cmd.exe	142
PID 4140 wrote to memory of 2524	4140	cmd.exe	142
PID 4140 wrote to memory of 548	4140	cmd.exe	145
PID 4140 wrote to memory of 548	4140	cmd.exe	145
PID 548 wrote to memory of 2276	548	sihost.exe	147
PID 548 wrote to memory of 2276	548	sihost.exe	147
PID 2276 wrote to memory of 2936	2276	cmd.exe	149
PID 2276 wrote to memory of 2936	2276	cmd.exe	149
PID 2276 wrote to memory of 924	2276	cmd.exe	153
PID 2276 wrote to memory of 924	2276	cmd.exe	153
PID 924 wrote to memory of 4916	924	sihost.exe	156
PID 924 wrote to memory of 4916	924	sihost.exe	156
PID 4916 wrote to memory of 2468	4916	cmd.exe	158
PID 4916 wrote to memory of 2468	4916	cmd.exe	158
PID 4916 wrote to memory of 2348	4916	cmd.exe	160
PID 4916 wrote to memory of 2348	4916	cmd.exe	160
PID 2348 wrote to memory of 4548	2348	sihost.exe	162
PID 2348 wrote to memory of 4548	2348	sihost.exe	162
PID 4548 wrote to memory of 2944	4548	cmd.exe	164
PID 4548 wrote to memory of 2944	4548	cmd.exe	164
PID 4548 wrote to memory of 1388	4548	cmd.exe	166
PID 4548 wrote to memory of 1388	4548	cmd.exe	166
PID 1388 wrote to memory of 2016	1388	sihost.exe	168
PID 1388 wrote to memory of 2016	1388	sihost.exe	168
PID 2016 wrote to memory of 3704	2016	cmd.exe	170
PID 2016 wrote to memory of 3704	2016	cmd.exe	170
PID 2016 wrote to memory of 4216	2016	cmd.exe	172
PID 2016 wrote to memory of 4216	2016	cmd.exe	172
PID 4216 wrote to memory of 2524	4216	sihost.exe	174
PID 4216 wrote to memory of 2524	4216	sihost.exe	174
PID 2524 wrote to memory of 3116	2524	cmd.exe	176
PID 2524 wrote to memory of 3116	2524	cmd.exe	176
PID 2524 wrote to memory of 2332	2524	cmd.exe	178
PID 2524 wrote to memory of 2332	2524	cmd.exe	178
PID 2332 wrote to memory of 4932	2332	sihost.exe	180
PID 2332 wrote to memory of 4932	2332	sihost.exe	180
PID 4932 wrote to memory of 1268	4932	cmd.exe	182
PID 4932 wrote to memory of 1268	4932	cmd.exe	182
PID 4932 wrote to memory of 4480	4932	cmd.exe	184
PID 4932 wrote to memory of 4480	4932	cmd.exe	184
PID 4480 wrote to memory of 4312	4480	sihost.exe	186
PID 4480 wrote to memory of 4312	4480	sihost.exe	186
PID 4312 wrote to memory of 2728	4312	cmd.exe	188
PID 4312 wrote to memory of 2728	4312	cmd.exe	188
PID 4312 wrote to memory of 1676	4312	cmd.exe	190
PID 4312 wrote to memory of 1676	4312	cmd.exe	190
PID 1676 wrote to memory of 3096	1676	sihost.exe	192
PID 1676 wrote to memory of 3096	1676	sihost.exe	192
PID 3096 wrote to memory of 1976	3096	cmd.exe	194
PID 3096 wrote to memory of 1976	3096	cmd.exe	194
PID 3096 wrote to memory of 4380	3096	cmd.exe	196
PID 3096 wrote to memory of 4380	3096	cmd.exe	196
PID 4380 wrote to memory of 956	4380	sihost.exe	198
PID 4380 wrote to memory of 956	4380	sihost.exe	198
PID 956 wrote to memory of 1968	956	cmd.exe	200
PID 956 wrote to memory of 1968	956	cmd.exe	200

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe
"C:\Users\Admin\AppData\Local\Temp\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RjtkEuxQS3.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5024
- - C:\Users\Public\Documents\sihost.exe
    "C:\Users\Public\Documents\sihost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:684
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9j3rBUpSkc.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:2524
    - - C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:548
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tlraSVrJxn.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2936
        
        C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f4KPDhjeqr.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2468
        
        C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0tZmJrpaGF.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2944
        
        C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OVj8bjUD5N.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3704
        
        C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3116
        
        C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1268
        
        C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2728
        
        C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1976
        
        C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9avng9MHpa.bat"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1968
        
        C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f4KPDhjeqr.bat"
        24⤵
        
        PID:4960
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:668
        
        C:\Users\Public\Documents\sihost.exe
        
        "C:\Users\Public\Documents\sihost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat"
        26⤵
        
        PID:1636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\Documents\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Documents\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\Libraries\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Templates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\security\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\security\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\security\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Mail\taskhostw.exe

Filesize
827KB

MD5
c847a23633e81d799fba45bde7cc9951

SHA1
090035126cabb2fb574175c271097042025202de

SHA256
18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c

SHA512
6b057e15133fe58bc1d105a90b761d2f3558e8a8d3a901d9892905dd75f6be569a4bff4a02d919623305c4d524d96b7f902ef3dded6782cc237b1a47807f34bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\0tZmJrpaGF.bat

Filesize
201B

MD5
485cac536d14f5db3fd023e79b89ee02

SHA1
6e163d56c0c26d03987e49f86b742306c67cca04

SHA256
7abf8cb87f801570fc6e062222b80d16eed392a0855f5140b7a7defa294e872b

SHA512
16a6001a584f100c2b3c8c54559c8ea42dd97a655579d7db43dbe51b3c9bea3917ffd1ede975e1e5d40163498061dbf9cc960927b611bc8a9312f794d20214bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\9avng9MHpa.bat

Filesize
201B

MD5
f69cc41aa25c430281ce07af244ae0e6

SHA1
a0b654ee02ce2b5f2cb602bbabbe42b9600e2a6b

SHA256
e5e5db96ce5864aeef4fd5f1f5d09e6109358dd00d1b07c079149ce979826fbc

SHA512
520efc6f86e71882edc0f5db144a667c91f69b5c93169d0ad3724603d9f126235b99c8a9d2f75bf6d5b8a9bb6ff4a1aba9c7770d764ed5530631559e2e5056c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\9j3rBUpSkc.bat

Filesize
201B

MD5
bab85c4b500f592c6eee0c318b942225

SHA1
0149a0ebbc797a2f679d57e233e82bcd48014ca7

SHA256
b8b864c592a017fd7a199dd995e755b8de1b9c47ee902c89f9d1e87623c2504e

SHA512
b44c7ad8002ca345d798785f5c4f23931c2ab643cb9ff31132023054a8f07ee8e1d88578f42d8ffe3a867ab2dccdde4f46e6eca81d4e9d7505ed9de5653b649e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OVj8bjUD5N.bat

Filesize
201B

MD5
8a7119c4652f7675ddeab54f89b8c516

SHA1
c5c176bc0ad5455044f52e20403865c80aaa6c27

SHA256
3d1c125bb092dd9080cc29c3c36834a9848f43cd6c5ad5a231d5ddd7e5297028

SHA512
f3967821172fa3f9568e2f680508ea13bf8380259c47203bfdadc9fc9f3aa6e51a4dd2bb6d612ebc6e38b4b41838181df954d471b530c80bdac07d63fa1093e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RjtkEuxQS3.bat

Filesize
201B

MD5
495a35ecfa3e7c592d2bd0296bd79adc

SHA1
c4cb4588bb199e1b387a8c8bdf87c53f27766717

SHA256
2f6cc23336f01ad904cd0ebfb05c0a7f58b79102d7ed91c537da6a8d5ce44389

SHA512
477b85bea213e01bcfa54b0fa00e67a1d6b2107f1beb3b05c44c3653e445d9802d19a353c1360a9d0731df4d7d3facc76ad51a753dc7b088fbe03444857f186a

Download Submit
C:\Users\Admin\AppData\Local\Temp\f4KPDhjeqr.bat

Filesize
201B

MD5
8295e355180db8708711e8eccd446ce4

SHA1
9a82ecde7295a3cb532158ba5a8fb25f92acd7bc

SHA256
3135cc4bb1995a6cfda3834d5d3f793ba4b91ef178cd35cdceab0d488bc3883b

SHA512
1f287d15a95287379272934e1ec935eecce1e57339e1fb15d3c134e77a62bff9ce6516a49340efa2a04f09ff0e15ea6415e2da0d7b385df8a09048ac886746d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\k2jNhBdkgg.bat

Filesize
201B

MD5
47f566a1278df1de3ec8c8ac1a828ca4

SHA1
140c0cb8121d0c43fd1ed6d9764e7bdd37e8f258

SHA256
e12d1877872c57a4cf215d9eda32462e3d190b9a24c1d4816d627dbd741fffa6

SHA512
7374e6aa890d01fa38efba5df2063b95a0474876c65aa2487be36965232123edfd59d25366bf45c9747e6125deb5616a55ae939ee978502dad1ed3435bb14980

Download Submit
C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat

Filesize
201B

MD5
929f8a3fba541ed047b1cb6dc6c162a6

SHA1
e514d5767488a48e0b097e74f59a53215f8bc5f9

SHA256
c9bad2b4eb0837c02e029caf2b3fed0d915f3a8893ef7e10daf0c525e9dda0f5

SHA512
8a106073db11d107559c9a6635a2070cf8183d2f278b8ced8bd56a9b2a98973dfee2c7c1f7ecc418ae6460936cc1eb308967ed3a5118253fed347d667c558fc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat

Filesize
201B

MD5
2d252f5ab0f44c97d35fd52adcc6811b

SHA1
ea2b14f42abd140f600f4b371bb3e647d8ba7549

SHA256
6157af275628f35cf5682b7bd7d4e12145cad31eb1eb6b2d3477b344d095829c

SHA512
becd972a7e550547644781ccb3fdb9c12d60129d597c681b04723e4a6987b12cd4521063e7f44596a55562b70dd8f9991e4eb9fd2101434b85e4fc6cc1745bca

Download Submit
C:\Users\Admin\AppData\Local\Temp\tlraSVrJxn.bat

Filesize
201B

MD5
e7d3a78eec291dd5b53014d00b0e1028

SHA1
4d0e2936acb58dd22cff8f2e034b5dc9415a71f2

SHA256
c189d7b9518fab89689cbdef4217eabcb44e458ddf661860fa9e3a20634d24f5

SHA512
048cbd039c4bbb21cb62a70bc653d65b8d206f8eda7887d4b8e0c469af6f1d09e641d84cbeb7211c1ab795487808af50e905b7737dd6abc20cf5944b773b585d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat

Filesize
201B

MD5
a203a8f2a5ff92080a0ddce756180e6e

SHA1
d378202458a10a4571c29d343560bbc2335d76ec

SHA256
b1c55a6f32bf3e48a4924c9e02a1a1a5c427ff3f7851765f7c6354760bf10a89

SHA512
df4f9fe70ad2b3801a81e4aa1fe7e9da57ac20ccf44fe25c7272bd6de958c6b630f4096a733d789d8b87c6c337358af6c040d82898039007024ba1abe768c68e

Download Submit
memory/3096-0-0x00007FF995B43000-0x00007FF995B45000-memory.dmp

Filesize
8KB

Download
memory/3096-36-0x00007FF995B40000-0x00007FF996601000-memory.dmp

Filesize
10.8MB

Download
memory/3096-4-0x00007FF995B40000-0x00007FF996601000-memory.dmp

Filesize
10.8MB

Download
memory/3096-1-0x0000000000800000-0x00000000008D6000-memory.dmp

Filesize
856KB

Download