dcrat | d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce

Resubmissions

13-01-2025 04:00

250113-ekp6psvlbx 10

12-01-2025 15:33

250112-szhbasxqfw 10

Analysis

max time kernel
872s
max time network
434s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
Size

984KB
MD5

808d571c621732642832aaca4a519717
SHA1

cf71f6fc8f7ad0d691cf899928296be33ed46e49
SHA256

d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce
SHA512

f01bb94b9bc2482aebb8862a2cc6a1f43afce1796df373c4d3dd2c33e68f06849c704a4c0a79320f6a1ab04c5227416445c4fe715c18fdfc0bc123f0f79cfb88
SSDEEP

12288:syEIOYTNEIf5AycvEhKIV6tEcln0Ai2a61h3cQ9Fk+ntGoWuzsx1oiLgo+:syErYT+PvXIUln/1GJgo+

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	3588	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	3588	schtasks.exe	83

UAC bypass 3 TTPs 24 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/5108-1-0x0000000000570000-0x000000000066C000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b73-25.dat	dcrat
behavioral2/files/0x000c000000023b77-40.dat	dcrat
behavioral2/memory/4792-225-0x0000000000BB0000-0x0000000000CAC000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1148	powershell.exe
2660	powershell.exe
3568	powershell.exe
3332	powershell.exe
752	powershell.exe
4480	powershell.exe
1704	powershell.exe
2204	powershell.exe
4140	powershell.exe
5112	powershell.exe
3068	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe

Executes dropped EXE 7 IoCs

pid	Process
4792	Registry.exe
1624	dwm.exe
4920	Registry.exe
3456	dwm.exe
1912	Registry.exe
4812	dllhost.exe
4940	dwm.exe

Checks whether UAC is enabled 1 TTPs 16 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\dllhost.exe	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\5940a34987c991	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\RCX88EF.tmp	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\RCX88F0.tmp	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\dllhost.exe	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Speech\Engines\SR\de-DE\smss.exe	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File created	C:\Windows\ServiceProfiles\NetworkService\5940a34987c991	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\RCX8B05.tmp	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\dllhost.exe	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File opened for modification	C:\Windows\System\dwm.exe	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\RCX8B04.tmp	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File created	C:\Windows\System\dwm.exe	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File created	C:\Windows\System\6cb0b6c459d5d3	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File created	C:\Windows\ServiceProfiles\NetworkService\dllhost.exe	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File opened for modification	C:\Windows\System\RCX84D4.tmp	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
File opened for modification	C:\Windows\System\RCX84D5.tmp	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1100	schtasks.exe
1560	schtasks.exe
4308	schtasks.exe
380	schtasks.exe
1320	schtasks.exe
2248	schtasks.exe
1748	schtasks.exe
3396	schtasks.exe
4940	schtasks.exe
4684	schtasks.exe
3828	schtasks.exe
1736	schtasks.exe
4852	schtasks.exe
3996	schtasks.exe
1836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
4140	powershell.exe
4140	powershell.exe
5112	powershell.exe
5112	powershell.exe
3332	powershell.exe
3332	powershell.exe
1148	powershell.exe
1148	powershell.exe
752	powershell.exe
752	powershell.exe
2204	powershell.exe
2204	powershell.exe
3068	powershell.exe
3068	powershell.exe
3568	powershell.exe
3568	powershell.exe
1704	powershell.exe
1704	powershell.exe
2660	powershell.exe
2660	powershell.exe
4480	powershell.exe
4480	powershell.exe
2660	powershell.exe
5112	powershell.exe
4140	powershell.exe
1148	powershell.exe
3068	powershell.exe
3332	powershell.exe
2204	powershell.exe
1704	powershell.exe
3568	powershell.exe
752	powershell.exe
4480	powershell.exe
4792	Registry.exe
4792	Registry.exe
4792	Registry.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4792	Registry.exe
Token: SeDebugPrivilege	1624	dwm.exe
Token: SeDebugPrivilege	4920	Registry.exe
Token: SeDebugPrivilege	3456	dwm.exe
Token: SeDebugPrivilege	1912	Registry.exe
Token: SeDebugPrivilege	4812	dllhost.exe
Token: SeDebugPrivilege	4940	dwm.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 5112	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	102
PID 5108 wrote to memory of 5112	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	102
PID 5108 wrote to memory of 4480	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	103
PID 5108 wrote to memory of 4480	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	103
PID 5108 wrote to memory of 1704	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	104
PID 5108 wrote to memory of 1704	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	104
PID 5108 wrote to memory of 1148	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	105
PID 5108 wrote to memory of 1148	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	105
PID 5108 wrote to memory of 3068	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	106
PID 5108 wrote to memory of 3068	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	106
PID 5108 wrote to memory of 2660	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	107
PID 5108 wrote to memory of 2660	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	107
PID 5108 wrote to memory of 2204	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	108
PID 5108 wrote to memory of 2204	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	108
PID 5108 wrote to memory of 3568	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	109
PID 5108 wrote to memory of 3568	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	109
PID 5108 wrote to memory of 4140	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	110
PID 5108 wrote to memory of 4140	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	110
PID 5108 wrote to memory of 752	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	111
PID 5108 wrote to memory of 752	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	111
PID 5108 wrote to memory of 3332	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	112
PID 5108 wrote to memory of 3332	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	112
PID 5108 wrote to memory of 2144	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	124
PID 5108 wrote to memory of 2144	5108	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe	124
PID 2144 wrote to memory of 1344	2144	cmd.exe	126
PID 2144 wrote to memory of 1344	2144	cmd.exe	126
PID 2144 wrote to memory of 4792	2144	cmd.exe	132
PID 2144 wrote to memory of 4792	2144	cmd.exe	132

System policy modification 1 TTPs 24 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Registry.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe
C:\Users\Admin\AppData\Local\Temp\d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Jo8csrhVL.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1344
- - C:\Recovery\WindowsRE\Registry.exe
    "C:\Recovery\WindowsRE\Registry.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Windows\System\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Windows\System\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Modules\PackageManagement\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PackageManagement\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Modules\PackageManagement\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\NetworkService\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\ServiceProfiles\NetworkService\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\System\dwm.exe
C:\Windows\System\dwm.exe
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1624

C:\Recovery\WindowsRE\Registry.exe
C:\Recovery\WindowsRE\Registry.exe
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4920

C:\Windows\System\dwm.exe
C:\Windows\System\dwm.exe
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3456

C:\Recovery\WindowsRE\Registry.exe
C:\Recovery\WindowsRE\Registry.exe
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1912

C:\Windows\ServiceProfiles\NetworkService\dllhost.exe
C:\Windows\ServiceProfiles\NetworkService\dllhost.exe
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4812

C:\Windows\System\dwm.exe
C:\Windows\System\dwm.exe
1⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\Registry.exe

Filesize
984KB

MD5
a6138b330c40e12e64df3aa61e4fca76

SHA1
b6f0311a0bfb9e94462f1646a5477df07c5b3054

SHA256
485f421aa1a7c923d69f794447604e086f322f8db168b9fce4fba2daf9f29d06

SHA512
8d26feb08c163b61d470b06cda668c8d86a70cfd9e4b4cb08ef62142b999632747d1b28f0bd52ec8be8b2cdd9b16a804ba95054a193211dcdf79fb6bbd23df9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Jo8csrhVL.bat

Filesize
199B

MD5
d0205cf7771602de890e042dffa96680

SHA1
41c316618e41f833fda8650ef9d9134eff6a5d10

SHA256
f16689e76f2ae5c7cbe046d5f19164132a04297432bf50bc490c9194b995bc9f

SHA512
e6e63157b87ce8a95b56219f63935650828ebf76b1fdf1661750005b6259c13fb6ba9bf722d774c26f7cb581b3f602647c7798cf4d27c2ad24f366f828a7de22

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ozcdgrje.olz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\ServiceProfiles\NetworkService\dllhost.exe

Filesize
984KB

MD5
808d571c621732642832aaca4a519717

SHA1
cf71f6fc8f7ad0d691cf899928296be33ed46e49

SHA256
d80fa7b3ff6a9ccf612307c00a81e470e63c53c6d3370ea7f5490de4f5f477ce

SHA512
f01bb94b9bc2482aebb8862a2cc6a1f43afce1796df373c4d3dd2c33e68f06849c704a4c0a79320f6a1ab04c5227416445c4fe715c18fdfc0bc123f0f79cfb88

Download Submit
memory/4140-103-0x00000251D0F50000-0x00000251D0F72000-memory.dmp

Filesize
136KB

Download
memory/4792-225-0x0000000000BB0000-0x0000000000CAC000-memory.dmp

Filesize
1008KB

Download
memory/5108-8-0x000000001B1D0000-0x000000001B1DC000-memory.dmp

Filesize
48KB

Download
memory/5108-9-0x000000001B1E0000-0x000000001B1EC000-memory.dmp

Filesize
48KB

Download
memory/5108-18-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

Filesize
10.8MB

Download
memory/5108-14-0x000000001B230000-0x000000001B23C000-memory.dmp

Filesize
48KB

Download
memory/5108-11-0x000000001B200000-0x000000001B208000-memory.dmp

Filesize
32KB

Download
memory/5108-97-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

Filesize
10.8MB

Download
memory/5108-12-0x000000001B210000-0x000000001B21E000-memory.dmp

Filesize
56KB

Download
memory/5108-13-0x000000001B220000-0x000000001B22C000-memory.dmp

Filesize
48KB

Download
memory/5108-10-0x000000001B1F0000-0x000000001B1FC000-memory.dmp

Filesize
48KB

Download
memory/5108-17-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

Filesize
10.8MB

Download
memory/5108-0-0x00007FFB52733000-0x00007FFB52735000-memory.dmp

Filesize
8KB

Download
memory/5108-4-0x0000000002750000-0x0000000002758000-memory.dmp

Filesize
32KB

Download
memory/5108-5-0x000000001B180000-0x000000001B190000-memory.dmp

Filesize
64KB

Download
memory/5108-6-0x000000001B190000-0x000000001B1A6000-memory.dmp

Filesize
88KB

Download
memory/5108-7-0x000000001B1C0000-0x000000001B1CA000-memory.dmp

Filesize
40KB

Download
memory/5108-3-0x0000000002730000-0x000000000273E000-memory.dmp

Filesize
56KB

Download
memory/5108-2-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

Filesize
10.8MB

Download
memory/5108-1-0x0000000000570000-0x000000000066C000-memory.dmp

Filesize
1008KB

Download