dcrat | 079172ddcc7b1086b9bf972b21d0d579dbff695fde14811165a986efe322873a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

findme.exe
Size

3.2MB
MD5

4fabffd3dfad2d1e11ae2317b40b6e4a
SHA1

df2ce294dc75060632bfb45add20e69ccc9396c1
SHA256

079172ddcc7b1086b9bf972b21d0d579dbff695fde14811165a986efe322873a
SHA512

bc6ab0e0286913472d6ca8cd19e95b4066d433fbb6247ed377e6ade995a74c201902c32463361e9d9746277fe8898d95b8a08114eedc027f062b38d4ea9550ed
SSDEEP

49152:ubA3jIe1fNayqo7lKdSD6qVvWakQ4BnFxFkUP6IqG7bZ0Z2lOWvOhvECUQb:ubQNuAD3vyQ9bLG7yglVv4vHUy

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat 37 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2620	schtasks.exe
		3016	schtasks.exe
		2152	schtasks.exe
		1576	schtasks.exe
		1800	schtasks.exe
		2944	schtasks.exe
		2716	schtasks.exe
		1248	schtasks.exe
		2524	schtasks.exe
		1324	schtasks.exe
		2764	schtasks.exe
		3044	schtasks.exe
		2328	schtasks.exe
		1764	schtasks.exe
		1824	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		findme.exe
		1840	schtasks.exe
		848	schtasks.exe
		2972	schtasks.exe
		2696	schtasks.exe
		1484	schtasks.exe
		1048	schtasks.exe
		2788	schtasks.exe
		2624	schtasks.exe
		2400	schtasks.exe
		2460	schtasks.exe
		2196	schtasks.exe
		1796	schtasks.exe
		1556	schtasks.exe
		2508	schtasks.exe
		2852	schtasks.exe
		2864	schtasks.exe
		2292	schtasks.exe
		2428	schtasks.exe
		1792	schtasks.exe
		2496	schtasks.exe
		2964	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2712	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2712	schtasks.exe	34

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016d54-12.dat	dcrat
behavioral1/memory/2464-13-0x0000000000DD0000-0x00000000010C8000-memory.dmp	dcrat
behavioral1/memory/2124-65-0x00000000011A0000-0x0000000001498000-memory.dmp	dcrat
behavioral1/memory/2948-151-0x00000000013D0000-0x00000000016C8000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1976	powershell.exe
2132	powershell.exe
1948	powershell.exe
2740	powershell.exe
3032	powershell.exe
1704	powershell.exe
2104	powershell.exe
2324	powershell.exe
2952	powershell.exe
3024	powershell.exe
2936	powershell.exe
1292	powershell.exe
2328	powershell.exe
3064	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	webnetdhcp.exe

Executes dropped EXE 3 IoCs

pid	Process
2464	webnetdhcp.exe
2124	webnetdhcp.exe
2948	csrss.exe

Loads dropped DLL 2 IoCs

pid	Process
2540	cmd.exe
2540	cmd.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
19	ip-api.com
4	ip-api.com
7	ip-api.com
14	ipinfo.io

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\dllhost.exe	webnetdhcp.exe
File created	C:\Program Files (x86)\Adobe\5940a34987c991	webnetdhcp.exe
File created	C:\Program Files\Windows Journal\en-US\wininit.exe	webnetdhcp.exe
File created	C:\Program Files\Windows Journal\en-US\56085415360792	webnetdhcp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\inf\de-DE\lsass.exe	webnetdhcp.exe
File created	C:\Windows\inf\de-DE\6203df4a6bafc7	webnetdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2428	schtasks.exe
1324	schtasks.exe
1824	schtasks.exe
2716	schtasks.exe
2972	schtasks.exe
3044	schtasks.exe
2864	schtasks.exe
1556	schtasks.exe
2764	schtasks.exe
2400	schtasks.exe
1484	schtasks.exe
2496	schtasks.exe
1576	schtasks.exe
2696	schtasks.exe
1792	schtasks.exe
1800	schtasks.exe
2964	schtasks.exe
2328	schtasks.exe
1248	schtasks.exe
2460	schtasks.exe
2624	schtasks.exe
2788	schtasks.exe
1764	schtasks.exe
1048	schtasks.exe
2508	schtasks.exe
2852	schtasks.exe
3016	schtasks.exe
2152	schtasks.exe
2620	schtasks.exe
848	schtasks.exe
2292	schtasks.exe
2944	schtasks.exe
1796	schtasks.exe
1840	schtasks.exe
2524	schtasks.exe
2196	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2464	webnetdhcp.exe
2464	webnetdhcp.exe
2464	webnetdhcp.exe
2464	webnetdhcp.exe
1976	powershell.exe
2740	powershell.exe
1948	powershell.exe
2124	webnetdhcp.exe
2124	webnetdhcp.exe
2124	webnetdhcp.exe
2124	webnetdhcp.exe
2324	powershell.exe
1292	powershell.exe
3024	powershell.exe
1704	powershell.exe
2132	powershell.exe
2328	powershell.exe
3064	powershell.exe
2936	powershell.exe
2104	powershell.exe
3032	powershell.exe
2952	powershell.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe
2948	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2948	csrss.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	webnetdhcp.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2124	webnetdhcp.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2948	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2620	2628	findme.exe	30
PID 2628 wrote to memory of 2620	2628	findme.exe	30
PID 2628 wrote to memory of 2620	2628	findme.exe	30
PID 2628 wrote to memory of 2620	2628	findme.exe	30
PID 2620 wrote to memory of 2540	2620	WScript.exe	31
PID 2620 wrote to memory of 2540	2620	WScript.exe	31
PID 2620 wrote to memory of 2540	2620	WScript.exe	31
PID 2620 wrote to memory of 2540	2620	WScript.exe	31
PID 2540 wrote to memory of 2464	2540	cmd.exe	33
PID 2540 wrote to memory of 2464	2540	cmd.exe	33
PID 2540 wrote to memory of 2464	2540	cmd.exe	33
PID 2540 wrote to memory of 2464	2540	cmd.exe	33
PID 2464 wrote to memory of 1976	2464	webnetdhcp.exe	41
PID 2464 wrote to memory of 1976	2464	webnetdhcp.exe	41
PID 2464 wrote to memory of 1976	2464	webnetdhcp.exe	41
PID 2464 wrote to memory of 1948	2464	webnetdhcp.exe	42
PID 2464 wrote to memory of 1948	2464	webnetdhcp.exe	42
PID 2464 wrote to memory of 1948	2464	webnetdhcp.exe	42
PID 2464 wrote to memory of 2740	2464	webnetdhcp.exe	43
PID 2464 wrote to memory of 2740	2464	webnetdhcp.exe	43
PID 2464 wrote to memory of 2740	2464	webnetdhcp.exe	43
PID 2464 wrote to memory of 1980	2464	webnetdhcp.exe	47
PID 2464 wrote to memory of 1980	2464	webnetdhcp.exe	47
PID 2464 wrote to memory of 1980	2464	webnetdhcp.exe	47
PID 1980 wrote to memory of 580	1980	cmd.exe	49
PID 1980 wrote to memory of 580	1980	cmd.exe	49
PID 1980 wrote to memory of 580	1980	cmd.exe	49
PID 1980 wrote to memory of 2124	1980	cmd.exe	50
PID 1980 wrote to memory of 2124	1980	cmd.exe	50
PID 1980 wrote to memory of 2124	1980	cmd.exe	50
PID 2124 wrote to memory of 1292	2124	webnetdhcp.exe	82
PID 2124 wrote to memory of 1292	2124	webnetdhcp.exe	82
PID 2124 wrote to memory of 1292	2124	webnetdhcp.exe	82
PID 2124 wrote to memory of 3024	2124	webnetdhcp.exe	83
PID 2124 wrote to memory of 3024	2124	webnetdhcp.exe	83
PID 2124 wrote to memory of 3024	2124	webnetdhcp.exe	83
PID 2124 wrote to memory of 3032	2124	webnetdhcp.exe	84
PID 2124 wrote to memory of 3032	2124	webnetdhcp.exe	84
PID 2124 wrote to memory of 3032	2124	webnetdhcp.exe	84
PID 2124 wrote to memory of 2952	2124	webnetdhcp.exe	86
PID 2124 wrote to memory of 2952	2124	webnetdhcp.exe	86
PID 2124 wrote to memory of 2952	2124	webnetdhcp.exe	86
PID 2124 wrote to memory of 1704	2124	webnetdhcp.exe	87
PID 2124 wrote to memory of 1704	2124	webnetdhcp.exe	87
PID 2124 wrote to memory of 1704	2124	webnetdhcp.exe	87
PID 2124 wrote to memory of 2324	2124	webnetdhcp.exe	89
PID 2124 wrote to memory of 2324	2124	webnetdhcp.exe	89
PID 2124 wrote to memory of 2324	2124	webnetdhcp.exe	89
PID 2124 wrote to memory of 2328	2124	webnetdhcp.exe	90
PID 2124 wrote to memory of 2328	2124	webnetdhcp.exe	90
PID 2124 wrote to memory of 2328	2124	webnetdhcp.exe	90
PID 2124 wrote to memory of 2132	2124	webnetdhcp.exe	91
PID 2124 wrote to memory of 2132	2124	webnetdhcp.exe	91
PID 2124 wrote to memory of 2132	2124	webnetdhcp.exe	91
PID 2124 wrote to memory of 2104	2124	webnetdhcp.exe	98
PID 2124 wrote to memory of 2104	2124	webnetdhcp.exe	98
PID 2124 wrote to memory of 2104	2124	webnetdhcp.exe	98
PID 2124 wrote to memory of 2936	2124	webnetdhcp.exe	99
PID 2124 wrote to memory of 2936	2124	webnetdhcp.exe	99
PID 2124 wrote to memory of 2936	2124	webnetdhcp.exe	99
PID 2124 wrote to memory of 3064	2124	webnetdhcp.exe	100
PID 2124 wrote to memory of 3064	2124	webnetdhcp.exe	100
PID 2124 wrote to memory of 3064	2124	webnetdhcp.exe	100
PID 2124 wrote to memory of 1932	2124	webnetdhcp.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\findme.exe
"C:\Users\Admin\AppData\Local\Temp\findme.exe"
1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\runtimebrokerHost\P6MatiaJbshfFUR3.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\runtimebrokerHost\Gjynmp1cQgbqqAJzLCDkc0fMhQUnd.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\runtimebrokerHost\webnetdhcp.exe
      "C:\runtimebrokerHost\webnetdhcp.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\runtimebrokerHost\webnetdhcp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Start Menu\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R2GDdKjFTg.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1980
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:580
      - C:\runtimebrokerHost\webnetdhcp.exe
        
        "C:\runtimebrokerHost\webnetdhcp.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\runtimebrokerHost\webnetdhcp.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\runtimebrokerHost\smss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\en-US\wininit.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\runtimebrokerHost\lsm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Desktop\dwm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\runtimebrokerHost\taskhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\inf\de-DE\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\System.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UVdrS8odIE.bat"
        7⤵
        
        PID:1932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:900
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe"
        8⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fffb6038-21a9-48d5-9c09-f5b84a0b0148.vbs"
        9⤵
        
        PID:700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\841ae86e-8bdd-4fc2-8005-16f164ecafb9.vbs"
        9⤵
        
        PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Start Menu\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Start Menu\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\runtimebrokerHost\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\runtimebrokerHost\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\runtimebrokerHost\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\en-US\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Journal\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\runtimebrokerHost\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\runtimebrokerHost\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\runtimebrokerHost\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Desktop\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\runtimebrokerHost\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\runtimebrokerHost\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\runtimebrokerHost\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\inf\de-DE\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\inf\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\inf\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Libraries\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\841ae86e-8bdd-4fc2-8005-16f164ecafb9.vbs

Filesize
510B

MD5
7e3f8075e6bffa80ca65a28f48f60077

SHA1
79f0f22d3adf5c16e34c0f6a5612e9b8032d951d

SHA256
8f4b2e7263d7c5d435561de489db19eed2d6ca6a6c1d93d8519c45c38e2135c8

SHA512
ace8bc501733eb34a68812d231fd249780bd6cac3a55260ca82de158d51a35e347350efc3beea37b6c40622ad55bbae6d12d645f17e827eb859971bc554ec8bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\R2GDdKjFTg.bat

Filesize
200B

MD5
aae4ed7cbc6713d2b30d6c2d994e5d20

SHA1
891fd67012ad8d90c4413e8e31fbbd1fba045e95

SHA256
aecba9a7ef3cf85a448596bd641a8136483d3445e8085edea1c6ee63002c933a

SHA512
b26107ff2c88eb1d6b3dd6a32a9b3aea279d12d9a550df48d79a91c8df36a7d5149324f2b02ca595fc9a1e14c94c206bead1d03c04d9cb081b76cf98f6957374

Download Submit
C:\Users\Admin\AppData\Local\Temp\UVdrS8odIE.bat

Filesize
223B

MD5
afcada6017818b8bbe18fdce3f862c0f

SHA1
550421575c6290b9040e08489cd917f8dd1d5fb8

SHA256
d63dec02aee06cb75d57bd147fe32de07a17b2daa5b20944af282806d2efe939

SHA512
21bf0af6b850aab64bec038f88115f54d7dacf1a3981d6cfca36f75904f1c92c1a0682488f010cad9f9ff49cb8cc48e0dbf07860f829535d44259af29508465e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fffb6038-21a9-48d5-9c09-f5b84a0b0148.vbs

Filesize
734B

MD5
a276b52f546ac93b44c3456598a1f8f9

SHA1
4dc2b8c9dbfb3ce6561cab624c61bd189e134fe0

SHA256
0a6d4ec0e362353feb43bcfdedf1ad67b841c35a24439cbe5845db165ec589c7

SHA512
c0e66f7502cff95019dfee002dae5ddb8db6b3be0610d2746fff00f51121f6e7515a9b75075cc07bffa1e8833eb19d43b24128594a9a9777de43037b2785cb95

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2a298fc3aa7ba50dbbb846279dd5ca9a

SHA1
d1c90aa60329c0cd3a5ad48b01d20727db2485d3

SHA256
ebc6816192ee0e2ec2ae479bb4f0f7ff32d28e80277d835adfbc8c6165013745

SHA512
d66cf8255edf45321f1ab37d42b2071567ca0077e744ab2deae19eb5582670487d4fa3384675a6f5d440324305e4ffd6baf467a76433e4f1ec3ed47d3b826dc8

Download Submit
C:\runtimebrokerHost\Gjynmp1cQgbqqAJzLCDkc0fMhQUnd.bat

Filesize
37B

MD5
2f75cb9c29ad8dc8dab47b39673a8f09

SHA1
89b9602bcf66bea31f020c426878acc7aa922b44

SHA256
a42bdf46c460b2e7baa4ec022dba0474a9a9a9eef343ae824a533e1ff700417e

SHA512
54e8c98fafbeeb42af261747afcf763e17113ef5ee4e23501f6088da93fd004c9db28c1d41c7c9a3fe05211abf9cd40ada3db993cbdd545cb88c32c77eb07812

Download Submit
C:\runtimebrokerHost\P6MatiaJbshfFUR3.vbe

Filesize
223B

MD5
e63c96d58301c1f1e3dae1378b1b0eca

SHA1
186598fa4a820157a4c284450f13c567bb3cb90e

SHA256
ee8722b767b0c57b52c64cdb9f7b4eca2b3593fbcde9c6106391a6b065195b2a

SHA512
390d7a2404c0379ff64c26bc6e046e09d6ab420aade79d7a1e8e2aada032c81621f4aaa5faaa1d3c4049799e3fca91f08198e306d2b2e0a2a0947a50e7d345c8

Download Submit
C:\runtimebrokerHost\webnetdhcp.exe

Filesize
2.9MB

MD5
eec01d18c981a5973da10c8cbac73764

SHA1
a366e8aff64b3b84c129a54615700b9a6a3238c1

SHA256
4c8610c40e37fb70da6b33ad42c7f5d8a0cc34a16c34a3837af521efbf79fa2f

SHA512
6425dd22c982be9bc1b10a5b885ca1e610b6ee30f2c3a5181f5d6bcdb5a84bdf6b4a5a851c9552f9b7b1f29d5141ecd2ffb0d00d41f3b70c64f7f332a877f165

Download Submit
memory/1976-61-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/1976-62-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/2124-65-0x00000000011A0000-0x0000000001498000-memory.dmp

Filesize
3.0MB

Download
memory/2124-66-0x000000001B240000-0x000000001B296000-memory.dmp

Filesize
344KB

Download
memory/2324-103-0x00000000027D0000-0x00000000027D8000-memory.dmp

Filesize
32KB

Download
memory/2324-102-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2464-20-0x0000000000B30000-0x0000000000B42000-memory.dmp

Filesize
72KB

Download
memory/2464-38-0x000000001AFC0000-0x000000001AFCC000-memory.dmp

Filesize
48KB

Download
memory/2464-26-0x000000001AF10000-0x000000001AF18000-memory.dmp

Filesize
32KB

Download
memory/2464-28-0x000000001AF20000-0x000000001AF32000-memory.dmp

Filesize
72KB

Download
memory/2464-29-0x000000001AF30000-0x000000001AF3C000-memory.dmp

Filesize
48KB

Download
memory/2464-30-0x000000001AF40000-0x000000001AF48000-memory.dmp

Filesize
32KB

Download
memory/2464-31-0x000000001AF50000-0x000000001AF5A000-memory.dmp

Filesize
40KB

Download
memory/2464-32-0x000000001AF60000-0x000000001AF6E000-memory.dmp

Filesize
56KB

Download
memory/2464-33-0x000000001AF70000-0x000000001AF7E000-memory.dmp

Filesize
56KB

Download
memory/2464-34-0x000000001AF80000-0x000000001AF88000-memory.dmp

Filesize
32KB

Download
memory/2464-35-0x000000001AF90000-0x000000001AF9C000-memory.dmp

Filesize
48KB

Download
memory/2464-36-0x000000001AFA0000-0x000000001AFA8000-memory.dmp

Filesize
32KB

Download
memory/2464-37-0x000000001AFB0000-0x000000001AFBA000-memory.dmp

Filesize
40KB

Download
memory/2464-25-0x00000000024D0000-0x00000000024DC000-memory.dmp

Filesize
48KB

Download
memory/2464-24-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

Filesize
32KB

Download
memory/2464-23-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

Filesize
48KB

Download
memory/2464-22-0x000000001AA70000-0x000000001AAC6000-memory.dmp

Filesize
344KB

Download
memory/2464-21-0x0000000000B40000-0x0000000000B48000-memory.dmp

Filesize
32KB

Download
memory/2464-19-0x0000000000B10000-0x0000000000B26000-memory.dmp

Filesize
88KB

Download
memory/2464-18-0x0000000000B00000-0x0000000000B08000-memory.dmp

Filesize
32KB

Download
memory/2464-17-0x0000000000AE0000-0x0000000000AFC000-memory.dmp

Filesize
112KB

Download
memory/2464-16-0x0000000000630000-0x0000000000638000-memory.dmp

Filesize
32KB

Download
memory/2464-15-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/2464-13-0x0000000000DD0000-0x00000000010C8000-memory.dmp

Filesize
3.0MB

Download
memory/2464-14-0x0000000000330000-0x000000000033E000-memory.dmp

Filesize
56KB

Download
memory/2948-153-0x0000000001340000-0x0000000001396000-memory.dmp

Filesize
344KB

Download
memory/2948-152-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/2948-151-0x00000000013D0000-0x00000000016C8000-memory.dmp

Filesize
3.0MB

Download