dcrat | 58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DCobxod.exe
Size

35.2MB
MD5

bc4a8996f18f14f3c77fff13fd23b00d
SHA1

431779aa67e97a32824956d9f3c9122a8340486b
SHA256

58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895
SHA512

1e7e873f4af45963ffd59973bd1d76fbe5bf3841414788ade05aab69f11aae66c5fa3da082a43183a094fb12f5f94e35190e01c9ac224888f557f659a453471c
SSDEEP

98304:yrdqTz4+mudOlbI9tp2159NiHZOGDjuXnU:0dqvYwO23mwY8

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\bcastdvr\\spoolsv.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\bcastdvr\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\bcastdvr\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\RuntimeBroker.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\bcastdvr\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\RuntimeBroker.exe\", \"C:\\Users\\Default\\SendTo\\lsass.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\bcastdvr\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\RuntimeBroker.exe\", \"C:\\Users\\Default\\SendTo\\lsass.exe\", \"C:\\Windows\\PLA\\Idle.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\bcastdvr\\spoolsv.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\RuntimeBroker.exe\", \"C:\\Users\\Default\\SendTo\\lsass.exe\", \"C:\\Windows\\PLA\\Idle.exe\", \"C:\\Browserhost\\intoHostperf.exe\""	intoHostperf.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	5100	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	5100	schtasks.exe	87

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3212	powershell.exe
2812	powershell.exe
1908	powershell.exe
4720	powershell.exe
4204	powershell.exe
2388	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	DCobxod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	intoHostperf.exe

Executes dropped EXE 13 IoCs

pid	Process
4404	intoHostperf.exe
2088	intoHostperf.exe
4296	intoHostperf.exe
4740	intoHostperf.exe
4716	intoHostperf.exe
3156	intoHostperf.exe
956	intoHostperf.exe
4200	intoHostperf.exe
3760	intoHostperf.exe
4176	intoHostperf.exe
4764	intoHostperf.exe
1164	intoHostperf.exe
3760	intoHostperf.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default\\SendTo\\lsass.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\PLA\\Idle.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\PLA\\Idle.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\intoHostperf = "\"C:\\Browserhost\\intoHostperf.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\bcastdvr\\spoolsv.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\RuntimeBroker.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\RuntimeBroker.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default\\SendTo\\lsass.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\bcastdvr\\spoolsv.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\intoHostperf = "\"C:\\Browserhost\\intoHostperf.exe\""	intoHostperf.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCB48F46C3B504486780128D4895FDE02F.TMP	csc.exe
File created	\??\c:\Windows\System32\-63gkj.exe	csc.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Controls\EndOfLife\sihost.exe	intoHostperf.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe	intoHostperf.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\9e8d7a4ca61bd9	intoHostperf.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\sppsvc.exe	intoHostperf.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe	intoHostperf.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\5b884080fd4f94	intoHostperf.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\PLA\6ccacd8608530f	intoHostperf.exe
File created	C:\Windows\bcastdvr\spoolsv.exe	intoHostperf.exe
File created	C:\Windows\bcastdvr\f3b6ecef712a24	intoHostperf.exe
File created	C:\Windows\PLA\Idle.exe	intoHostperf.exe
File opened for modification	C:\Windows\PLA\Idle.exe	intoHostperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCobxod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4432	PING.EXE
2000	PING.EXE
5092	PING.EXE
4744	PING.EXE
3636	PING.EXE
1876	PING.EXE
968	PING.EXE
4444	PING.EXE

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	DCobxod.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	intoHostperf.exe

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
1876	PING.EXE
968	PING.EXE
4444	PING.EXE
4432	PING.EXE
2000	PING.EXE
5092	PING.EXE
4744	PING.EXE
3636	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4372	schtasks.exe
4180	schtasks.exe
4580	schtasks.exe
3236	schtasks.exe
5060	schtasks.exe
3152	schtasks.exe
3104	schtasks.exe
3044	schtasks.exe
4200	schtasks.exe
1184	schtasks.exe
2504	schtasks.exe
2784	schtasks.exe
2124	schtasks.exe
2672	schtasks.exe
4552	schtasks.exe
3716	schtasks.exe
5008	schtasks.exe
4072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe
4404	intoHostperf.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4404	intoHostperf.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	2088	intoHostperf.exe
Token: SeDebugPrivilege	4296	intoHostperf.exe
Token: SeDebugPrivilege	4740	intoHostperf.exe
Token: SeDebugPrivilege	4716	intoHostperf.exe
Token: SeDebugPrivilege	3156	intoHostperf.exe
Token: SeDebugPrivilege	956	intoHostperf.exe
Token: SeDebugPrivilege	4200	intoHostperf.exe
Token: SeDebugPrivilege	3760	intoHostperf.exe
Token: SeDebugPrivilege	4176	intoHostperf.exe
Token: SeDebugPrivilege	4764	intoHostperf.exe
Token: SeDebugPrivilege	1164	intoHostperf.exe
Token: SeDebugPrivilege	3760	intoHostperf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2028	2512	DCobxod.exe	83
PID 2512 wrote to memory of 2028	2512	DCobxod.exe	83
PID 2512 wrote to memory of 2028	2512	DCobxod.exe	83
PID 2028 wrote to memory of 1512	2028	WScript.exe	84
PID 2028 wrote to memory of 1512	2028	WScript.exe	84
PID 2028 wrote to memory of 1512	2028	WScript.exe	84
PID 1512 wrote to memory of 4404	1512	cmd.exe	86
PID 1512 wrote to memory of 4404	1512	cmd.exe	86
PID 4404 wrote to memory of 4728	4404	intoHostperf.exe	92
PID 4404 wrote to memory of 4728	4404	intoHostperf.exe	92
PID 4728 wrote to memory of 2216	4728	csc.exe	94
PID 4728 wrote to memory of 2216	4728	csc.exe	94
PID 4404 wrote to memory of 3212	4404	intoHostperf.exe	110
PID 4404 wrote to memory of 3212	4404	intoHostperf.exe	110
PID 4404 wrote to memory of 2388	4404	intoHostperf.exe	111
PID 4404 wrote to memory of 2388	4404	intoHostperf.exe	111
PID 4404 wrote to memory of 4204	4404	intoHostperf.exe	112
PID 4404 wrote to memory of 4204	4404	intoHostperf.exe	112
PID 4404 wrote to memory of 1908	4404	intoHostperf.exe	113
PID 4404 wrote to memory of 1908	4404	intoHostperf.exe	113
PID 4404 wrote to memory of 2812	4404	intoHostperf.exe	114
PID 4404 wrote to memory of 2812	4404	intoHostperf.exe	114
PID 4404 wrote to memory of 4720	4404	intoHostperf.exe	117
PID 4404 wrote to memory of 4720	4404	intoHostperf.exe	117
PID 4404 wrote to memory of 4932	4404	intoHostperf.exe	122
PID 4404 wrote to memory of 4932	4404	intoHostperf.exe	122
PID 4932 wrote to memory of 4700	4932	cmd.exe	124
PID 4932 wrote to memory of 4700	4932	cmd.exe	124
PID 4932 wrote to memory of 4432	4932	cmd.exe	125
PID 4932 wrote to memory of 4432	4932	cmd.exe	125
PID 4932 wrote to memory of 2088	4932	cmd.exe	138
PID 4932 wrote to memory of 2088	4932	cmd.exe	138
PID 2088 wrote to memory of 4176	2088	intoHostperf.exe	140
PID 2088 wrote to memory of 4176	2088	intoHostperf.exe	140
PID 4176 wrote to memory of 1344	4176	cmd.exe	142
PID 4176 wrote to memory of 1344	4176	cmd.exe	142
PID 4176 wrote to memory of 2000	4176	cmd.exe	143
PID 4176 wrote to memory of 2000	4176	cmd.exe	143
PID 4176 wrote to memory of 4296	4176	cmd.exe	147
PID 4176 wrote to memory of 4296	4176	cmd.exe	147
PID 4296 wrote to memory of 4720	4296	intoHostperf.exe	151
PID 4296 wrote to memory of 4720	4296	intoHostperf.exe	151
PID 4720 wrote to memory of 1124	4720	cmd.exe	153
PID 4720 wrote to memory of 1124	4720	cmd.exe	153
PID 4720 wrote to memory of 5092	4720	cmd.exe	154
PID 4720 wrote to memory of 5092	4720	cmd.exe	154
PID 4720 wrote to memory of 4740	4720	cmd.exe	156
PID 4720 wrote to memory of 4740	4720	cmd.exe	156
PID 4740 wrote to memory of 4932	4740	intoHostperf.exe	159
PID 4740 wrote to memory of 4932	4740	intoHostperf.exe	159
PID 4932 wrote to memory of 2608	4932	cmd.exe	161
PID 4932 wrote to memory of 2608	4932	cmd.exe	161
PID 4932 wrote to memory of 4964	4932	cmd.exe	162
PID 4932 wrote to memory of 4964	4932	cmd.exe	162
PID 4932 wrote to memory of 4716	4932	cmd.exe	164
PID 4932 wrote to memory of 4716	4932	cmd.exe	164
PID 4716 wrote to memory of 1344	4716	intoHostperf.exe	166
PID 4716 wrote to memory of 1344	4716	intoHostperf.exe	166
PID 1344 wrote to memory of 2764	1344	cmd.exe	168
PID 1344 wrote to memory of 2764	1344	cmd.exe	168
PID 1344 wrote to memory of 4676	1344	cmd.exe	169
PID 1344 wrote to memory of 4676	1344	cmd.exe	169
PID 1344 wrote to memory of 3156	1344	cmd.exe	171
PID 1344 wrote to memory of 3156	1344	cmd.exe	171

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DCobxod.exe
"C:\Users\Admin\AppData\Local\Temp\DCobxod.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Browserhost\H1Tsc0Ilqr3tfV2ZqDRU0epu1xRlbvhuJExp.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Browserhost\I0GR.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Browserhost\intoHostperf.exe
      "C:\Browserhost/intoHostperf.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iclmutyt\iclmutyt.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4728
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C30.tmp" "c:\Windows\System32\CSCB48F46C3B504486780128D4895FDE02F.TMP"
        6⤵
        
        PID:2216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\bcastdvr\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Browserhost\intoHostperf.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OSnK0SIgGz.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4932
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4700
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4432
      - C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XcOf3EZBsc.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1344
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2000
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cZiCzHXbdI.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1124
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5092
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z63w1kYtFS.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2608
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4964
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uzBRNhnnhO.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2764
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4676
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\daekv7QIWo.bat"
        15⤵
        
        PID:1244
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1400
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3132
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ViC2VcqdKs.bat"
        17⤵
        
        PID:2960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1300
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4744
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cZiCzHXbdI.bat"
        19⤵
        
        PID:1172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1452
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3636
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UUMu1rrm8x.bat"
        21⤵
        
        PID:5016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3860
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1876
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5tk1CddJ7G.bat"
        23⤵
        
        PID:4664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2320
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:968
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n8fHs36pOy.bat"
        25⤵
        
        PID:924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3756
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4444
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eoTsPsP9ij.bat"
        27⤵
        
        PID:4052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2764
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2832
        
        C:\Browserhost\intoHostperf.exe
        
        "C:\Browserhost\intoHostperf.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\bcastdvr\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\bcastdvr\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\bcastdvr\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Default\SendTo\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\SendTo\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\Default\SendTo\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\PLA\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\PLA\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Windows\PLA\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "intoHostperfi" /sc MINUTE /mo 6 /tr "'C:\Browserhost\intoHostperf.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "intoHostperf" /sc ONLOGON /tr "'C:\Browserhost\intoHostperf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "intoHostperfi" /sc MINUTE /mo 13 /tr "'C:\Browserhost\intoHostperf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Browserhost\H1Tsc0Ilqr3tfV2ZqDRU0epu1xRlbvhuJExp.vbe

Filesize
193B

MD5
469f076b98518fc3f174277ae4e7c6c2

SHA1
f47b8ee20d1901242563bca5949b2fc9b8dcce32

SHA256
27f62059a2e4543d324d2dc4b57fa3afccb086411ee077c136c9732800987dd9

SHA512
6bf0a52c4bb33945c00c637fb50298975f060f4209f6c5655352a656b239cf47d78f4e1088eb7d0df5cde52915e704cec485babfa33284b501394a06ac40c214

Download Submit
C:\Browserhost\I0GR.bat

Filesize
85B

MD5
fb60a3f4d062529781b1856a97f6d2a8

SHA1
1da3695e467be7e3a89ce9c7de7db683e6e438fe

SHA256
81fcf50eda7d7a8a0170239aee3d3741e2ab76d1aa7af8800c2e47cf182dcdf0

SHA512
1f99a3b004752db78fb8e9e4d097f866bad641cd196ccb6d639c40c4c3dda87b5e1a7a7836c8a276b965ac50f1b8b43731bf12d592cd5993938769d1196593e4

Download Submit
C:\Browserhost\intoHostperf.exe

Filesize
34.9MB

MD5
cadd0c3b32099635f889ba630c4697f4

SHA1
305f57ac6c6a0afbdc7666a6964bc2acbb2ed738

SHA256
cd91ce0978cf8df9a22d3275fd693ebc759263485550df913d837694fc3afcb4

SHA512
4712774b492b09866ed752404d248b87b595282b7b3b617c73ae1a029d5628c186e980768515eebdb950e1c89c11cb8ba47a382192400701d3dc961a98ea4714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\intoHostperf.exe.log

Filesize
1KB

MD5
07309bd8d88aa32cac50b856dcde7ea4

SHA1
ff36ee74f17d7af6f2a59e4d868970b65d1181e2

SHA256
b9e8a168e9c52fef84060a8a9d03406e694b7b83fe5aacca905cc3f0bcf4b023

SHA512
3f0fa70207546a0150dad3bd4e817191561b2a97fcbb73db0bed9a6bb9462b10495c0aae11643d788b655893523c862f2c4a71f22ff611b2dfb4fe54a594bdc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\5tk1CddJ7G.bat

Filesize
159B

MD5
0d9da1cc8be89b62b61c44f332a2070d

SHA1
a520a9d8d2209a59724c9f7bbc5c72f08d657220

SHA256
199baa7d7c80e7b2f7f8e89faaa91e5d6147e3e71f833e93a6f7533c0a62f785

SHA512
16ef87e65c4ee7e6e460031d1e4d127ecde1496075ead0aaf0fbf87f790faccb9b26f800e312773b76d85ce918f6d53ab5cce02bc276fa34092ec2db1c7e7b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\OSnK0SIgGz.bat

Filesize
159B

MD5
e601ec90d01949b7ccee47e9515d3948

SHA1
7fe5962be4a6e4fbd9cee4be96f903296a888fd4

SHA256
3ff2475d1ef789bd5eff3438d6e2cbbf3d09f1a423ff1b45d5b31426ee421469

SHA512
35158b8d7aadd983923063c676b276d32d76819a4f09680e3f884f75aa695f00e547eb5b601cceaf89899f66af4506fad1e6dbc87da73a87a449dbe28eceff63

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9C30.tmp

Filesize
1KB

MD5
cb439fca3d2f368b29d806d23dd8bf18

SHA1
dd6d2f707129e058745c6697791a7cb5b501b86e

SHA256
29e0b0f746e5584212470e045fdc3fef5c582e6d692537e4a0a7a85048f6909e

SHA512
c5b6390e69f34bd91f353859517dd1d22280ebe9de6b7979d42542f96e9c28106a8631f71b17453ddd1766cae03ecc9e5e62c7a8e8e1092dacebe2c98c41b2c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\UUMu1rrm8x.bat

Filesize
159B

MD5
324d5eb2df76ad07e8db54b3521bd8a2

SHA1
a585db4ca901848de630db5bae73a3f9aba8d5bb

SHA256
84b022c9fa4d2457c8e97dd530f32eb2b0d8d26ad14b0f7c49c63188e0e7aee1

SHA512
b89e11281e41911a6a065ab64f1753c66c8188487ddd3da46037ab7989282d8f3f7c885aa674a38b67c6e64b6000e37f2242350c2e608928118736d4ed5822d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ViC2VcqdKs.bat

Filesize
159B

MD5
0b815a8ab6cc0475e1f200aca161546e

SHA1
4262d6aa8ae2d0701cb931479114f0b986212347

SHA256
6c5c0493876750eeb9ec1e7712a4a28c3532c74c44ce3547f2ea47f7f9a48c99

SHA512
93a7dba49a60eb74e052e2561d15973acb7e784bde474f51e29bb2f80bbce04be206887356241dca9ad83eab4472fd3cdeceb61cf0d8deded6470f8e2ebf8f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XcOf3EZBsc.bat

Filesize
159B

MD5
4179a7964a1429f1f9d8c928db386b13

SHA1
8b8a447d54cad240b99c922db7913bb701ae670c

SHA256
c59799704daabbc5bb5f2e5db2881fe1679f1d886a7eda36d482c178f8d7ee69

SHA512
f582c6a906cb88e5c3f1f8337567649667875b13cbfb64ba1b1ca314c5bf0029732d2843966dc4eb3e9a7c663694982d50f7ef278dc54d553bb333d05372eb10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z63w1kYtFS.bat

Filesize
207B

MD5
a1032364619888469f8e5659f25624ce

SHA1
a55a25df9a686dfecba770c8fc55c29d3bc62a02

SHA256
4cf2266c2833ecfa840d687976c62d3728229bd0192f9615156492de193bff3d

SHA512
e122be91f10678936da1f542fee1e9483088e2dacad330706b3fc26d15b4b64256c20f071feddb3bd830afce3d8f9f4edf181feb024ff32ff52720e92814f500

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m5523qdx.yxu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cZiCzHXbdI.bat

Filesize
159B

MD5
54ff523ca511883dfa117a0568bf639a

SHA1
ada14f450b4784348a21afc8ca74b991412d549e

SHA256
73437cb6ad40cd54ab72a5a7250b2f99a68dad28ea9f91645f8c6a43d4188d8c

SHA512
6a4736d8b3d1829a60cd415b01f8999ab5ed0ba7693baff248ee5efc7dbda07eb58defc8a50ed3e84aba52dedf4b9945780292267273b99b54f31e6be7e43276

Download Submit
C:\Users\Admin\AppData\Local\Temp\daekv7QIWo.bat

Filesize
207B

MD5
c5fe632693a4a711552b55e4a59802bb

SHA1
c654147eb895b28aef470a42b596601838d50bad

SHA256
215fa7a030257fe6ce8f4f70bc318cc08caed7ee93c2e12701566076fdab0e17

SHA512
c453db50bb74c276e2ade6e5e2be6153ded07dba8b3d9a940160db20d535fcd2a8113c53b87250ca2e5448a15c8a7b4f6bf87349a445e71f6507dae3afce532b

Download Submit
C:\Users\Admin\AppData\Local\Temp\eoTsPsP9ij.bat

Filesize
207B

MD5
49de0c38a5902d72df03fb40e55ae689

SHA1
2f125b23466ff46fd9d24521d28b267b93866cad

SHA256
04f17cf5ee575d990081284be8f9d1b3d1d00c1ffeaa78e9c2f0f2763fd3eb81

SHA512
04880f07790628e620984059d558ada6db9e982e58966c1da8351b56bfaa096fcb1802c09f3263b734b0ebf6ade8abc6f172304ca736cd44754cbe3ebc1aa7a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\n8fHs36pOy.bat

Filesize
159B

MD5
6ce0f5d9d9505fcb74c85e96ecfd6256

SHA1
fa04226ebc1eeaf51dc6a79d35bdc442118d0611

SHA256
6b8287e58cf920777ad3548aad6819a561659c40a33844f12c136654666b4b84

SHA512
2d4a93572a491bc437115923f590963bbe1046ce08e5c27592336bfb1206c8f9db3334182262f94954b0cf0c78641f2e5710c9f171f1c10d2715fd0fc0f8a1f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\uzBRNhnnhO.bat

Filesize
207B

MD5
5d2ca86c4fa6a9d6abee1ac3c20d719c

SHA1
0069b41590666bbdfd68a7671b4ccadd0f6151d3

SHA256
b003a5d390a0780838b6d2f90b3e98627c0c794a21e709d1955770b151a1a6da

SHA512
efba489446dedeae79f9093d50b5edb06c6c0088108972b49f832fde1aa3a545ee5bbd4ad054019c0c8bfc068b663e0b404dc8d2df37ccadd9bedb5cc8a80fd5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\iclmutyt\iclmutyt.0.cs

Filesize
363B

MD5
e9cdfabea844f140a002ff1926e335ac

SHA1
a551981bb4a39e106e31767f9e20a2305cbe92df

SHA256
2d05daecc1acc07bbf6fd4e7972d7b24bfb81aeda8a673c962e288d35dd177a2

SHA512
8ae5ffaf776b6a75f186aefaa7fadbd95a8b18f629ac613b62acb9e7ce2404f9ff7bb566ef458b382e518a1fc13768e15e04697d728730271e734b2ae7a7ad65

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\iclmutyt\iclmutyt.cmdline

Filesize
235B

MD5
669086eca52d062315aa53a42a92d1cf

SHA1
f8b3e973ab24fa03b913870da26aa355319af823

SHA256
57e7c3f1d280736df183420cae63a0d2dc38cc0abdd0a85befe4f866a7843adc

SHA512
a5fbb35da915330f295e8cb20bb40ba52495ba6e278fad008d2795a911e88433fee384321e7a0fc74c915db029576627a4c21422c4048fca708b8f5826dc7a82

Download Submit
\??\c:\Windows\System32\CSCB48F46C3B504486780128D4895FDE02F.TMP

Filesize
1KB

MD5
82a7b8ef3bc275711e3b27c6df93c7ff

SHA1
bdac909f26475c94c74145576bcf22adb0f8203c

SHA256
582921e5e6617cb736006c46c9c8576d8fdefb8763469bdbf305d52d298f6124

SHA512
f2100bca60280f6ad93f40254d6fe69bd9917a44973516874aa54c28042796503daac5c51869924f5ecd17615f461dda6441f479e1201c44ad07f5a7728af248

Download Submit
memory/1908-93-0x000001FB47980000-0x000001FB479A2000-memory.dmp

Filesize
136KB

Download
memory/4404-28-0x000000001B420000-0x000000001B430000-memory.dmp

Filesize
64KB

Download
memory/4404-38-0x000000001CA20000-0x000000001CA32000-memory.dmp

Filesize
72KB

Download
memory/4404-53-0x000000001CA60000-0x000000001CA6E000-memory.dmp

Filesize
56KB

Download
memory/4404-55-0x000000001CB00000-0x000000001CB18000-memory.dmp

Filesize
96KB

Download
memory/4404-57-0x000000001CA70000-0x000000001CA7C000-memory.dmp

Filesize
48KB

Download
memory/4404-59-0x000000001CB70000-0x000000001CBBE000-memory.dmp

Filesize
312KB

Download
memory/4404-49-0x000000001CA40000-0x000000001CA4E000-memory.dmp

Filesize
56KB

Download
memory/4404-47-0x000000001CAA0000-0x000000001CAFA000-memory.dmp

Filesize
360KB

Download
memory/4404-45-0x000000001C9D0000-0x000000001C9E0000-memory.dmp

Filesize
64KB

Download
memory/4404-43-0x000000001C9C0000-0x000000001C9D0000-memory.dmp

Filesize
64KB

Download
memory/4404-95-0x00007FFAE4AC0000-0x00007FFAE4BC0000-memory.dmp

Filesize
1024KB

Download
memory/4404-41-0x000000001C960000-0x000000001C96E000-memory.dmp

Filesize
56KB

Download
memory/4404-39-0x000000001CF70000-0x000000001D498000-memory.dmp

Filesize
5.2MB

Download
memory/4404-51-0x000000001CA50000-0x000000001CA60000-memory.dmp

Filesize
64KB

Download
memory/4404-36-0x000000001CA00000-0x000000001CA16000-memory.dmp

Filesize
88KB

Download
memory/4404-34-0x000000001C930000-0x000000001C940000-memory.dmp

Filesize
64KB

Download
memory/4404-32-0x000000001C9E0000-0x000000001C9F2000-memory.dmp

Filesize
72KB

Download
memory/4404-30-0x000000001C920000-0x000000001C92E000-memory.dmp

Filesize
56KB

Download
memory/4404-26-0x000000001B3F0000-0x000000001B400000-memory.dmp

Filesize
64KB

Download
memory/4404-24-0x000000001C940000-0x000000001C958000-memory.dmp

Filesize
96KB

Download
memory/4404-22-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

Filesize
64KB

Download
memory/4404-20-0x000000001C970000-0x000000001C9C0000-memory.dmp

Filesize
320KB

Download
memory/4404-19-0x000000001B400000-0x000000001B41C000-memory.dmp

Filesize
112KB

Download
memory/4404-17-0x0000000002860000-0x000000000286E000-memory.dmp

Filesize
56KB

Download
memory/4404-15-0x000000001B540000-0x000000001B566000-memory.dmp

Filesize
152KB

Download
memory/4404-13-0x0000000000440000-0x00000000007CE000-memory.dmp

Filesize
3.6MB

Download
memory/4404-12-0x00007FFAE4AC0000-0x00007FFAE4BC0000-memory.dmp

Filesize
1024KB

Download