dcrat | 58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2025 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895.exe
Size

35.2MB
MD5

bc4a8996f18f14f3c77fff13fd23b00d
SHA1

431779aa67e97a32824956d9f3c9122a8340486b
SHA256

58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895
SHA512

1e7e873f4af45963ffd59973bd1d76fbe5bf3841414788ade05aab69f11aae66c5fa3da082a43183a094fb12f5f94e35190e01c9ac224888f557f659a453471c
SSDEEP

98304:yrdqTz4+mudOlbI9tp2159NiHZOGDjuXnU:0dqvYwO23mwY8

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\csrss.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\csrss.exe\", \"C:\\Browserhost\\explorer.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\csrss.exe\", \"C:\\Browserhost\\explorer.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\smss.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\csrss.exe\", \"C:\\Browserhost\\explorer.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\smss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\csrss.exe\", \"C:\\Browserhost\\explorer.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\smss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\csrss.exe\", \"C:\\Browserhost\\explorer.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\smss.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Browserhost\\intoHostperf.exe\""	intoHostperf.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	2056	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2056	schtasks.exe	88

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2604	powershell.exe
1044	powershell.exe
5004	powershell.exe
4432	powershell.exe
2092	powershell.exe
888	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	intoHostperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	smss.exe

Executes dropped EXE 14 IoCs

pid	Process
32	intoHostperf.exe
3932	smss.exe
3024	smss.exe
5004	smss.exe
1160	smss.exe
1532	smss.exe
4912	smss.exe
2068	smss.exe
2700	smss.exe
4948	smss.exe
5088	smss.exe
3200	smss.exe
1624	smss.exe
2176	smss.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Offline Web Pages\\csrss.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Browserhost\\explorer.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Browserhost\\explorer.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\smss.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\intoHostperf = "\"C:\\Browserhost\\intoHostperf.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\intoHostperf = "\"C:\\Browserhost\\intoHostperf.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Offline Web Pages\\csrss.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\smss.exe\""	intoHostperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	intoHostperf.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCF1A36CFE61B54F64888268A4E4B37B6.TMP	csc.exe
File created	\??\c:\Windows\System32\ewkptm.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\smss.exe	intoHostperf.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\69ddcba757bf72	intoHostperf.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\csrss.exe	intoHostperf.exe
File created	C:\Windows\Offline Web Pages\886983d96e3d3e	intoHostperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4528	PING.EXE
704	PING.EXE
1616	PING.EXE
1068	PING.EXE
3020	PING.EXE
4844	PING.EXE
2476	PING.EXE

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	intoHostperf.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	smss.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
4528	PING.EXE
704	PING.EXE
1616	PING.EXE
1068	PING.EXE
3020	PING.EXE
4844	PING.EXE
2476	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2084	schtasks.exe
1564	schtasks.exe
3660	schtasks.exe
2636	schtasks.exe
2944	schtasks.exe
920	schtasks.exe
3664	schtasks.exe
3096	schtasks.exe
2076	schtasks.exe
2540	schtasks.exe
3000	schtasks.exe
1988	schtasks.exe
2828	schtasks.exe
4580	schtasks.exe
456	schtasks.exe
4304	schtasks.exe
4932	schtasks.exe
4980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe
32	intoHostperf.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	32	intoHostperf.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	3932	smss.exe
Token: SeDebugPrivilege	3024	smss.exe
Token: SeDebugPrivilege	5004	smss.exe
Token: SeDebugPrivilege	1160	smss.exe
Token: SeDebugPrivilege	1532	smss.exe
Token: SeDebugPrivilege	4912	smss.exe
Token: SeDebugPrivilege	2068	smss.exe
Token: SeDebugPrivilege	2700	smss.exe
Token: SeDebugPrivilege	4948	smss.exe
Token: SeDebugPrivilege	5088	smss.exe
Token: SeDebugPrivilege	3200	smss.exe
Token: SeDebugPrivilege	1624	smss.exe
Token: SeDebugPrivilege	2176	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4744	4928	58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895.exe	83
PID 4928 wrote to memory of 4744	4928	58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895.exe	83
PID 4928 wrote to memory of 4744	4928	58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895.exe	83
PID 4744 wrote to memory of 208	4744	WScript.exe	84
PID 4744 wrote to memory of 208	4744	WScript.exe	84
PID 4744 wrote to memory of 208	4744	WScript.exe	84
PID 208 wrote to memory of 32	208	cmd.exe	86
PID 208 wrote to memory of 32	208	cmd.exe	86
PID 32 wrote to memory of 2836	32	intoHostperf.exe	93
PID 32 wrote to memory of 2836	32	intoHostperf.exe	93
PID 2836 wrote to memory of 4816	2836	csc.exe	95
PID 2836 wrote to memory of 4816	2836	csc.exe	95
PID 32 wrote to memory of 4432	32	intoHostperf.exe	111
PID 32 wrote to memory of 4432	32	intoHostperf.exe	111
PID 32 wrote to memory of 5004	32	intoHostperf.exe	112
PID 32 wrote to memory of 5004	32	intoHostperf.exe	112
PID 32 wrote to memory of 1044	32	intoHostperf.exe	113
PID 32 wrote to memory of 1044	32	intoHostperf.exe	113
PID 32 wrote to memory of 2092	32	intoHostperf.exe	114
PID 32 wrote to memory of 2092	32	intoHostperf.exe	114
PID 32 wrote to memory of 888	32	intoHostperf.exe	115
PID 32 wrote to memory of 888	32	intoHostperf.exe	115
PID 32 wrote to memory of 2604	32	intoHostperf.exe	117
PID 32 wrote to memory of 2604	32	intoHostperf.exe	117
PID 32 wrote to memory of 5092	32	intoHostperf.exe	123
PID 32 wrote to memory of 5092	32	intoHostperf.exe	123
PID 5092 wrote to memory of 1532	5092	cmd.exe	125
PID 5092 wrote to memory of 1532	5092	cmd.exe	125
PID 5092 wrote to memory of 1576	5092	cmd.exe	126
PID 5092 wrote to memory of 1576	5092	cmd.exe	126
PID 5092 wrote to memory of 3932	5092	cmd.exe	133
PID 5092 wrote to memory of 3932	5092	cmd.exe	133
PID 3932 wrote to memory of 4092	3932	smss.exe	138
PID 3932 wrote to memory of 4092	3932	smss.exe	138
PID 4092 wrote to memory of 2640	4092	cmd.exe	141
PID 4092 wrote to memory of 2640	4092	cmd.exe	141
PID 4092 wrote to memory of 4940	4092	cmd.exe	143
PID 4092 wrote to memory of 4940	4092	cmd.exe	143
PID 4092 wrote to memory of 3024	4092	cmd.exe	146
PID 4092 wrote to memory of 3024	4092	cmd.exe	146
PID 3024 wrote to memory of 3936	3024	smss.exe	149
PID 3024 wrote to memory of 3936	3024	smss.exe	149
PID 3936 wrote to memory of 2004	3936	cmd.exe	151
PID 3936 wrote to memory of 2004	3936	cmd.exe	151
PID 3936 wrote to memory of 1616	3936	cmd.exe	152
PID 3936 wrote to memory of 1616	3936	cmd.exe	152
PID 3936 wrote to memory of 5004	3936	cmd.exe	157
PID 3936 wrote to memory of 5004	3936	cmd.exe	157
PID 5004 wrote to memory of 4392	5004	smss.exe	160
PID 5004 wrote to memory of 4392	5004	smss.exe	160
PID 4392 wrote to memory of 540	4392	cmd.exe	162
PID 4392 wrote to memory of 540	4392	cmd.exe	162
PID 4392 wrote to memory of 1068	4392	cmd.exe	163
PID 4392 wrote to memory of 1068	4392	cmd.exe	163
PID 4392 wrote to memory of 1160	4392	cmd.exe	165
PID 4392 wrote to memory of 1160	4392	cmd.exe	165
PID 1160 wrote to memory of 4648	1160	smss.exe	168
PID 1160 wrote to memory of 4648	1160	smss.exe	168
PID 4648 wrote to memory of 740	4648	cmd.exe	170
PID 4648 wrote to memory of 740	4648	cmd.exe	170
PID 4648 wrote to memory of 3020	4648	cmd.exe	171
PID 4648 wrote to memory of 3020	4648	cmd.exe	171
PID 4648 wrote to memory of 1532	4648	cmd.exe	174
PID 4648 wrote to memory of 1532	4648	cmd.exe	174

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895.exe
"C:\Users\Admin\AppData\Local\Temp\58040788269169456e7831099188a99796227cac63cc28771496d9f97204b895.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Browserhost\H1Tsc0Ilqr3tfV2ZqDRU0epu1xRlbvhuJExp.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Browserhost\I0GR.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Browserhost\intoHostperf.exe
      "C:\Browserhost/intoHostperf.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:32
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bq5dui5h\bq5dui5h.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2836
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA09.tmp" "c:\Windows\System32\CSCF1A36CFE61B54F64888268A4E4B37B6.TMP"
        6⤵
        
        PID:4816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Browserhost\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Browserhost\intoHostperf.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kT4I0do5Jg.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5092
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1532
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1576
      - C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KZMa9uzHOO.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4940
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9mWviDJuKI.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2004
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1616
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I6hKBNza0Y.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:540
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1068
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ghJDzcD21F.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:740
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3020
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tV5RM9l7zq.bat"
        15⤵
        
        PID:3132
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3640
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4844
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ghJDzcD21F.bat"
        17⤵
        
        PID:4964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1612
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2476
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Fc24Cr0sci.bat"
        19⤵
        
        PID:4928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4812
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dYHSyFVcIa.bat"
        21⤵
        
        PID:4296
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1508
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:100
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RXbe2nqO2a.bat"
        23⤵
        
        PID:4884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2996
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4528
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p8DYq14q3H.bat"
        25⤵
        
        PID:1328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3172
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:3940
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I6hKBNza0Y.bat"
        27⤵
        
        PID:1700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:3596
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:704
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\336zK5Rer1.bat"
        29⤵
        
        PID:3024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:4460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:1772
        
        C:\Program Files (x86)\MSBuild\Microsoft\smss.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\smss.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Browserhost\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Browserhost\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Browserhost\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "intoHostperfi" /sc MINUTE /mo 10 /tr "'C:\Browserhost\intoHostperf.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "intoHostperf" /sc ONLOGON /tr "'C:\Browserhost\intoHostperf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "intoHostperfi" /sc MINUTE /mo 6 /tr "'C:\Browserhost\intoHostperf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Browserhost\H1Tsc0Ilqr3tfV2ZqDRU0epu1xRlbvhuJExp.vbe

Filesize
193B

MD5
469f076b98518fc3f174277ae4e7c6c2

SHA1
f47b8ee20d1901242563bca5949b2fc9b8dcce32

SHA256
27f62059a2e4543d324d2dc4b57fa3afccb086411ee077c136c9732800987dd9

SHA512
6bf0a52c4bb33945c00c637fb50298975f060f4209f6c5655352a656b239cf47d78f4e1088eb7d0df5cde52915e704cec485babfa33284b501394a06ac40c214

Download Submit
C:\Browserhost\I0GR.bat

Filesize
85B

MD5
fb60a3f4d062529781b1856a97f6d2a8

SHA1
1da3695e467be7e3a89ce9c7de7db683e6e438fe

SHA256
81fcf50eda7d7a8a0170239aee3d3741e2ab76d1aa7af8800c2e47cf182dcdf0

SHA512
1f99a3b004752db78fb8e9e4d097f866bad641cd196ccb6d639c40c4c3dda87b5e1a7a7836c8a276b965ac50f1b8b43731bf12d592cd5993938769d1196593e4

Download Submit
C:\Browserhost\intoHostperf.exe

Filesize
34.9MB

MD5
cadd0c3b32099635f889ba630c4697f4

SHA1
305f57ac6c6a0afbdc7666a6964bc2acbb2ed738

SHA256
cd91ce0978cf8df9a22d3275fd693ebc759263485550df913d837694fc3afcb4

SHA512
4712774b492b09866ed752404d248b87b595282b7b3b617c73ae1a029d5628c186e980768515eebdb950e1c89c11cb8ba47a382192400701d3dc961a98ea4714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smss.exe.log

Filesize
1KB

MD5
8ee01a9d8d8d1ecf515b687bf5e354ca

SHA1
c3b943dce30e425ae34e6737c7d5c3cdd92f79c5

SHA256
c45f52a36b283b46aae313b5a4fcbfbfb67b3c5ac4ee3ecd921087ddadb691a1

SHA512
6cb43253ddb3d2e5bdedcf76bc299e91ce970c6ccc53a2d9df7ba621435a6a704ce3990bdf59d939e513e609bab3daf8f110c1cca8485e1a9fe8536a67d41dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Temp\336zK5Rer1.bat

Filesize
225B

MD5
e2fdd7bc47da04ea3ffcb32af1a36be0

SHA1
d8f86a5222f3da2bd7e9d55fee47088310493ba2

SHA256
b7d7b00a7c29aec60aa37250ae201e06017c4d849163cb474bd5cbcf2ef2854f

SHA512
8fd98b062ec03abdbc956cea2e02a26abeca2440718ad41d948dcd825e8fefcd969d0852940f43e3655a0fbf3a57549eb321396c0b1c7c874fcef4cd75b8bb32

Download Submit
C:\Users\Admin\AppData\Local\Temp\9mWviDJuKI.bat

Filesize
177B

MD5
80c0a5110712750375a776cacbe38752

SHA1
ecdb69b0528a1be7e28955607284da94db5dcfa2

SHA256
fc49250e69b8f8f93f9bfa0034fd4b37c502bcdf24b2c15483af51dbd053a937

SHA512
ebb3aecf324456a9b7dd8078d0b5374a8c1635187e1ada6ce3350639fa90fb0dae21c0cf80300406456d5c852a2259ddff1f1378ec9cd6ed742e417817d3a7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fc24Cr0sci.bat

Filesize
225B

MD5
e73899393318c9bde9e6ae130b4d678f

SHA1
7957bf29003437e2fda98ec5be4d1cdd0b90e206

SHA256
635b1fa587f424264600bc1d08bdd4620ea4e63960cbe31b49edbd7c3e7e0456

SHA512
68564672083d7040a4a6dc25ce08e0f792103b92db6f2251eba0fca47368755a222edef7a1b8b21fc2c09034f5a410efe32c50b01616490f5c2133223e29485d

Download Submit
C:\Users\Admin\AppData\Local\Temp\I6hKBNza0Y.bat

Filesize
177B

MD5
7baff04ddf3c1e720bf89f97ba702736

SHA1
4f7452c314cee3c5398cf04cee567fb9aaf5f996

SHA256
5ac07273bdeb95a243b97b5acc75ac0908ef9adac5d0893f3c8ec1e854f839c6

SHA512
88d044b6add135bb5548c58a637aea8fc6f57a118e954e6b27d4bb0dd31040f1e16aaa66e69971d1e3dbba379cd0468bfdb12073b09bcef30d4ba80ff3e0e81e

Download Submit
C:\Users\Admin\AppData\Local\Temp\KZMa9uzHOO.bat

Filesize
225B

MD5
16fa4ceac8b56e1f5b60ccd3803fa22d

SHA1
74de5f624ac56be1e002e365883ac049ef077010

SHA256
5171697e3fc79b103874a415527687679ea4b8e21e5575123aaa0049d667d65b

SHA512
2cf6e09633a94ba76f3dc353ae8ec927c3a8fd2e5ceaa6dfb8581bb6bf282de20ab673e08129efe274b36a8e5ec285bc270e32849e16c8bd7bb80521ca8ec778

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBA09.tmp

Filesize
1KB

MD5
b3fc9abfeac8e81f43730b851c3e11bb

SHA1
c8b2ccc974c483ed188e542ed000e890cb1e8e00

SHA256
73266aeec53273252e1d0aae3a9d65b3441d145a98a369851fcc3dc8d5866a6f

SHA512
4fa98255d336bd120cc6fc0598347f0a3ee2fa2df9f7a8edfd73fc7a541b6bc8383694e3b5168dc441ad6a7215cb43085a661fd06b89470711b5d5494fb1c64b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RXbe2nqO2a.bat

Filesize
177B

MD5
469f6c1e334635b95a91c7a9621e3397

SHA1
5ad9cae1d31927c56aceb376e472cf03f66919b2

SHA256
d8a8e3dafabdc564d17d6e0909945bb145e096e5d67bb1deab01e483199aa684

SHA512
9dac74633df3113e8611cc2d00f5903a19b632fbbd7485fe55065cdf28575c3ff537b10dc4ba2c3c1cf75d385c1ba0f38ab9692ed8383562c0868d4d97664a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g4sjs5nd.xpn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dYHSyFVcIa.bat

Filesize
225B

MD5
a47750da418dcd5bcdd7867dd9a5dc2d

SHA1
4b86f652608a22caea6d2bb91c1485c61d261bc7

SHA256
578424b3cf1dc6b29f5101d4f943bbec1b6be7f029aec044b88d70a2edddad7d

SHA512
6adada8e17f5ffdbea16dced59a84e11ffd063d5308b53c6da976f1587e415a56c794807eeba9e5a0b63aa5578293d2368739ab2169df997131b17754e5613d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ghJDzcD21F.bat

Filesize
177B

MD5
3e53ae054c2666291932f12122442b14

SHA1
54bd50965d994d96a1d84999ac1be9efda73f237

SHA256
ceab57324a1989556d5da9bab75081ff5270a5b50dfd6bf949ab76d3ba171547

SHA512
9cb14262569164141ce0d166a760f1f1e3d781cc1195fa81a57728d2ae9d3e57477b3c09313747f4fc353faac8b2e96d9c5f3ada566e1af14ffe90f24e70bbd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\kT4I0do5Jg.bat

Filesize
225B

MD5
bc5b6c908b657f67ccd9196213a0c929

SHA1
a6cb2d100500b0f4ba92423c3b665e8bb54a3362

SHA256
782519f3c369795a9506c5af771b63b3202e24fbbb6d47f7f10c86f9b7e4ac03

SHA512
eb3291b43e20687c4162bda6cc4e9c50ce3233935bd8e489a64804d46ba84b4f8ff96fba3c83b2fd7d97e7cc4ff5c05259dda7dd6bca6bbbe99f0e9f60d8ab4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\p8DYq14q3H.bat

Filesize
225B

MD5
5447088e82ebe9c860e27ca0993d5d1b

SHA1
8eaf10ab15ad592fae6f962b87e3ad4a0ba43b59

SHA256
e45cc0fd934e71cd0fb4ae89e2db442ee0987985b98976271118cb118aa3d318

SHA512
d191989351b30c413ceead82c69f57c1c0e511918f9650e3efcd75f63058a6069dddcc68092cffa2a338d5a4591a7b38794e0687515c53d4feccf44a7d2dd87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tV5RM9l7zq.bat

Filesize
177B

MD5
7bc82c244001da64ca0f1082d9c75389

SHA1
05cd404cc1c306dd124317593c15d6bd36c4641e

SHA256
3f39ef0258fe621a0bf126d03c15132e74089c0386a6e855581f68015de3a2f2

SHA512
b16403c9f11f00fdf5e8632a6502f9d071fbefa8b31c12053706f47655aa2d462ed12915285b4183180cede2a0ad19b51e791e03932843ef84b7ed4bab3710a0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bq5dui5h\bq5dui5h.0.cs

Filesize
370B

MD5
3116a5bbf95fb8736ab96b62fd0ce893

SHA1
306888d939e0910368473fd90f3789882e1ea556

SHA256
a4c5585107a25f6d057d7aa558cc8f0be13b2c5886791eec638134fc04885936

SHA512
4018a0b1f54252aeb2b9d787bb4d27c532eba3786318bb250c7713e54750a3161fe136db43a1539084f790f0697b6ae2f7aefaa0d9eedf47bc84f1ffe305a521

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bq5dui5h\bq5dui5h.cmdline

Filesize
235B

MD5
abbcba812e05c148ae60c7b782878f31

SHA1
aa2d7dc3322998ee21a1dead5dd7c77af3673b0d

SHA256
05f650070134e6492d0a93e1707e143593755e04b64fae033ce7a35691b2a91b

SHA512
4d7abeb61edee032ee6013059db85073e0c8793c1d6c05365a628e788349b0841f4fc087897b0ca2b30cc93ee19449442779076df4f1cfffb59b174eac569129

Download Submit
\??\c:\Windows\System32\CSCF1A36CFE61B54F64888268A4E4B37B6.TMP

Filesize
1KB

MD5
be99f41194f5159cc131a1a4353a0e0a

SHA1
f24e3bf06e777b4de8d072166cff693e43f2295c

SHA256
564d9051e5639603c83562a9ff2c2e478cc7e13d54faf39f761297bac78603bf

SHA512
51d1a50772bb7d689193e6a9b2e363185cf5438103644b2b68cf13e08274c5d99407b99f8cdc856143d28669f5ee4ee316041a8e33df42f55bfd181aa3f3c0f5

Download Submit
memory/32-41-0x000000001C970000-0x000000001C97E000-memory.dmp

Filesize
56KB

Download
memory/32-106-0x000000001CF10000-0x000000001CF5E000-memory.dmp

Filesize
312KB

Download
memory/32-53-0x000000001CA70000-0x000000001CA7E000-memory.dmp

Filesize
56KB

Download
memory/32-55-0x000000001CB10000-0x000000001CB28000-memory.dmp

Filesize
96KB

Download
memory/32-57-0x000000001CA80000-0x000000001CA8C000-memory.dmp

Filesize
48KB

Download
memory/32-59-0x000000001CB80000-0x000000001CBCE000-memory.dmp

Filesize
312KB

Download
memory/32-49-0x000000001CA50000-0x000000001CA5E000-memory.dmp

Filesize
56KB

Download
memory/32-47-0x000000001CAB0000-0x000000001CB0A000-memory.dmp

Filesize
360KB

Download
memory/32-45-0x000000001CA00000-0x000000001CA10000-memory.dmp

Filesize
64KB

Download
memory/32-43-0x000000001C9F0000-0x000000001CA00000-memory.dmp

Filesize
64KB

Download
memory/32-19-0x000000001C910000-0x000000001C92C000-memory.dmp

Filesize
112KB

Download
memory/32-39-0x000000001CF80000-0x000000001D4A8000-memory.dmp

Filesize
5.2MB

Download
memory/32-99-0x000000001D5B0000-0x000000001D659000-memory.dmp

Filesize
676KB

Download
memory/32-24-0x000000001C930000-0x000000001C948000-memory.dmp

Filesize
96KB

Download
memory/32-38-0x000000001CA30000-0x000000001CA42000-memory.dmp

Filesize
72KB

Download
memory/32-36-0x000000001CA10000-0x000000001CA26000-memory.dmp

Filesize
88KB

Download
memory/32-34-0x000000001C960000-0x000000001C970000-memory.dmp

Filesize
64KB

Download
memory/32-32-0x000000001C9D0000-0x000000001C9E2000-memory.dmp

Filesize
72KB

Download
memory/32-12-0x00007FF9087C3000-0x00007FF9087C5000-memory.dmp

Filesize
8KB

Download
memory/32-20-0x000000001C980000-0x000000001C9D0000-memory.dmp

Filesize
320KB

Download
memory/32-22-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/32-30-0x000000001C950000-0x000000001C95E000-memory.dmp

Filesize
56KB

Download
memory/32-28-0x000000001C900000-0x000000001C910000-memory.dmp

Filesize
64KB

Download
memory/32-13-0x0000000000450000-0x00000000007DE000-memory.dmp

Filesize
3.6MB

Download
memory/32-15-0x000000001B500000-0x000000001B526000-memory.dmp

Filesize
152KB

Download
memory/32-26-0x000000001C8F0000-0x000000001C900000-memory.dmp

Filesize
64KB

Download
memory/32-17-0x0000000002870000-0x000000000287E000-memory.dmp

Filesize
56KB

Download
memory/32-51-0x000000001CA60000-0x000000001CA70000-memory.dmp

Filesize
64KB

Download
memory/1044-93-0x000001C67CAE0000-0x000001C67CB02000-memory.dmp

Filesize
136KB

Download
memory/1160-281-0x000000001DD50000-0x000000001DDF9000-memory.dmp

Filesize
676KB

Download
memory/1160-282-0x000000001EA70000-0x000000001EABE000-memory.dmp

Filesize
312KB

Download
memory/1532-312-0x000000001DA10000-0x000000001DA5E000-memory.dmp

Filesize
312KB

Download
memory/1532-311-0x000000001D760000-0x000000001D809000-memory.dmp

Filesize
676KB

Download
memory/1624-522-0x000000001DD30000-0x000000001DD7E000-memory.dmp

Filesize
312KB

Download
memory/1624-521-0x000000001CCC0000-0x000000001CD69000-memory.dmp

Filesize
676KB

Download
memory/2068-372-0x000000001D4B0000-0x000000001D4FE000-memory.dmp

Filesize
312KB

Download
memory/2068-371-0x000000001D200000-0x000000001D2A9000-memory.dmp

Filesize
676KB

Download
memory/2700-401-0x000000001D5A0000-0x000000001D649000-memory.dmp

Filesize
676KB

Download
memory/2700-402-0x000000001D850000-0x000000001D89E000-memory.dmp

Filesize
312KB

Download
memory/3024-221-0x000000001D440000-0x000000001D4E9000-memory.dmp

Filesize
676KB

Download
memory/3024-222-0x000000001E3D0000-0x000000001E41E000-memory.dmp

Filesize
312KB

Download
memory/3200-492-0x000000001DF10000-0x000000001DF5E000-memory.dmp

Filesize
312KB

Download
memory/3200-491-0x000000001CE80000-0x000000001CF29000-memory.dmp

Filesize
676KB

Download
memory/3932-189-0x000000001D150000-0x000000001D1F9000-memory.dmp

Filesize
676KB

Download
memory/3932-190-0x000000001D300000-0x000000001D402000-memory.dmp

Filesize
1.0MB

Download
memory/3932-191-0x000000001BFB0000-0x000000001BFFE000-memory.dmp

Filesize
312KB

Download
memory/4912-342-0x000000001E410000-0x000000001E45E000-memory.dmp

Filesize
312KB

Download
memory/4912-341-0x000000001D7D0000-0x000000001D879000-memory.dmp

Filesize
676KB

Download
memory/4948-432-0x000000001DAD0000-0x000000001DB1E000-memory.dmp

Filesize
312KB

Download
memory/4948-431-0x000000001D920000-0x000000001D9C9000-memory.dmp

Filesize
676KB

Download
memory/5004-252-0x000000001F090000-0x000000001F0DE000-memory.dmp

Filesize
312KB

Download
memory/5004-251-0x000000001E370000-0x000000001E419000-memory.dmp

Filesize
676KB

Download
memory/5088-462-0x000000001E9F0000-0x000000001EA3E000-memory.dmp

Filesize
312KB

Download
memory/5088-461-0x000000001D960000-0x000000001DA09000-memory.dmp

Filesize
676KB

Download