dcrat | 1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48

Analysis

max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
Size

1.7MB
MD5

2865c19b41d7790e761e3375174b8b2e
SHA1

745a04eeee90df0823e8b3c7b0e1b297646acda1
SHA256

1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48
SHA512

c76edaee744073ffdc32a4a15448b1b6faaac07ecce7792f06e352868a9ab4b68e3bdbf07b58b95bdeb7d4f3e8ea95979576769253390550a9dd25ec313bd4aa
SSDEEP

49152:j+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKvx:OTHUxUoh1IF9gl2q

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	5004	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	5004	schtasks.exe	85

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/372-1-0x0000000000A30000-0x0000000000BF0000-memory.dmp	dcrat
behavioral2/files/0x0008000000023ce4-33.dat	dcrat
behavioral2/files/0x000b000000023ce4-67.dat	dcrat
behavioral2/files/0x0007000000023ce0-241.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4448	powershell.exe
2168	powershell.exe
4852	powershell.exe
2344	powershell.exe
4120	powershell.exe
796	powershell.exe
3820	powershell.exe
3352	powershell.exe
2232	powershell.exe
3624	powershell.exe
4564	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 7 IoCs

pid	Process
4568	fontdrvhost.exe
4468	fontdrvhost.exe
2216	fontdrvhost.exe
2312	fontdrvhost.exe
4252	fontdrvhost.exe
756	fontdrvhost.exe
2240	fontdrvhost.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXDD82.tmp	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File created	C:\Program Files (x86)\Windows Mail\TextInputHost.exe	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\TextInputHost.exe	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File created	C:\Program Files (x86)\Windows Mail\22eafd247d37c3	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXDD71.tmp	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\IdentityCRL\production\dwm.exe	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File created	C:\Windows\IdentityCRL\production\6cb0b6c459d5d3	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File opened for modification	C:\Windows\Globalization\Time Zone\RCXDF96.tmp	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File opened for modification	C:\Windows\Globalization\Time Zone\RCXDFA7.tmp	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File opened for modification	C:\Windows\Globalization\Time Zone\RuntimeBroker.exe	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File opened for modification	C:\Windows\IdentityCRL\production\RCXE1BB.tmp	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File opened for modification	C:\Windows\IdentityCRL\production\dwm.exe	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File created	C:\Windows\Globalization\Time Zone\RuntimeBroker.exe	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File opened for modification	C:\Windows\IdentityCRL\production\RCXE239.tmp	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
File created	C:\Windows\Globalization\Time Zone\9e8d7a4ca61bd9	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1872	schtasks.exe
3048	schtasks.exe
3144	schtasks.exe
3320	schtasks.exe
2476	schtasks.exe
3640	schtasks.exe
2012	schtasks.exe
4092	schtasks.exe
2312	schtasks.exe
4488	schtasks.exe
1836	schtasks.exe
3160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
2232	powershell.exe
2232	powershell.exe
4120	powershell.exe
4120	powershell.exe
4852	powershell.exe
4852	powershell.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
3624	powershell.exe
3624	powershell.exe
2168	powershell.exe
2168	powershell.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
4564	powershell.exe
4564	powershell.exe
4448	powershell.exe
4448	powershell.exe
2344	powershell.exe
2344	powershell.exe
796	powershell.exe
796	powershell.exe
3352	powershell.exe
3352	powershell.exe
3820	powershell.exe
3820	powershell.exe
3352	powershell.exe
4564	powershell.exe
2232	powershell.exe
4852	powershell.exe
3624	powershell.exe
4120	powershell.exe
2168	powershell.exe
3820	powershell.exe
796	powershell.exe
372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
4448	powershell.exe
2344	powershell.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe
4568	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	3820	powershell.exe
Token: SeDebugPrivilege	4568	fontdrvhost.exe
Token: SeDebugPrivilege	4468	fontdrvhost.exe
Token: SeDebugPrivilege	2216	fontdrvhost.exe
Token: SeDebugPrivilege	2312	fontdrvhost.exe
Token: SeDebugPrivilege	4252	fontdrvhost.exe
Token: SeDebugPrivilege	756	fontdrvhost.exe
Token: SeDebugPrivilege	2240	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 796	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	99
PID 372 wrote to memory of 796	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	99
PID 372 wrote to memory of 3624	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	100
PID 372 wrote to memory of 3624	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	100
PID 372 wrote to memory of 4564	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	101
PID 372 wrote to memory of 4564	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	101
PID 372 wrote to memory of 3352	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	102
PID 372 wrote to memory of 3352	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	102
PID 372 wrote to memory of 2232	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	103
PID 372 wrote to memory of 2232	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	103
PID 372 wrote to memory of 3820	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	104
PID 372 wrote to memory of 3820	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	104
PID 372 wrote to memory of 4448	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	105
PID 372 wrote to memory of 4448	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	105
PID 372 wrote to memory of 2168	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	106
PID 372 wrote to memory of 2168	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	106
PID 372 wrote to memory of 4852	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	107
PID 372 wrote to memory of 4852	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	107
PID 372 wrote to memory of 2344	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	108
PID 372 wrote to memory of 2344	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	108
PID 372 wrote to memory of 4120	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	109
PID 372 wrote to memory of 4120	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	109
PID 372 wrote to memory of 4568	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	121
PID 372 wrote to memory of 4568	372	1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe	121
PID 4568 wrote to memory of 2012	4568	fontdrvhost.exe	123
PID 4568 wrote to memory of 2012	4568	fontdrvhost.exe	123
PID 4568 wrote to memory of 3680	4568	fontdrvhost.exe	124
PID 4568 wrote to memory of 3680	4568	fontdrvhost.exe	124
PID 2012 wrote to memory of 4468	2012	WScript.exe	136
PID 2012 wrote to memory of 4468	2012	WScript.exe	136
PID 4468 wrote to memory of 4564	4468	fontdrvhost.exe	138
PID 4468 wrote to memory of 4564	4468	fontdrvhost.exe	138
PID 4468 wrote to memory of 3672	4468	fontdrvhost.exe	139
PID 4468 wrote to memory of 3672	4468	fontdrvhost.exe	139
PID 4564 wrote to memory of 2216	4564	WScript.exe	144
PID 4564 wrote to memory of 2216	4564	WScript.exe	144
PID 2216 wrote to memory of 548	2216	fontdrvhost.exe	146
PID 2216 wrote to memory of 548	2216	fontdrvhost.exe	146
PID 2216 wrote to memory of 1132	2216	fontdrvhost.exe	147
PID 2216 wrote to memory of 1132	2216	fontdrvhost.exe	147
PID 548 wrote to memory of 2312	548	WScript.exe	148
PID 548 wrote to memory of 2312	548	WScript.exe	148
PID 2312 wrote to memory of 2740	2312	fontdrvhost.exe	150
PID 2312 wrote to memory of 2740	2312	fontdrvhost.exe	150
PID 2312 wrote to memory of 3972	2312	fontdrvhost.exe	151
PID 2312 wrote to memory of 3972	2312	fontdrvhost.exe	151
PID 2740 wrote to memory of 4252	2740	WScript.exe	152
PID 2740 wrote to memory of 4252	2740	WScript.exe	152
PID 4252 wrote to memory of 1384	4252	fontdrvhost.exe	154
PID 4252 wrote to memory of 1384	4252	fontdrvhost.exe	154
PID 4252 wrote to memory of 1836	4252	fontdrvhost.exe	155
PID 4252 wrote to memory of 1836	4252	fontdrvhost.exe	155
PID 1384 wrote to memory of 756	1384	WScript.exe	156
PID 1384 wrote to memory of 756	1384	WScript.exe	156
PID 756 wrote to memory of 3472	756	fontdrvhost.exe	158
PID 756 wrote to memory of 3472	756	fontdrvhost.exe	158
PID 756 wrote to memory of 3892	756	fontdrvhost.exe	159
PID 756 wrote to memory of 3892	756	fontdrvhost.exe	159
PID 3472 wrote to memory of 2240	3472	WScript.exe	160
PID 3472 wrote to memory of 2240	3472	WScript.exe	160
PID 2240 wrote to memory of 2964	2240	fontdrvhost.exe	162
PID 2240 wrote to memory of 2964	2240	fontdrvhost.exe	162
PID 2240 wrote to memory of 2248	2240	fontdrvhost.exe	163
PID 2240 wrote to memory of 2248	2240	fontdrvhost.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe
"C:\Users\Admin\AppData\Local\Temp\1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4120
- C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
  "C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06e3dd1a-243e-443f-8e93-23b9af36d815.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
      C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fde11bac-5690-459e-8bda-a77e2a69b483.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4564
      - C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c703ac2-f70f-4b22-89e8-c24fb2397793.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0bc8ece-116d-4e6c-846b-6b925483b391.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\443135a2-9617-4a17-9857-367bd452950c.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f8da1dc-096a-410a-a493-cf2f42c520e8.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
        
        C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9368e2a8-3680-42a8-8baf-97deffd485f3.vbs"
        15⤵
        
        PID:2964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\694f10f7-ef32-4462-a4ca-7dd35e49aea2.vbs"
        15⤵
        
        PID:2248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69622d28-9e89-4e5e-bae2-1a96c32f8e8d.vbs"
        13⤵
        
        PID:3892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\371aad88-2270-4021-969a-d8962a94815e.vbs"
        11⤵
        
        PID:1836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c31c1c57-dfb9-47d1-b53b-25adea7b712f.vbs"
        9⤵
        
        PID:3972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31379284-1d26-4017-93e5-38cf65b23dc1.vbs"
        7⤵
        
        PID:1132
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4fe51e8e-dc08-46c1-a473-227e6a2554b1.vbs"
        5⤵
        
        PID:3672
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d8f9d26-334e-4329-9e34-51e717a457b7.vbs"
    3⤵
    PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Globalization\Time Zone\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Globalization\Time Zone\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\Time Zone\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\IdentityCRL\production\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\IdentityCRL\production\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\06e3dd1a-243e-443f-8e93-23b9af36d815.vbs

Filesize
726B

MD5
36f0781cfb27ad72b86e88beab50744d

SHA1
2c94fb8f6331a8df441a9f477d1d010ea89efcae

SHA256
779ba699c189e05470aaeb5173ede4d4be0f8586c4f7201444ec753399664f34

SHA512
cb388c9a92163a72f469aea10954c2b0d1775ee605743ad1734cfc6ea7f681d39997cbb3aaa134cfe6ed74933757812d9fa766689b38d4dc97dc89d90e5d32c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2d8f9d26-334e-4329-9e34-51e717a457b7.vbs

Filesize
502B

MD5
a4130749ca9be199ab943b85d67ba112

SHA1
cc4b9a4e67437755882b3b628a2db915c4ef5da7

SHA256
1ada7c3af2e4bb5d46db4a9a9b5a05f1bb8bd3eda7fdd05029cf03326acc9dab

SHA512
faf473e6251c0f1fa42a60ecd16558370db0c28f88e5bcd047edde45e3132431f6fc4b434cd5bea70358fd3db201fc6c35971a8b1bf34eb73f0cd4dd926f85d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\443135a2-9617-4a17-9857-367bd452950c.vbs

Filesize
726B

MD5
d86f5bd4439545781e36fa36bac359df

SHA1
48921cfb93b25f60a9e8b6f8deb4eda7ff1e5885

SHA256
9fd1d807dbfbb5dd41c349e9d0b581771b2896eb17a78409261d72f982aa2e4c

SHA512
30c7f796f0decaf4a73364467d2ba2c5c5bad4a2acec53f5450f1e91a0e60d68465b270aea13a013b48831dca4c2ceb600f444ada2a508f9dc929bce152cc704

Download Submit
C:\Users\Admin\AppData\Local\Temp\6c703ac2-f70f-4b22-89e8-c24fb2397793.vbs

Filesize
726B

MD5
0d51292d2673b7541dcb765cd3de6214

SHA1
f1fedcc67b75acf9d384595e08640b2eae7df562

SHA256
1fec7621374e711ec11469b18636da6c497dc1309ee5044a3e51b4f6caa3cab1

SHA512
15c4381da9cd6d5af2b6a56430fdb1e9193432aca9a9fba5ad43947c27c67d0355e905e3e48fc51bff0eb64d44e7d9de922e1f66bb03dca0a978e28616c7c542

Download Submit
C:\Users\Admin\AppData\Local\Temp\6f8da1dc-096a-410a-a493-cf2f42c520e8.vbs

Filesize
725B

MD5
4d3d183baad8d204969c1ef4987e990d

SHA1
fd8516d0f3c3cdd853075fbff983408b3d8126d0

SHA256
b01065f7caa67d97aeee159e970464a84df76a531900486ff71282db30eb7381

SHA512
648c08f15a22966fb4ea09ad939dd9ec03ef6337253bdf8c5c02f91f255728c93d0b0e0a5023325d07a78015cb04e16a1b25b85ecdb9341342f168e0b1635d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\9368e2a8-3680-42a8-8baf-97deffd485f3.vbs

Filesize
726B

MD5
7e3cdac50946df019b9ab44aa4c960e0

SHA1
7c7a5ffe88b3f9349333d41e367530716861d05d

SHA256
c7db042087e2c076772fc6ae9da3de5d2c354bd50f71191ba8b97bd0b8eec8f9

SHA512
9868424ff661cac15ddfd210442f1335566a472c2c4fea97a14beb52e871e80a233569498ea6d77be10e27053c158c0f1d4f41a30100492a0aa39a342a604186

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCXDB5D.tmp

Filesize
1.7MB

MD5
64a7d53536484c80f3816ac58f6561f0

SHA1
65ed3b9c78a1412f99fd3b760bba46cb33e109e0

SHA256
5e0f73566b5c6d171393cdc5d2cbec8ae6f8c7afd37e0bac19aed41e556174d8

SHA512
722e81ebd97480de4a29fc1a5322076a160d3a332b59a7aaaf99797f7d9d558e6a5fd45aa0146c9504d8c4dcc725d33429b25fccd2289a316896297e1e4ce3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nuq0y44c.tvg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\f0bc8ece-116d-4e6c-846b-6b925483b391.vbs

Filesize
726B

MD5
28875e590b9b8497ac20976e43030f2a

SHA1
3940539bfeb2918128af27f234a3d94bfa29f408

SHA256
3dcb9eaede27481e2132b7488954afaab5141141c3e9efbc449b60821a53751a

SHA512
9871d049b01b4dba85cc7fdb5b5c4ca16e5987fa5f2deb1b7550cb94e4d0629e5d9c51967cb11ac982c186d36326ad52f09420596d2239aea3515f77555aee89

Download Submit
C:\Users\Admin\AppData\Local\Temp\fde11bac-5690-459e-8bda-a77e2a69b483.vbs

Filesize
726B

MD5
7af21a4b2ed259233c03426f408d91cd

SHA1
4d207c6e7ee70e4c49eb15841c1fecf2dc5af2ab

SHA256
3fd74694cade4136680bda55e0d4c59833b0de21244f7d91bd4a961b15626633

SHA512
29c74d1951fb4d1b8679ebe4e923d2e00131bbc013ad31317eda6b65cefaa6df7d340258e390b9219bc2eca956c92face9bebc00bf2f551bef5938115aa28839

Download Submit
C:\Users\Admin\AppData\Roaming\Sun\fontdrvhost.exe

Filesize
1.7MB

MD5
2865c19b41d7790e761e3375174b8b2e

SHA1
745a04eeee90df0823e8b3c7b0e1b297646acda1

SHA256
1f861816998420f9cf99ee91c77fe8cb5fb3ff7750caaed27e0570aa35a7bb48

SHA512
c76edaee744073ffdc32a4a15448b1b6faaac07ecce7792f06e352868a9ab4b68e3bdbf07b58b95bdeb7d4f3e8ea95979576769253390550a9dd25ec313bd4aa

Download Submit
C:\Windows\IdentityCRL\production\dwm.exe

Filesize
1.7MB

MD5
e364cfc57230abf19d9f76d62d11dce6

SHA1
44628cbb27066f652abba2f0e48585dfeeb49165

SHA256
2b1ee62d636d550f12a4fb369c76b40b294ce1db4e8821ced6cdabdf0a609923

SHA512
008b143f50adb1c13ca20d629a22d371cfbf5acb6bfa578aacdef3c3f09f331143931359a6dad91b51d62356fe92100b0bb2c17010b00db22648aaa7aece5de9

Download Submit
memory/372-12-0x000000001BEF0000-0x000000001BF02000-memory.dmp

Filesize
72KB

Download
memory/372-6-0x0000000002D30000-0x0000000002D40000-memory.dmp

Filesize
64KB

Download
memory/372-22-0x00007FFBF2980000-0x00007FFBF3441000-memory.dmp

Filesize
10.8MB

Download
memory/372-0-0x00007FFBF2983000-0x00007FFBF2985000-memory.dmp

Filesize
8KB

Download
memory/372-10-0x0000000002DD0000-0x0000000002DD8000-memory.dmp

Filesize
32KB

Download
memory/372-15-0x000000001C030000-0x000000001C03A000-memory.dmp

Filesize
40KB

Download
memory/372-16-0x000000001C040000-0x000000001C04E000-memory.dmp

Filesize
56KB

Download
memory/372-242-0x00007FFBF2980000-0x00007FFBF3441000-memory.dmp

Filesize
10.8MB

Download
memory/372-17-0x000000001C050000-0x000000001C058000-memory.dmp

Filesize
32KB

Download
memory/372-18-0x000000001C160000-0x000000001C16C000-memory.dmp

Filesize
48KB

Download
memory/372-14-0x000000001BF20000-0x000000001BF2C000-memory.dmp

Filesize
48KB

Download
memory/372-13-0x000000001C450000-0x000000001C978000-memory.dmp

Filesize
5.2MB

Download
memory/372-19-0x000000001C170000-0x000000001C17C000-memory.dmp

Filesize
48KB

Download
memory/372-1-0x0000000000A30000-0x0000000000BF0000-memory.dmp

Filesize
1.8MB

Download
memory/372-3-0x0000000002D00000-0x0000000002D1C000-memory.dmp

Filesize
112KB

Download
memory/372-7-0x0000000002D40000-0x0000000002D56000-memory.dmp

Filesize
88KB

Download
memory/372-8-0x0000000002D60000-0x0000000002D70000-memory.dmp

Filesize
64KB

Download
memory/372-2-0x00007FFBF2980000-0x00007FFBF3441000-memory.dmp

Filesize
10.8MB

Download
memory/372-5-0x0000000002D20000-0x0000000002D28000-memory.dmp

Filesize
32KB

Download
memory/372-23-0x00007FFBF2980000-0x00007FFBF3441000-memory.dmp

Filesize
10.8MB

Download
memory/372-4-0x0000000002D70000-0x0000000002DC0000-memory.dmp

Filesize
320KB

Download
memory/372-9-0x0000000002DC0000-0x0000000002DCC000-memory.dmp

Filesize
48KB

Download
memory/756-331-0x000000001C700000-0x000000001C802000-memory.dmp

Filesize
1.0MB

Download
memory/2232-137-0x0000022BA9410000-0x0000022BA9432000-memory.dmp

Filesize
136KB

Download
memory/2240-333-0x0000000002AE0000-0x0000000002AF2000-memory.dmp

Filesize
72KB

Download
memory/2240-344-0x000000001C020000-0x000000001C122000-memory.dmp

Filesize
1.0MB

Download
memory/4468-276-0x0000000003000000-0x0000000003012000-memory.dmp

Filesize
72KB

Download