dcrat | 4e5088984e5d2304a531271ae248973b36e6d96a7f48f0dc56a92ffd951452fc

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
Size

1.6MB
MD5

f82f2ef304088a6c70fb7c56d7453d4d
SHA1

ec83164a34f06f452b81cbe1e80481c56dc89d9c
SHA256

051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9
SHA512

cd75c63375de66ea9d6954252058a2e4d89cdb2d54d907424fa72a09c1ab5f3d9d2426eff93090606cf015d71bd7b509bf1eb7d94421811b1b445a15cdb9ddb8
SSDEEP

24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5472	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	3400	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	3400	schtasks.exe	88

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral10/memory/4556-1-0x0000000000D10000-0x0000000000EB2000-memory.dmp	dcrat
behavioral10/files/0x0007000000024237-26.dat	dcrat
behavioral10/files/0x00080000000241fc-41.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe
5668	powershell.exe
4208	powershell.exe
5760	powershell.exe
5160	powershell.exe
2340	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	backgroundTaskHost.exe

Executes dropped EXE 13 IoCs

pid	Process
1216	backgroundTaskHost.exe
3848	backgroundTaskHost.exe
1596	backgroundTaskHost.exe
4524	backgroundTaskHost.exe
4488	backgroundTaskHost.exe
2548	backgroundTaskHost.exe
3688	backgroundTaskHost.exe
2632	backgroundTaskHost.exe
4416	backgroundTaskHost.exe
212	backgroundTaskHost.exe
4524	backgroundTaskHost.exe
5160	backgroundTaskHost.exe
5752	backgroundTaskHost.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhostw.exe	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX7078.tmp	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhostw.exe	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
File created	C:\Program Files (x86)\Windows Mail\6cb0b6c459d5d3	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\RCX6C4D.tmp	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX7077.tmp	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\dwm.exe	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\ea9f0e6c9e2dcd	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
File created	C:\Program Files (x86)\Windows Mail\dwm.exe	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\RCX6C4E.tmp	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	backgroundTaskHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4528	schtasks.exe
4720	schtasks.exe
4516	schtasks.exe
4752	schtasks.exe
4308	schtasks.exe
4756	schtasks.exe
5472	schtasks.exe
4588	schtasks.exe
3824	schtasks.exe
4636	schtasks.exe
4916	schtasks.exe
4700	schtasks.exe
4616	schtasks.exe
4568	schtasks.exe
4728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
5668	powershell.exe
5668	powershell.exe
5160	powershell.exe
5160	powershell.exe
4972	powershell.exe
4972	powershell.exe
5760	powershell.exe
5760	powershell.exe
2340	powershell.exe
2340	powershell.exe
5668	powershell.exe
4208	powershell.exe
4208	powershell.exe
5160	powershell.exe
5760	powershell.exe
2340	powershell.exe
4972	powershell.exe
4208	powershell.exe
1216	backgroundTaskHost.exe
1216	backgroundTaskHost.exe
3848	backgroundTaskHost.exe
1596	backgroundTaskHost.exe
4524	backgroundTaskHost.exe
4524	backgroundTaskHost.exe
4488	backgroundTaskHost.exe
4488	backgroundTaskHost.exe
2548	backgroundTaskHost.exe
2548	backgroundTaskHost.exe
3688	backgroundTaskHost.exe
2632	backgroundTaskHost.exe
2632	backgroundTaskHost.exe
4416	backgroundTaskHost.exe
212	backgroundTaskHost.exe
4524	backgroundTaskHost.exe
5160	backgroundTaskHost.exe
5752	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
Token: SeDebugPrivilege	5668	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	1216	backgroundTaskHost.exe
Token: SeDebugPrivilege	3848	backgroundTaskHost.exe
Token: SeDebugPrivilege	1596	backgroundTaskHost.exe
Token: SeDebugPrivilege	4524	backgroundTaskHost.exe
Token: SeDebugPrivilege	4488	backgroundTaskHost.exe
Token: SeDebugPrivilege	2548	backgroundTaskHost.exe
Token: SeDebugPrivilege	3688	backgroundTaskHost.exe
Token: SeDebugPrivilege	2632	backgroundTaskHost.exe
Token: SeDebugPrivilege	4416	backgroundTaskHost.exe
Token: SeDebugPrivilege	212	backgroundTaskHost.exe
Token: SeDebugPrivilege	4524	backgroundTaskHost.exe
Token: SeDebugPrivilege	5160	backgroundTaskHost.exe
Token: SeDebugPrivilege	5752	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4972	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	111
PID 4556 wrote to memory of 4972	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	111
PID 4556 wrote to memory of 2340	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	112
PID 4556 wrote to memory of 2340	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	112
PID 4556 wrote to memory of 5160	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	113
PID 4556 wrote to memory of 5160	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	113
PID 4556 wrote to memory of 5760	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	114
PID 4556 wrote to memory of 5760	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	114
PID 4556 wrote to memory of 4208	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	115
PID 4556 wrote to memory of 4208	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	115
PID 4556 wrote to memory of 5668	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	116
PID 4556 wrote to memory of 5668	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	116
PID 4556 wrote to memory of 1216	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	123
PID 4556 wrote to memory of 1216	4556	051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe	123
PID 1216 wrote to memory of 924	1216	backgroundTaskHost.exe	124
PID 1216 wrote to memory of 924	1216	backgroundTaskHost.exe	124
PID 1216 wrote to memory of 3068	1216	backgroundTaskHost.exe	125
PID 1216 wrote to memory of 3068	1216	backgroundTaskHost.exe	125
PID 924 wrote to memory of 3848	924	WScript.exe	128
PID 924 wrote to memory of 3848	924	WScript.exe	128
PID 3848 wrote to memory of 4748	3848	backgroundTaskHost.exe	130
PID 3848 wrote to memory of 4748	3848	backgroundTaskHost.exe	130
PID 3848 wrote to memory of 5200	3848	backgroundTaskHost.exe	131
PID 3848 wrote to memory of 5200	3848	backgroundTaskHost.exe	131
PID 4748 wrote to memory of 1596	4748	WScript.exe	132
PID 4748 wrote to memory of 1596	4748	WScript.exe	132
PID 1596 wrote to memory of 4652	1596	backgroundTaskHost.exe	133
PID 1596 wrote to memory of 4652	1596	backgroundTaskHost.exe	133
PID 1596 wrote to memory of 4184	1596	backgroundTaskHost.exe	134
PID 1596 wrote to memory of 4184	1596	backgroundTaskHost.exe	134
PID 4652 wrote to memory of 4524	4652	WScript.exe	138
PID 4652 wrote to memory of 4524	4652	WScript.exe	138
PID 4524 wrote to memory of 4928	4524	backgroundTaskHost.exe	139
PID 4524 wrote to memory of 4928	4524	backgroundTaskHost.exe	139
PID 4524 wrote to memory of 4896	4524	backgroundTaskHost.exe	140
PID 4524 wrote to memory of 4896	4524	backgroundTaskHost.exe	140
PID 4928 wrote to memory of 4488	4928	WScript.exe	141
PID 4928 wrote to memory of 4488	4928	WScript.exe	141
PID 4488 wrote to memory of 3440	4488	backgroundTaskHost.exe	142
PID 4488 wrote to memory of 3440	4488	backgroundTaskHost.exe	142
PID 4488 wrote to memory of 5012	4488	backgroundTaskHost.exe	143
PID 4488 wrote to memory of 5012	4488	backgroundTaskHost.exe	143
PID 3440 wrote to memory of 2548	3440	WScript.exe	144
PID 3440 wrote to memory of 2548	3440	WScript.exe	144
PID 2548 wrote to memory of 1352	2548	backgroundTaskHost.exe	145
PID 2548 wrote to memory of 1352	2548	backgroundTaskHost.exe	145
PID 2548 wrote to memory of 4208	2548	backgroundTaskHost.exe	146
PID 2548 wrote to memory of 4208	2548	backgroundTaskHost.exe	146
PID 1352 wrote to memory of 3688	1352	WScript.exe	147
PID 1352 wrote to memory of 3688	1352	WScript.exe	147
PID 3688 wrote to memory of 1832	3688	backgroundTaskHost.exe	148
PID 3688 wrote to memory of 1832	3688	backgroundTaskHost.exe	148
PID 3688 wrote to memory of 4176	3688	backgroundTaskHost.exe	149
PID 3688 wrote to memory of 4176	3688	backgroundTaskHost.exe	149
PID 1832 wrote to memory of 2632	1832	WScript.exe	150
PID 1832 wrote to memory of 2632	1832	WScript.exe	150
PID 2632 wrote to memory of 5372	2632	backgroundTaskHost.exe	151
PID 2632 wrote to memory of 5372	2632	backgroundTaskHost.exe	151
PID 2632 wrote to memory of 1072	2632	backgroundTaskHost.exe	152
PID 2632 wrote to memory of 1072	2632	backgroundTaskHost.exe	152
PID 5372 wrote to memory of 4416	5372	WScript.exe	154
PID 5372 wrote to memory of 4416	5372	WScript.exe	154
PID 4416 wrote to memory of 3348	4416	backgroundTaskHost.exe	155
PID 4416 wrote to memory of 3348	4416	backgroundTaskHost.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
"C:\Users\Admin\AppData\Local\Temp\051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\SppExtComObj.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\87efddaf44110a3d80760c508da79ad7\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5668
- C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
  "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\769b1d76-cafc-4916-9eac-2032f3d6af02.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
      "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3848
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d1a47cb-0e30-4f22-a052-eed9ca40f77b.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4748
      - C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0d65791-ceab-4855-97bd-ca46a05e2e07.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bec9a3c2-88fb-48a3-aa4f-1addb82fabf7.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a62997a-d699-48e0-bdd1-45582c8b9242.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3440
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c06da5a-02de-48a5-a6c8-cb2e5d786538.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42efb86d-43ff-441f-bc05-4c4bc53d49fa.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3cad8a1a-241d-4ad8-8fa2-28a5bf2362c5.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:5372
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3661349-6e8c-4f1e-a414-e126ab5f0549.vbs"
        19⤵
        
        PID:3348
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1219797-69e3-4c60-b942-849959dbb34f.vbs"
        21⤵
        
        PID:2096
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d20ce639-a56d-47c8-9c09-889799f59ac8.vbs"
        23⤵
        
        PID:2244
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5160
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f42e4564-116c-41ef-b4bd-3566f3ea7958.vbs"
        25⤵
        
        PID:5808
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12512168-26e0-42eb-b0d4-a54b3f80d4dd.vbs"
        27⤵
        
        PID:2268
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        28⤵
        
        PID:3488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f472d008-5427-4c10-99bc-8a85bfa183da.vbs"
        29⤵
        
        PID:5788
        
        C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe
        
        "C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe"
        30⤵
        
        PID:1660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44e30306-74a0-422e-b95c-cf968992be1a.vbs"
        29⤵
        
        PID:404
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a49423ee-0ff2-4e71-b07a-53e5df355946.vbs"
        27⤵
        
        PID:5064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5bfff8a7-924a-4935-b623-5c25b3473448.vbs"
        25⤵
        
        PID:6008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\439927a1-1413-45ba-97fb-adb46c8ac5e2.vbs"
        23⤵
        
        PID:4576
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af45f588-ec0f-49f4-a895-5b7a8f198b72.vbs"
        21⤵
        
        PID:4492
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\642ed69b-3019-4f8f-98f3-d39fe705ef10.vbs"
        19⤵
        
        PID:5640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6aa6b951-144a-462c-be9f-4f348850a8c0.vbs"
        17⤵
        
        PID:1072
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ebe7c52-16f0-46c5-b362-024c4290ae64.vbs"
        15⤵
        
        PID:4176
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4fd39604-3272-45fd-a81b-ecc01f713b02.vbs"
        13⤵
        
        PID:4208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f6e12b5-aae7-4b63-9d04-2f0284e78034.vbs"
        11⤵
        
        PID:5012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5185fa8-0de6-4903-a9a6-b0a39fb5b531.vbs"
        9⤵
        
        PID:4896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebc9ff5f-a231-4e03-b1d3-898b694314b1.vbs"
        7⤵
        
        PID:4184
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1b20889-51a3-4478-8c46-af77d3135c03.vbs"
        5⤵
        
        PID:5200
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\641db6f3-e9d1-4a86-a8fb-aaefd96254a0.vbs"
    3⤵
    PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Admin\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Pictures\Camera Roll\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\87efddaf44110a3d80760c508da79ad7\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\87efddaf44110a3d80760c508da79ad7\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\87efddaf44110a3d80760c508da79ad7\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\dwm.exe

Filesize
1.6MB

MD5
f82f2ef304088a6c70fb7c56d7453d4d

SHA1
ec83164a34f06f452b81cbe1e80481c56dc89d9c

SHA256
051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9

SHA512
cd75c63375de66ea9d6954252058a2e4d89cdb2d54d907424fa72a09c1ab5f3d9d2426eff93090606cf015d71bd7b509bf1eb7d94421811b1b445a15cdb9ddb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\backgroundTaskHost.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c79cf713064165d9921621736789b679

SHA1
4d8b3c69ddab8dd528496de06ce7e6e6c2758389

SHA256
6de25d006efb9912c4460725c3ff494adc8585749971235d743dae6cb568068e

SHA512
22dbec206c054253a245c7eac9cbfa4d62b49a11b02adea88b6dc8e1ee4243d46e8f61efa5374d43260ff686dbd3c769b7e14bbc6d5fb2f8999f258a904a04a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
672e8b21617ca3b368c6c154913fcfff

SHA1
cb3dab8c008b5fba2af958ce2c416c01baa6a98b

SHA256
b6ce484f4dcfab37c7fac91278a1d66c8b122865f12511634b8c5eac3fc081ec

SHA512
98b45d5545237042c9d4e99e6aa2d514bb643c80cccd1f79ca8e6412a7949fc235f2f6a5fc12a7f772e1af2343ab2e2fb863d161f1d0da3326e636c52513c7ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3c7942d5130e519e28d6051f8513f7c4

SHA1
e768daf9cbd6a718a8a60c08c893ce1797cd86fb

SHA256
83042c329ad8e497403069fdb4718252bd97c127d4e04fae1977349d767c90a1

SHA512
c7456ee68bea337227d9ac5f20acdcce72abad524cc771f8d9e49e8ca8811a093d1972d88da72c612a865de9417c6dec258148ff94e739a50097b62415566bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\12512168-26e0-42eb-b0d4-a54b3f80d4dd.vbs

Filesize
734B

MD5
0ee649c645da6ccb93f3f62f7d8f7957

SHA1
2eb17f0c66e86a001f94ee76877fab26b0e5c60d

SHA256
73453c55d227e3e89a47a5bf9c581de0ab80a6a674e6e5800bfebfb865910f63

SHA512
c8965a4af467d0eca2bd37439e3f553a9b79fb3d11918b8c6f130c4138c3e0e5339d0acafba6fdf654a194998cb83d3cb7e63309c7e1a406ca8424541cbdcfe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2d1a47cb-0e30-4f22-a052-eed9ca40f77b.vbs

Filesize
734B

MD5
86bc0c021ed80c64f5ad384a2b555075

SHA1
ae4858c9a1e0a66bef769a55831bb760d0307439

SHA256
fd66b2fffb6cccf268f896bb81061619f9657df0880f049e26ec718f3c693cbc

SHA512
c86dfcc9c4c2e14fab2d4d72b652c507df3d7131120f88a6c437c8d2ee14afe3b69b90eb6735660f4dd2aa6de77100ab3c0c93e1db9b11bfc605c1f50949050d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3cad8a1a-241d-4ad8-8fa2-28a5bf2362c5.vbs

Filesize
734B

MD5
ade78a9dc00fbf1cbeed31d742b6a4a8

SHA1
42f6a218301ecec7506510d584e8708ad14bac73

SHA256
81eadf664f53fead85b086bfa57bb73e88900920f2db2d2de3dbbee3ae1481a8

SHA512
80476296396cc23a68f43607b54ffbb3002a2fdc840b692864649104135de4ca75e091453cd698a7eff7f739ecd6487575aaea381babe5aa44f103a8b6c48b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\42efb86d-43ff-441f-bc05-4c4bc53d49fa.vbs

Filesize
734B

MD5
12361d0d113a99a214d8da7f3f5fef79

SHA1
e8dcca571af355240728f535f94c4e9e12981cf8

SHA256
7604f79fa8740f181c5e1cd57b1419cbd28edd54f08a940d5c5fe6776d73b6c6

SHA512
049355e788d6ad4278e825137e9063b3ec472b6e3f9d883128cca887fc72bb59d2185937036d35e75d824cc5a078054b86101dc9b4df35561f6fefd2884e93fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a62997a-d699-48e0-bdd1-45582c8b9242.vbs

Filesize
734B

MD5
aed5c22dbb7a7a641527d102f0c5e2da

SHA1
d5bfe90a0c97448bfc97192b37609e74c5eab1fb

SHA256
2c1351166d068dd20b5ccb7b4b9c98700bf16ee255f6879f2e31687bbdecdf43

SHA512
0c3ac2b5f649b58e5eb5677b9744c81e0a83081cc304a710bc12afc15d4c4df786dca6c4b5e867c74cc8eb352d0c935b63f25d208b2d33241a6e8da062d19d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\641db6f3-e9d1-4a86-a8fb-aaefd96254a0.vbs

Filesize
510B

MD5
49446ed26032a8a2b481abf2b52dbfce

SHA1
defa1d92833e7895357b29b775499b5fdcbd33fd

SHA256
fabce9f51822fc9a0c5e236c86ae683acea4efda9dd5c3b9c1b41fabf902c09e

SHA512
084d57afd268e67cbf4b46a0b85bac30a7e869a796f80e78f112ae133dc188ace4c155c2434d450f597648a478e5e499f038d99c049254b4e79f125f20cf6cea

Download Submit
C:\Users\Admin\AppData\Local\Temp\769b1d76-cafc-4916-9eac-2032f3d6af02.vbs

Filesize
734B

MD5
95bc5830b064956680251a6d2aed3bda

SHA1
bbcb6b1b9bde01adc01e4f5c690147e6079c08e4

SHA256
2a267a76733ca5e476b57b02165073c12705b77c5e453efa8a206e327326975f

SHA512
48609028252fb840fc9bec5078aec2950ab3e6ba1805ce1fb2e9830180473a635f3c014c9c7b8666f0154e881d4f55ba51be7736c581f04e275785f85011415a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9c06da5a-02de-48a5-a6c8-cb2e5d786538.vbs

Filesize
734B

MD5
9dd7afd0ab6c6ea1d413f7a4911272e5

SHA1
f2cd66550e569fd0cb78bfee9b2e5b060c676bbb

SHA256
dcc0ea50fb3edc6204596aee1c615c74755b89fa7652c0d0feee54b7a8dcc43e

SHA512
9d2ae96f78039e3fc20675ba0c0f315d3dbe977733c90cdfe0d6679787c49d0751b818b6dadd7b9b38302ec85964c2d151c018014955dfccbdfca87e8e5b1e98

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gkkyn0c.t1c.psm1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a0d65791-ceab-4855-97bd-ca46a05e2e07.vbs

Filesize
734B

MD5
68462306f44dce6ddd96e5c84b083605

SHA1
2fdef1b60eef8d6e70d2a01d82fdfd02f0a393d4

SHA256
40a2961d956b678e6e3ef7515c4d92e76150d98870d5e4d369ceed97c102d527

SHA512
d0b66975d5f5d2b0f64620221a4630fb9b74a00d598d9a420cabbff2876786b0f8d30872db2f8e84701cc30f8fa719bea13509ae287f7cf16dad45b73c33708f

Download Submit
C:\Users\Admin\AppData\Local\Temp\bec9a3c2-88fb-48a3-aa4f-1addb82fabf7.vbs

Filesize
734B

MD5
8b96ba0a4e888e06cc46407fc6ad0027

SHA1
8d81e0dd9659fdc1026fd85f90253c797be8866c

SHA256
721ae9c0591454550640e4a1ebe7efafa3b2cf87ff937a7a0e3db94c4725d5d4

SHA512
a9090e7209e68783cceea8180635232fe9feae73aabf7d8bfd33d7f8d57e58fcc0546ac76b1c0d1d32a7202a674a859da3222c746073ade2afe30adcb916d4f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\c1219797-69e3-4c60-b942-849959dbb34f.vbs

Filesize
733B

MD5
6267f292a0a11291849da74f115c9def

SHA1
f1b2bf5fcf00d58e61f0fd634f871b50f02168d0

SHA256
e8d1a0d3c6f6d4a792d0f48e2854322cbfddba729b72158625dd3e19e6aa8c1a

SHA512
2ea01ad6bbdf9ae28f6ef55f01d3f2383a1eb20e32bee218fd96090c4b111992c81b18d3ccaa6820051f14e7f1c16103d63c6ba9fc3b478d063e7155bf84b482

Download Submit
C:\Users\Admin\AppData\Local\Temp\d3661349-6e8c-4f1e-a414-e126ab5f0549.vbs

Filesize
734B

MD5
4ffca7d521c9e867d27e2c7bd419a559

SHA1
a7ce033191f3a330a83a9d70ff6d9a26e29af6cf

SHA256
789db4175db6f3717addbbedc7d8c0045ded50752d26179361e1e98fcae4c952

SHA512
fa87fcfd26c0e6910b42545a3e923adafca687824a15dc16f234be0e9d5d688724ef863a8d516ade99a59c68bb469d1e8f1a6a6bfaa181a8847d02046c814246

Download Submit
C:\Users\Admin\AppData\Local\Temp\f42e4564-116c-41ef-b4bd-3566f3ea7958.vbs

Filesize
734B

MD5
1a666e0c462765b160ddbe72ae49cafa

SHA1
b024e20323d9cbfa4c68aac3206aec04994ee5e2

SHA256
75ee7282b645976fb19f169db8de5d39584c42ded4fdda4cafaa7b620ca9db85

SHA512
30a38866cbf1cea53b0bdbbbebe07f5a3c4c3bdbdf504a606f8d2861c914eddf2a542ee75bf1a43e68425d233677ce0dfd7c6abf0eafd7c4447275cf21f26411

Download Submit
C:\Users\Admin\AppData\Local\Temp\f472d008-5427-4c10-99bc-8a85bfa183da.vbs

Filesize
734B

MD5
58d8b809a2a5b004dad9a6f1c532d9f2

SHA1
d309d526e99d2cb92960dd3cbcbc8f65adf5a8d9

SHA256
5dea43dc8d7d8179412e0a0debaaae728bfab807ef9e8abe369a11960af54f51

SHA512
5048a6cd8eec2e924b2957a99aea2dd0df3d114a3ce07b9193758b619c6bd139f088eba77a7991bfa6dc3ebb388606657117efb8a547b89a76780f850833e7c8

Download Submit
C:\Users\Admin\SppExtComObj.exe

Filesize
1.6MB

MD5
71a219edfce94a9070513eec5660c95c

SHA1
f6901a16d458f33d94aec60980480aee7979fc55

SHA256
cc4bc9ca0ca31063efbc3818d44cdc3293deaa326cd1083af88ab38293e6bc76

SHA512
bb451f5600d01554ffec50c668ac7609c0bcb6ef6c1101e0398d27d96950ca33939e35c424ef4439ee435e011072a570f14f58f7666160a24f5aa5fd1ba5f33e

Download Submit
memory/4556-5-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

Filesize
64KB

Download
memory/4556-207-0x00007FFD7B110000-0x00007FFD7BBD1000-memory.dmp

Filesize
10.8MB

Download
memory/4556-17-0x000000001C3B0000-0x000000001C3BC000-memory.dmp

Filesize
48KB

Download
memory/4556-16-0x000000001C3A0000-0x000000001C3AA000-memory.dmp

Filesize
40KB

Download
memory/4556-10-0x000000001BB80000-0x000000001BB8C000-memory.dmp

Filesize
48KB

Download
memory/4556-11-0x000000001BB90000-0x000000001BB9C000-memory.dmp

Filesize
48KB

Download
memory/4556-7-0x0000000003020000-0x0000000003028000-memory.dmp

Filesize
32KB

Download
memory/4556-8-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/4556-6-0x0000000003000000-0x0000000003016000-memory.dmp

Filesize
88KB

Download
memory/4556-13-0x000000001BBB0000-0x000000001BBBE000-memory.dmp

Filesize
56KB

Download
memory/4556-12-0x000000001BBA0000-0x000000001BBAA000-memory.dmp

Filesize
40KB

Download
memory/4556-14-0x000000001C380000-0x000000001C388000-memory.dmp

Filesize
32KB

Download
memory/4556-4-0x0000000003050000-0x00000000030A0000-memory.dmp

Filesize
320KB

Download
memory/4556-3-0x0000000002F20000-0x0000000002F3C000-memory.dmp

Filesize
112KB

Download
memory/4556-2-0x00007FFD7B110000-0x00007FFD7BBD1000-memory.dmp

Filesize
10.8MB

Download
memory/4556-1-0x0000000000D10000-0x0000000000EB2000-memory.dmp

Filesize
1.6MB

Download
memory/4556-15-0x000000001C390000-0x000000001C398000-memory.dmp

Filesize
32KB

Download
memory/4556-9-0x0000000003030000-0x0000000003038000-memory.dmp

Filesize
32KB

Download
memory/4556-0-0x00007FFD7B113000-0x00007FFD7B115000-memory.dmp

Filesize
8KB

Download
memory/4972-165-0x000002875F650000-0x000002875F672000-memory.dmp

Filesize
136KB

Download