dcrat | 6681cb73deb0effc4f44f704c6bddb07e98c1f8da4c8478cca7ddd49abdb0c3f

Analysis

max time kernel
142s
max time network
156s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Size

5.9MB
MD5

5d8505501b7faa4c7e541b0a32467a58
SHA1

ed0b9de10c38774af49d9279e25a8958817f33a7
SHA256

1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca
SHA512

a1fb110b16700001f75d4f74d93746349b5e2e78d4a5dde84c00ffe4eeed914cf7a3702de507c9a287f6df54a4cc0a4010a6bc28e4b641e8d5dcf20db6a302d9
SSDEEP

98304:xyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw44:xyeU11Rvqmu8TWKnF6N/1wt

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2844	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2844	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2844	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2844	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2844	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2844	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2844	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2844	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2844	schtasks.exe	30

UAC bypass 3 TTPs 15 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2856	powershell.exe
2904	powershell.exe
2708	powershell.exe
2596	powershell.exe
2008	powershell.exe
1816	powershell.exe
2300	powershell.exe
1256	powershell.exe
1676	powershell.exe
1920	powershell.exe
1952	powershell.exe
2076	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe

Executes dropped EXE 4 IoCs

pid	Process
1828	lsm.exe
1804	lsm.exe
2696	lsm.exe
1836	lsm.exe

Checks whether UAC is enabled 1 TTPs 10 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\LogFiles\AIT\RCXDFDA.tmp	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File opened for modification	C:\Windows\System32\LogFiles\AIT\RCXDFEB.tmp	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File opened for modification	C:\Windows\System32\LogFiles\AIT\OSPPSVC.exe	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File created	C:\Windows\System32\LogFiles\AIT\OSPPSVC.exe	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File created	C:\Windows\System32\LogFiles\AIT\1610b97d3ab4a7	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
1828	lsm.exe
1828	lsm.exe
1804	lsm.exe
1804	lsm.exe
2696	lsm.exe
2696	lsm.exe
1836	lsm.exe
1836	lsm.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\101b941d020240	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCXDDB6.tmp	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCXDDC7.tmp	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0019\spoolsv.exe	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File opened for modification	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0019\spoolsv.exe	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File created	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0019\f3b6ecef712a24	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File opened for modification	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0019\RCXDB82.tmp	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
File opened for modification	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0019\RCXDB93.tmp	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3036	schtasks.exe
3020	schtasks.exe
1640	schtasks.exe
2828	schtasks.exe
2636	schtasks.exe
2780	schtasks.exe
2652	schtasks.exe
2604	schtasks.exe
1096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
2708	powershell.exe
2300	powershell.exe
2904	powershell.exe
2856	powershell.exe
1816	powershell.exe
2008	powershell.exe
1920	powershell.exe
2076	powershell.exe
1952	powershell.exe
1676	powershell.exe
1256	powershell.exe
2596	powershell.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe
1828	lsm.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	1828	lsm.exe
Token: SeDebugPrivilege	1804	lsm.exe
Token: SeDebugPrivilege	2696	lsm.exe
Token: SeDebugPrivilege	1836	lsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1920	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	41
PID 2124 wrote to memory of 1920	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	41
PID 2124 wrote to memory of 1920	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	41
PID 2124 wrote to memory of 1816	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	42
PID 2124 wrote to memory of 1816	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	42
PID 2124 wrote to memory of 1816	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	42
PID 2124 wrote to memory of 2008	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	44
PID 2124 wrote to memory of 2008	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	44
PID 2124 wrote to memory of 2008	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	44
PID 2124 wrote to memory of 1676	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	45
PID 2124 wrote to memory of 1676	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	45
PID 2124 wrote to memory of 1676	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	45
PID 2124 wrote to memory of 2596	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	47
PID 2124 wrote to memory of 2596	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	47
PID 2124 wrote to memory of 2596	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	47
PID 2124 wrote to memory of 2708	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	49
PID 2124 wrote to memory of 2708	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	49
PID 2124 wrote to memory of 2708	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	49
PID 2124 wrote to memory of 2904	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	50
PID 2124 wrote to memory of 2904	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	50
PID 2124 wrote to memory of 2904	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	50
PID 2124 wrote to memory of 2856	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	52
PID 2124 wrote to memory of 2856	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	52
PID 2124 wrote to memory of 2856	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	52
PID 2124 wrote to memory of 1256	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	54
PID 2124 wrote to memory of 1256	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	54
PID 2124 wrote to memory of 1256	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	54
PID 2124 wrote to memory of 2300	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	56
PID 2124 wrote to memory of 2300	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	56
PID 2124 wrote to memory of 2300	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	56
PID 2124 wrote to memory of 1952	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	58
PID 2124 wrote to memory of 1952	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	58
PID 2124 wrote to memory of 1952	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	58
PID 2124 wrote to memory of 2076	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	59
PID 2124 wrote to memory of 2076	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	59
PID 2124 wrote to memory of 2076	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	59
PID 2124 wrote to memory of 1828	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	65
PID 2124 wrote to memory of 1828	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	65
PID 2124 wrote to memory of 1828	2124	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe	65
PID 1828 wrote to memory of 1360	1828	lsm.exe	66
PID 1828 wrote to memory of 1360	1828	lsm.exe	66
PID 1828 wrote to memory of 1360	1828	lsm.exe	66
PID 1828 wrote to memory of 1900	1828	lsm.exe	67
PID 1828 wrote to memory of 1900	1828	lsm.exe	67
PID 1828 wrote to memory of 1900	1828	lsm.exe	67
PID 1360 wrote to memory of 1804	1360	WScript.exe	68
PID 1360 wrote to memory of 1804	1360	WScript.exe	68
PID 1360 wrote to memory of 1804	1360	WScript.exe	68
PID 1804 wrote to memory of 1596	1804	lsm.exe	69
PID 1804 wrote to memory of 1596	1804	lsm.exe	69
PID 1804 wrote to memory of 1596	1804	lsm.exe	69
PID 1804 wrote to memory of 2436	1804	lsm.exe	70
PID 1804 wrote to memory of 2436	1804	lsm.exe	70
PID 1804 wrote to memory of 2436	1804	lsm.exe	70
PID 1596 wrote to memory of 2696	1596	WScript.exe	71
PID 1596 wrote to memory of 2696	1596	WScript.exe	71
PID 1596 wrote to memory of 2696	1596	WScript.exe	71
PID 2696 wrote to memory of 352	2696	lsm.exe	72
PID 2696 wrote to memory of 352	2696	lsm.exe	72
PID 2696 wrote to memory of 352	2696	lsm.exe	72
PID 2696 wrote to memory of 1520	2696	lsm.exe	73
PID 2696 wrote to memory of 1520	2696	lsm.exe	73
PID 2696 wrote to memory of 1520	2696	lsm.exe	73
PID 352 wrote to memory of 1836	352	WScript.exe	74

System policy modification 1 TTPs 15 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
"C:\Users\Admin\AppData\Local\Temp\1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1828
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74123978-7af5-4e83-b54f-7598187cd117.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe
      "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1804
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\701fdcff-39ed-4937-b20b-f144a96e339d.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1596
      - C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80f924f5-ddfa-4ac6-b21f-cfa0976d6ab8.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:352
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15a77a32-d2ee-42c9-9229-56f5a29bfc5f.vbs"
        9⤵
        
        PID:3008
        
        C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe
        
        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe"
        10⤵
        
        PID:2416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02460290-6983-4422-8cd2-37c14db1ca5b.vbs"
        11⤵
        
        PID:2928
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\373353a3-408c-4e25-84ad-f9783ac1fc3f.vbs"
        11⤵
        
        PID:1920
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5ad544e-176e-4f7e-b20d-a2f1d3a09965.vbs"
        9⤵
        
        PID:1924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\000b1f31-6489-410a-81a3-dea3ba1b618c.vbs"
        7⤵
        
        PID:1520
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac3bc1b8-82f6-4006-af92-ad65c18cf17c.vbs"
        5⤵
        
        PID:2436
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\837d2091-babc-439f-bac8-c244cf353bb2.vbs"
    3⤵
    PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\inf\.NET CLR Networking 4.0.0.0\0019\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\inf\.NET CLR Networking 4.0.0.0\0019\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\inf\.NET CLR Networking 4.0.0.0\0019\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Windows\System32\LogFiles\AIT\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\System32\LogFiles\AIT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Windows\System32\LogFiles\AIT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\lsm.exe

Filesize
5.5MB

MD5
7f21be9ce89cbb8cb81f0008a24802ee

SHA1
6628cc6ce841bcfcc5d5e87284d22196d15e0490

SHA256
3ad53bdfffb31bbe733c2a9866c60f0a20d2edb5845743d576e1a4b4c0b1b441

SHA512
a285c892fe313478c34b08ed5ae3ede070ae6e5c2e2d4e7c8319a58b5a804ce401d31f5a28e3d55c4ffa421bd94d0c5668eacc5052bb79a6c935654ef105995f

Download Submit
C:\Users\Admin\AppData\Local\Temp\02460290-6983-4422-8cd2-37c14db1ca5b.vbs

Filesize
747B

MD5
a1bf9b134e6974f40e020caab67148ad

SHA1
3634201440362fc1cdbf1f0f485efaf42eed81de

SHA256
4ee43f20b88421e4a131ea67184c2c7e05eb7e1643cac0fa6d8ef0a12a621b6f

SHA512
16b668b9632196b4c81f3b13fdb55cae2d1e2f5fe944b7caa0f5e31767b0db015254159378d87918a6cd681054f8dcd3d16c6313c20f9d6ca4ade15981121d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\15a77a32-d2ee-42c9-9229-56f5a29bfc5f.vbs

Filesize
747B

MD5
9fd5a289cbb45bd2aee9fd6952bb20dd

SHA1
c74466133c0c6492bce6e1f33783a665461e3e2b

SHA256
55c84b1d439937e3896b25fba6db9faccd0b6647688b38e9dbbe6911b05e882f

SHA512
0f2606099305020f7505ef8640665842ff24e3aba6102d2ee2a605e5ae6bf35db983347f493a94127242b0ad095185e5742c5e8271ed9da50f19b16ed99ef1fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\6dde813ff7286e8839024e617617a509c69bce29.exe

Filesize
2.6MB

MD5
f541550e30e6948fa06af288942aad20

SHA1
c1ecea8fbeb749e72c2a6200ec55efd8896c96a1

SHA256
8c898fe79f90a997df501ee29f4c711a29552ec7effbc2b693b8f32246209d9d

SHA512
6f7756804daf1c7af49ba3e303eb34e6dee38f34b0605090fd97ac7366608f36d5a2266e3458910650d08e401f9822ac01bbdd41d8dacfaeffb0aeb3d550b9dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\701fdcff-39ed-4937-b20b-f144a96e339d.vbs

Filesize
747B

MD5
61c213c910399afd52d8e43f4b202ec5

SHA1
26ffd26405b47111ca48f6a44cf6fbc97ad6a770

SHA256
b76aae388ae995d8068857d7e94a35a209981acfc5d3264506131248e5e55c21

SHA512
693bdd1b2661fbb856ab09921d5fcb0308b12af1dcad5ac218d7ae13d5f01bd8e2e037929872e6f8665add941ca2723fa04314c18507decca8290369c1676b82

Download Submit
C:\Users\Admin\AppData\Local\Temp\74123978-7af5-4e83-b54f-7598187cd117.vbs

Filesize
747B

MD5
6a5183b0184e3f3a699c647ba2c0bbef

SHA1
c6d453b8bdbc9e6f590ca932b42aff4bac33a4e7

SHA256
10dd2dbae0f415178d5f425302172cb89fe7cbd4248fa34a184a7aead9d890ee

SHA512
5778f5d8ca0f8e25a4fba9712687506a3a770c31c692ed186992d82883aa7ec9904e3f6f1098de2a4bd8d5342fbb2ff44c735650f715ff2da6eca86029d7d85f

Download Submit
C:\Users\Admin\AppData\Local\Temp\80f924f5-ddfa-4ac6-b21f-cfa0976d6ab8.vbs

Filesize
747B

MD5
7f06bd0ac17e5a8103701b8395982932

SHA1
43897cebb416cb0bf7176b7a2d21971366308764

SHA256
f50b25d551e6f9defe4650d8ab5398494926910a415b8044386ab3e6d9f2ba6f

SHA512
5959b9a6f61eb0ab50ec67c71799d8ed3e33da23628e54b1bba40f4fe831ea9f077e81c99b0cbd72093caf5d05954a027bef55781c7d1819f924358294ae0f01

Download Submit
C:\Users\Admin\AppData\Local\Temp\837d2091-babc-439f-bac8-c244cf353bb2.vbs

Filesize
523B

MD5
9b4aec1e6db2351915b67e34d4166584

SHA1
e65be07846c7638912e6a8f1fc6eb418f9c7353f

SHA256
1069c6c5fbcfe1fb22dd7cd913314fd6e12bf086a1b5a04fe9aada89729b5c05

SHA512
420485e8f19cbc3437371cba52acd6b965f9974905a696ba601c0ba86be176f0ae47fee76c250c13679204bdb85e0ee0b575ae6423278b0ff181d82ec573bf65

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCXD95F.tmp

Filesize
5.9MB

MD5
5d8505501b7faa4c7e541b0a32467a58

SHA1
ed0b9de10c38774af49d9279e25a8958817f33a7

SHA256
1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca

SHA512
a1fb110b16700001f75d4f74d93746349b5e2e78d4a5dde84c00ffe4eeed914cf7a3702de507c9a287f6df54a4cc0a4010a6bc28e4b641e8d5dcf20db6a302d9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7058a27c3ca227c416ab095df0827719

SHA1
ab0000c5a59ffda7cfc2fe44df51b0c4be102b1a

SHA256
24ebad3674fd7a297324917081dbbe9a54aad659ef470f920d6cf63a11411e13

SHA512
293c98de66f862c7232db5ce0efcdb9a2e5c6556813ea1e94a7b33c8e38f75146fe80ba98fa2270b08e06faaba44d067961313011243420921851aeb26cd40c5

Download Submit
memory/1804-166-0x0000000001220000-0x0000000001276000-memory.dmp

Filesize
344KB

Download
memory/1828-138-0x0000000001330000-0x0000000001C28000-memory.dmp

Filesize
9.0MB

Download
memory/2008-136-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2124-14-0x0000000000B20000-0x0000000000B28000-memory.dmp

Filesize
32KB

Download
memory/2124-35-0x00000000011D0000-0x00000000011D8000-memory.dmp

Filesize
32KB

Download
memory/2124-6-0x0000000000480000-0x0000000000488000-memory.dmp

Filesize
32KB

Download
memory/2124-16-0x0000000000B60000-0x0000000000B6A000-memory.dmp

Filesize
40KB

Download
memory/2124-17-0x0000000000B70000-0x0000000000BC6000-memory.dmp

Filesize
344KB

Download
memory/2124-20-0x0000000000C60000-0x0000000000C6C000-memory.dmp

Filesize
48KB

Download
memory/2124-23-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download
memory/2124-21-0x0000000000C70000-0x0000000000C78000-memory.dmp

Filesize
32KB

Download
memory/2124-19-0x0000000000C50000-0x0000000000C58000-memory.dmp

Filesize
32KB

Download
memory/2124-24-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

Filesize
48KB

Download
memory/2124-18-0x0000000000BC0000-0x0000000000BCC000-memory.dmp

Filesize
48KB

Download
memory/2124-27-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

Filesize
48KB

Download
memory/2124-29-0x0000000000D00000-0x0000000000D08000-memory.dmp

Filesize
32KB

Download
memory/2124-30-0x000000001AFF0000-0x000000001AFFC000-memory.dmp

Filesize
48KB

Download
memory/2124-28-0x0000000000CF0000-0x0000000000CFC000-memory.dmp

Filesize
48KB

Download
memory/2124-34-0x00000000011C0000-0x00000000011CE000-memory.dmp

Filesize
56KB

Download
memory/2124-33-0x00000000011B0000-0x00000000011B8000-memory.dmp

Filesize
32KB

Download
memory/2124-39-0x000000001B400000-0x000000001B40C000-memory.dmp

Filesize
48KB

Download
memory/2124-38-0x000000001B020000-0x000000001B02A000-memory.dmp

Filesize
40KB

Download
memory/2124-37-0x000000001B010000-0x000000001B018000-memory.dmp

Filesize
32KB

Download
memory/2124-36-0x000000001B000000-0x000000001B00C000-memory.dmp

Filesize
48KB

Download
memory/2124-0-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Filesize
4KB

Download
memory/2124-32-0x00000000011A0000-0x00000000011AE000-memory.dmp

Filesize
56KB

Download
memory/2124-31-0x0000000001190000-0x000000000119A000-memory.dmp

Filesize
40KB

Download
memory/2124-26-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

Filesize
32KB

Download
memory/2124-25-0x0000000000CC0000-0x0000000000CCC000-memory.dmp

Filesize
48KB

Download
memory/2124-15-0x0000000000B40000-0x0000000000B50000-memory.dmp

Filesize
64KB

Download
memory/2124-13-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Filesize
48KB

Download
memory/2124-1-0x00000000011E0000-0x0000000001AD8000-memory.dmp

Filesize
9.0MB

Download
memory/2124-10-0x0000000000550000-0x0000000000566000-memory.dmp

Filesize
88KB

Download
memory/2124-11-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/2124-139-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-12-0x0000000000B30000-0x0000000000B42000-memory.dmp

Filesize
72KB

Download
memory/2124-9-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/2124-7-0x0000000000520000-0x000000000053C000-memory.dmp

Filesize
112KB

Download
memory/2124-8-0x0000000000490000-0x0000000000498000-memory.dmp

Filesize
32KB

Download
memory/2124-2-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2124-5-0x0000000000470000-0x000000000047E000-memory.dmp

Filesize
56KB

Download
memory/2124-4-0x0000000000460000-0x000000000046E000-memory.dmp

Filesize
56KB

Download
memory/2124-3-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2300-121-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2416-204-0x0000000000C30000-0x0000000000C86000-memory.dmp

Filesize
344KB

Download
memory/2696-179-0x000000001B4A0000-0x000000001B4F6000-memory.dmp

Filesize
344KB

Download