dcrat | b8c5e2c8477706f3f54e152443718dcec270889002289aa1730eabc5ba3f312f

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

279dab20ac900bec30b0f1793b059f0d.exe
Size

885KB
MD5

279dab20ac900bec30b0f1793b059f0d
SHA1

746b709243322cebafc65da649e8b2a9955033b0
SHA256

035e4ad513f0cb3ac0e1ef6c550e753ba271cf1795721a84f019c877cc53bfe5
SHA512

5a02f8bef439ed12276e3e7fbbb0b405988289cb2958c33a26f22c5a21d28f0befa0cc5df26abf1e1a51a0a81d37f2da945cc22f48ebd20503e7987ec5265338
SSDEEP

12288:UlNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:UlNCv6XJ5BClaXfD9vUha+u

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5904	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5692	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5900	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	4912	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5708	4912	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral24/memory/4280-1-0x0000000000810000-0x00000000008F4000-memory.dmp	dcrat
behavioral24/files/0x0004000000022bb5-21.dat	dcrat

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	279dab20ac900bec30b0f1793b059f0d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	279dab20ac900bec30b0f1793b059f0d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Registry.exe

Executes dropped EXE 12 IoCs

pid	Process
3376	Registry.exe
3656	Registry.exe
2328	Registry.exe
1792	Registry.exe
4724	Registry.exe
2244	Registry.exe
448	Registry.exe
5604	Registry.exe
5312	Registry.exe
2592	Registry.exe
4536	Registry.exe
960	Registry.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RCX9D22.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\RCX9D44.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\RCX9D54.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\RCX9D77.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File created	C:\Program Files (x86)\Windows NT\RuntimeBroker.exe	279dab20ac900bec30b0f1793b059f0d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\55b276f4edf653	279dab20ac900bec30b0f1793b059f0d.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\ee2ad38f3d4382	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RCX9D11.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\RCX9D97.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File created	C:\Program Files (x86)\Windows NT\9e8d7a4ca61bd9	279dab20ac900bec30b0f1793b059f0d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\StartMenuExperienceHost.exe	279dab20ac900bec30b0f1793b059f0d.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Media\Raga\RuntimeBroker.exe	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Windows\Media\Raga\RCX97DF.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Windows\Media\Raga\RCX97FF.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File created	C:\Windows\Vss\Writers\System\services.exe	279dab20ac900bec30b0f1793b059f0d.exe
File created	C:\Windows\Vss\Writers\System\c5b4cb5e9653cc	279dab20ac900bec30b0f1793b059f0d.exe
File created	C:\Windows\en-US\ea9f0e6c9e2dcd	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Windows\Vss\Writers\System\RCX9D32.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Windows\Vss\Writers\System\RCX9D43.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File created	C:\Windows\Media\Raga\9e8d7a4ca61bd9	279dab20ac900bec30b0f1793b059f0d.exe
File created	C:\Windows\en-US\taskhostw.exe	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Windows\en-US\RCX9DA8.tmp	279dab20ac900bec30b0f1793b059f0d.exe
File opened for modification	C:\Windows\en-US\RCX9DB8.tmp	279dab20ac900bec30b0f1793b059f0d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	279dab20ac900bec30b0f1793b059f0d.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	Registry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4984	schtasks.exe
1484	schtasks.exe
5084	schtasks.exe
1164	schtasks.exe
4020	schtasks.exe
4896	schtasks.exe
4224	schtasks.exe
2136	schtasks.exe
3044	schtasks.exe
5692	schtasks.exe
3724	schtasks.exe
4972	schtasks.exe
5904	schtasks.exe
1472	schtasks.exe
1984	schtasks.exe
5072	schtasks.exe
4432	schtasks.exe
5708	schtasks.exe
4244	schtasks.exe
984	schtasks.exe
1632	schtasks.exe
2156	schtasks.exe
4364	schtasks.exe
1156	schtasks.exe
3568	schtasks.exe
1588	schtasks.exe
1748	schtasks.exe
4508	schtasks.exe
3004	schtasks.exe
1080	schtasks.exe
5900	schtasks.exe
4808	schtasks.exe
2432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4280	279dab20ac900bec30b0f1793b059f0d.exe
4280	279dab20ac900bec30b0f1793b059f0d.exe
4280	279dab20ac900bec30b0f1793b059f0d.exe
4280	279dab20ac900bec30b0f1793b059f0d.exe
4280	279dab20ac900bec30b0f1793b059f0d.exe
3996	279dab20ac900bec30b0f1793b059f0d.exe
3376	Registry.exe
3656	Registry.exe
2328	Registry.exe
1792	Registry.exe
1792	Registry.exe
4724	Registry.exe
4724	Registry.exe
2244	Registry.exe
448	Registry.exe
448	Registry.exe
5604	Registry.exe
5604	Registry.exe
5312	Registry.exe
2592	Registry.exe
4536	Registry.exe
4536	Registry.exe
960	Registry.exe
960	Registry.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	279dab20ac900bec30b0f1793b059f0d.exe
Token: SeDebugPrivilege	3996	279dab20ac900bec30b0f1793b059f0d.exe
Token: SeDebugPrivilege	3376	Registry.exe
Token: SeDebugPrivilege	3656	Registry.exe
Token: SeDebugPrivilege	2328	Registry.exe
Token: SeDebugPrivilege	1792	Registry.exe
Token: SeDebugPrivilege	4724	Registry.exe
Token: SeDebugPrivilege	2244	Registry.exe
Token: SeDebugPrivilege	448	Registry.exe
Token: SeDebugPrivilege	5604	Registry.exe
Token: SeDebugPrivilege	5312	Registry.exe
Token: SeDebugPrivilege	2592	Registry.exe
Token: SeDebugPrivilege	4536	Registry.exe
Token: SeDebugPrivilege	960	Registry.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 3996	4280	279dab20ac900bec30b0f1793b059f0d.exe	95
PID 4280 wrote to memory of 3996	4280	279dab20ac900bec30b0f1793b059f0d.exe	95
PID 3996 wrote to memory of 4604	3996	279dab20ac900bec30b0f1793b059f0d.exe	123
PID 3996 wrote to memory of 4604	3996	279dab20ac900bec30b0f1793b059f0d.exe	123
PID 4604 wrote to memory of 5936	4604	cmd.exe	125
PID 4604 wrote to memory of 5936	4604	cmd.exe	125
PID 4604 wrote to memory of 3376	4604	cmd.exe	126
PID 4604 wrote to memory of 3376	4604	cmd.exe	126
PID 3376 wrote to memory of 1176	3376	Registry.exe	127
PID 3376 wrote to memory of 1176	3376	Registry.exe	127
PID 3376 wrote to memory of 5192	3376	Registry.exe	128
PID 3376 wrote to memory of 5192	3376	Registry.exe	128
PID 1176 wrote to memory of 3656	1176	WScript.exe	129
PID 1176 wrote to memory of 3656	1176	WScript.exe	129
PID 3656 wrote to memory of 4692	3656	Registry.exe	130
PID 3656 wrote to memory of 4692	3656	Registry.exe	130
PID 3656 wrote to memory of 5960	3656	Registry.exe	131
PID 3656 wrote to memory of 5960	3656	Registry.exe	131
PID 4692 wrote to memory of 2328	4692	WScript.exe	136
PID 4692 wrote to memory of 2328	4692	WScript.exe	136
PID 2328 wrote to memory of 4828	2328	Registry.exe	137
PID 2328 wrote to memory of 4828	2328	Registry.exe	137
PID 2328 wrote to memory of 4880	2328	Registry.exe	138
PID 2328 wrote to memory of 4880	2328	Registry.exe	138
PID 4828 wrote to memory of 1792	4828	WScript.exe	142
PID 4828 wrote to memory of 1792	4828	WScript.exe	142
PID 1792 wrote to memory of 1360	1792	Registry.exe	143
PID 1792 wrote to memory of 1360	1792	Registry.exe	143
PID 1792 wrote to memory of 1748	1792	Registry.exe	144
PID 1792 wrote to memory of 1748	1792	Registry.exe	144
PID 1360 wrote to memory of 4724	1360	WScript.exe	145
PID 1360 wrote to memory of 4724	1360	WScript.exe	145
PID 4724 wrote to memory of 5692	4724	Registry.exe	146
PID 4724 wrote to memory of 5692	4724	Registry.exe	146
PID 4724 wrote to memory of 2032	4724	Registry.exe	147
PID 4724 wrote to memory of 2032	4724	Registry.exe	147
PID 5692 wrote to memory of 2244	5692	WScript.exe	149
PID 5692 wrote to memory of 2244	5692	WScript.exe	149
PID 2244 wrote to memory of 5488	2244	Registry.exe	150
PID 2244 wrote to memory of 5488	2244	Registry.exe	150
PID 2244 wrote to memory of 5376	2244	Registry.exe	151
PID 2244 wrote to memory of 5376	2244	Registry.exe	151
PID 5488 wrote to memory of 448	5488	WScript.exe	152
PID 5488 wrote to memory of 448	5488	WScript.exe	152
PID 448 wrote to memory of 2124	448	Registry.exe	153
PID 448 wrote to memory of 2124	448	Registry.exe	153
PID 448 wrote to memory of 5296	448	Registry.exe	154
PID 448 wrote to memory of 5296	448	Registry.exe	154
PID 2124 wrote to memory of 5604	2124	WScript.exe	156
PID 2124 wrote to memory of 5604	2124	WScript.exe	156
PID 5604 wrote to memory of 2492	5604	Registry.exe	157
PID 5604 wrote to memory of 2492	5604	Registry.exe	157
PID 5604 wrote to memory of 2344	5604	Registry.exe	158
PID 5604 wrote to memory of 2344	5604	Registry.exe	158
PID 2492 wrote to memory of 5312	2492	WScript.exe	159
PID 2492 wrote to memory of 5312	2492	WScript.exe	159
PID 5312 wrote to memory of 2820	5312	Registry.exe	160
PID 5312 wrote to memory of 2820	5312	Registry.exe	160
PID 5312 wrote to memory of 1460	5312	Registry.exe	161
PID 5312 wrote to memory of 1460	5312	Registry.exe	161
PID 2820 wrote to memory of 2592	2820	WScript.exe	162
PID 2820 wrote to memory of 2592	2820	WScript.exe	162
PID 2592 wrote to memory of 2588	2592	Registry.exe	163
PID 2592 wrote to memory of 2588	2592	Registry.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\279dab20ac900bec30b0f1793b059f0d.exe
"C:\Users\Admin\AppData\Local\Temp\279dab20ac900bec30b0f1793b059f0d.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\279dab20ac900bec30b0f1793b059f0d.exe
  "C:\Users\Admin\AppData\Local\Temp\279dab20ac900bec30b0f1793b059f0d.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rUDbQWxsNg.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
      "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\090123a8-e620-41d2-9697-de4ddbf5be50.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1176
      - C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e5048e1-4f64-4e50-9592-dbe19f6d4c95.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b8a3d8b-337d-41a1-8dd7-79b94b8a5abe.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b26af3d-39c5-4e6b-b97e-6ccfdc1221d4.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3afdc0e4-cd22-4205-9493-c91bec976f02.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:5692
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ec01610-bbcd-4945-8607-e82fd0fd5830.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5488
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d65274c-0ab0-4595-934f-96e8e20d96e1.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de74454b-c50d-4e7b-9efb-8556c3030bdd.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9be92698-ff49-49c3-91f0-f75fa540081c.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\644abf84-57a0-4a5d-99ab-4d39c6f8760f.vbs"
        23⤵
        
        PID:2588
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1746c71-aa13-435f-8ddb-0b8ddcc01dbc.vbs"
        25⤵
        
        PID:5692
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dee29604-5782-40c2-97e7-dfd0ff4aa771.vbs"
        27⤵
        
        PID:224
        
        C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe"
        28⤵
        
        PID:2608
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bbfcd212-0cfa-4c0c-b631-af7013855522.vbs"
        27⤵
        
        PID:1752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a041f12-b30f-4a90-81c8-4a95887b6a11.vbs"
        25⤵
        
        PID:5300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36cdfd24-7f45-42f3-882a-b5715411b3a5.vbs"
        23⤵
        
        PID:1432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0844bac-c02a-4c63-9412-7f91b12e3e51.vbs"
        21⤵
        
        PID:1460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6790e82-64be-4bf4-92c3-497682e6fc94.vbs"
        19⤵
        
        PID:2344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6122fafc-4db3-4683-b35a-e4b4e847efee.vbs"
        17⤵
        
        PID:5296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b083e301-f03e-49d7-a2e3-d7408b57353e.vbs"
        15⤵
        
        PID:5376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86f3a05a-2cb2-478f-a649-72ddbd434e4c.vbs"
        13⤵
        
        PID:2032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b7c777c-0b53-4a1b-a9ba-dfd0a3474736.vbs"
        11⤵
        
        PID:1748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f113a2db-a11d-4fad-93c5-8a7d24b6fa5a.vbs"
        9⤵
        
        PID:4880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe41c0aa-30b3-41e9-b325-76b25c639142.vbs"
        7⤵
        
        PID:5960
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\01d6cc36-4b5c-4fc3-9e68-7d4550393a78.vbs"
        5⤵
        
        PID:5192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\4d7dcf6448637544ea7e961be1ad\RuntimeBroker.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\4d7dcf6448637544ea7e961be1ad\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\4d7dcf6448637544ea7e961be1ad\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\Raga\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Media\Raga\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\Raga\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\4fc20efa2b2ad5aa4b35f8fcca90f7df\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\4fc20efa2b2ad5aa4b35f8fcca90f7df\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\4fc20efa2b2ad5aa4b35f8fcca90f7df\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\4d7dcf6448637544ea7e961be1ad\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\4d7dcf6448637544ea7e961be1ad\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\4d7dcf6448637544ea7e961be1ad\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\Vss\Writers\System\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\System\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\4d7dcf6448637544ea7e961be1ad\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\4d7dcf6448637544ea7e961be1ad\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\4d7dcf6448637544ea7e961be1ad\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Windows\en-US\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\en-US\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\4d7dcf6448637544ea7e961be1ad\RuntimeBroker.exe

Filesize
885KB

MD5
279dab20ac900bec30b0f1793b059f0d

SHA1
746b709243322cebafc65da649e8b2a9955033b0

SHA256
035e4ad513f0cb3ac0e1ef6c550e753ba271cf1795721a84f019c877cc53bfe5

SHA512
5a02f8bef439ed12276e3e7fbbb0b405988289cb2958c33a26f22c5a21d28f0befa0cc5df26abf1e1a51a0a81d37f2da945cc22f48ebd20503e7987ec5265338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\279dab20ac900bec30b0f1793b059f0d.exe.log

Filesize
1KB

MD5
7800fca2323a4130444c572374a030f4

SHA1
40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

SHA256
29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

SHA512
c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\01d6cc36-4b5c-4fc3-9e68-7d4550393a78.vbs

Filesize
514B

MD5
4c01f8ae021b2f503af513391109ec1f

SHA1
2f194db5c005462008bfe5cf77d51468fd45d0fc

SHA256
b8f1497f9d9683a4157def66d4a70969011329e53ddb105ede70abccddc6912e

SHA512
9e5ac0a41aa0f9a24214afb8d496cec75196d0f1c6ad6288120458d39531dd36230885fcb027d91a59c1b1f61fe60eb07eda9667f21f74d2da8b5808d1e10398

Download Submit
C:\Users\Admin\AppData\Local\Temp\090123a8-e620-41d2-9697-de4ddbf5be50.vbs

Filesize
738B

MD5
77180def0b7fdc0c45081e0d32804f10

SHA1
ca2e034443aa7d1cfa48e9107260ab16260e5bb2

SHA256
42053a179d2e8a40c31d854f31a971e56289fe05c379015565cee82b97c9fd18

SHA512
fca7b6c107cc62a16bd603bcec53a4afafdd0058fac5e6791c30d29cb2b54d60ca77049c8170be246bcf6e65324575ab14cff95caa32ed7eb9079c457652ca4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3afdc0e4-cd22-4205-9493-c91bec976f02.vbs

Filesize
738B

MD5
01a0c93cfe789c8fac6775143a108571

SHA1
b0f7505606c2d436611cb9a24fd5565134dfb328

SHA256
12671f2aa10782c3b748dec0daebe867b02f7d30f5bfb776bc00e0c1b3040768

SHA512
b3286adc6eeb5a9cffedae803344cb834cb4e0dcf273fd05cb47f309804290691d02d7f88a341bf2a5a166dd8a771c684be4c5e1fbccb32784ce560a5899f583

Download Submit
C:\Users\Admin\AppData\Local\Temp\3e5048e1-4f64-4e50-9592-dbe19f6d4c95.vbs

Filesize
738B

MD5
edc9526dcbc086de413a0c6a23852af4

SHA1
4ec324fcc87911953a30ad43bb16efad133c39b1

SHA256
e153b2d690001ba69658d742671a85e4cc2dacd386a5d3d4ca22f1bd2dd5150d

SHA512
b4b43593c512b2b45cdd7ba7ca56fbab7d9f0457e7814eafccdd650304ef5e433460a39fd1d586b64786655a79dc7b974769d358a75d35c738afd02d047d37c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b8a3d8b-337d-41a1-8dd7-79b94b8a5abe.vbs

Filesize
738B

MD5
7f380b7bed708882b5eeec7b4f26923b

SHA1
d94a57c91023689cc7ee56da50a6b06c909aebcf

SHA256
3d61c04d2c7d01c8db81b1fc414960e5a306ad1511e68d84c70a3afd05cc58f3

SHA512
aa9cbe87ce1bd29e8c499e050d035c749539091c9b865a9af832d8dcb1f3c2535a65ea64ab4c3592877261a3aa9b83980b66e2a880b7852c9b3be4b5263f1228

Download Submit
C:\Users\Admin\AppData\Local\Temp\644abf84-57a0-4a5d-99ab-4d39c6f8760f.vbs

Filesize
738B

MD5
ac1cbf7792224815306fa1515f6e7200

SHA1
5e29139bf493c15bdff4d4334aa10cc80b4ed07c

SHA256
146d6ff939351f8a3c5bdfba83fe7021661fdd863cb30d21906f169ce0ff6ed8

SHA512
950abba4b8d7694abf4825a8935f33c01c24be98598a4890be685bb9eaa0dbc4e0159081917ba081fff555290bab6e116077c2808132bd7ac4df648ecbab4792

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b26af3d-39c5-4e6b-b97e-6ccfdc1221d4.vbs

Filesize
738B

MD5
827336bc1d1d411b9ef9343f96d7af83

SHA1
898ca4aaee50d20a337622cc4a2f02eaa876a084

SHA256
3c14baf502c8ab1b11fceda739eba9f1ac23789ad4b9739ebc575fa5a4ef8cfb

SHA512
535fa9926011f1e06b63a76c49640deef0f564c7aa6a5d02a7da1b01de617fa6863e3f43328d47b33b18a3c9fe1ed53b8268d6c8cb5830de42f7ccb8feb4b31e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9be92698-ff49-49c3-91f0-f75fa540081c.vbs

Filesize
738B

MD5
822b5853d9f19e8b5dc1b2cee7b01923

SHA1
1b01cad890d209a2697e89d51506803c610c0e90

SHA256
f8b326eb6c87c5e073b9e73abe61df4bb778cd17c8e7161d01e0b88f940483b4

SHA512
36419d7b00a4c1f4c683d1ef5766baa99ebde18288a97af26cf7a314be68f28f7165e49552a273a3e6b62858aa393e63d3267d4dee10f3f332c352556b7ce067

Download Submit
C:\Users\Admin\AppData\Local\Temp\9d65274c-0ab0-4595-934f-96e8e20d96e1.vbs

Filesize
737B

MD5
33f63aa4fc52696061b452b25f1c9f0e

SHA1
e21a7c682c494bb303785573aecc195399cf7cc0

SHA256
4af4c00cf230186810cb758ea56278d9f05a45755a0fa5cdcb3adcb891134a29

SHA512
04281e3527aa1ab67e9dc9592e596be280be8c01ab8c11285b16fbe642b1a5ba4449d6e8ad99a2c34146bc593b8b15b0b1158b790632c84e9d11df103f85cd60

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ec01610-bbcd-4945-8607-e82fd0fd5830.vbs

Filesize
738B

MD5
cdf086110c5717b9309626424e43de2d

SHA1
2d04b149aaed06abb56ab70682dfd93514dd82e4

SHA256
5b9c47c83cb90c124451420209c41ff6637cdebd43ff500bce9a69d903eb1bca

SHA512
94fcd34fe7369c69eacf40c515acf12295dbdea0fce5ef0b15060c489b275bfc5530563a1959d431e5551d34b5b7d33f35af1572123438cec18b8c6c4b69bd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1746c71-aa13-435f-8ddb-0b8ddcc01dbc.vbs

Filesize
738B

MD5
52677f3edc7fa15e5b568858853551ea

SHA1
0f873549e960b57632115baa2670ea040f18c6f7

SHA256
ff14e10495073c3e8decce372364b843f50252ed9a6404160ac751bfa36ae777

SHA512
bffb651b8905649c0147f0a3409c70e63c1fc0138abadeadd88a3879d731d5cb04529e103da35dbff52c117e20357ccd8f9ef79369a1f0c5e4f863441518c099

Download Submit
C:\Users\Admin\AppData\Local\Temp\de74454b-c50d-4e7b-9efb-8556c3030bdd.vbs

Filesize
738B

MD5
d3255d9886cbef1fd2c6c97a1af2a5c4

SHA1
ef128bcefc51e0968d5b72abf2c57a9ecb0b7b21

SHA256
b20b1d8b613007c88d62de97205099218eea7d863cc1c76dc7435cd90ddfe6e9

SHA512
957f43809d6397a9d545ca7108b1c068647826a213a239848ae85eae341b131166e7263fa80240f7510490a81220f6de5b177507a09e3e17a5c7b23756ff1fcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\dee29604-5782-40c2-97e7-dfd0ff4aa771.vbs

Filesize
737B

MD5
b5970f7e2e14cb56735400e5bdd69ea9

SHA1
884dd670e5dce2560ee01ab35e3de7c2ad30228c

SHA256
48ce80ed2d9f2df25bb4ffe10814334069a7b5e25274ad116f034f24978cd19f

SHA512
7f27c8dd71ee2573cef023115e29e8f6570cbb0564fa674e6b49b8da93ebb09330070656df3860cd78b1c406215734862f80e6b889759305d3458985ea8872b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\rUDbQWxsNg.bat

Filesize
227B

MD5
7288532bd983b9a126421f15a1192b53

SHA1
69cead4e8d879cafd5009344b9d6022386102952

SHA256
6796142ceece28cde520cd1eac190dcf81ad9fc226a28c9f1a6c20e9a22d8f0f

SHA512
7bdb2a27d281627591b504ecf982173a2b08331e4cb396c0a88eec009cdfea04f7ff56d086f1a5c5efc32736eb1ed9a8f26a9b66f39b53ff699c2a9eb31e796a

Download Submit
memory/4280-0-0x00007FF969683000-0x00007FF969685000-memory.dmp

Filesize
8KB

Download
memory/4280-45-0x00007FF969680000-0x00007FF96A141000-memory.dmp

Filesize
10.8MB

Download
memory/4280-7-0x000000001B440000-0x000000001B44A000-memory.dmp

Filesize
40KB

Download
memory/4280-8-0x000000001B450000-0x000000001B45E000-memory.dmp

Filesize
56KB

Download
memory/4280-9-0x000000001BA70000-0x000000001BA78000-memory.dmp

Filesize
32KB

Download
memory/4280-10-0x000000001BA80000-0x000000001BA8C000-memory.dmp

Filesize
48KB

Download
memory/4280-6-0x000000001B420000-0x000000001B436000-memory.dmp

Filesize
88KB

Download
memory/4280-5-0x0000000002980000-0x0000000002990000-memory.dmp

Filesize
64KB

Download
memory/4280-4-0x000000001BAC0000-0x000000001BB10000-memory.dmp

Filesize
320KB

Download
memory/4280-3-0x000000001B400000-0x000000001B41C000-memory.dmp

Filesize
112KB

Download
memory/4280-2-0x00007FF969680000-0x00007FF96A141000-memory.dmp

Filesize
10.8MB

Download
memory/4280-1-0x0000000000810000-0x00000000008F4000-memory.dmp

Filesize
912KB

Download