dcrat | 5656064ae4d3c302be4f376131bce57fa83ba30e94c329f33adb91836d7f4bf8

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Size

1.6MB
MD5

43460cdfde5083d6f692f08813ef6dd1
SHA1

55756e184df04ffe1c502a40f8f859de16d19003
SHA256

33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b
SHA512

23dc4dc7bfa6f60da960b314c940e3e17e15e5719d5453a5ad1ca6f2c7f034357ad71a1a3a46b16b508076af878d7972c2d24cc3a6a7721a12bd851ff63c6e66
SSDEEP

24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5436	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	3664	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6124	3664	schtasks.exe	88

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral12/memory/1740-1-0x0000000000860000-0x0000000000A02000-memory.dmp	dcrat
behavioral12/files/0x000700000002432d-26.dat	dcrat
behavioral12/files/0x000800000002432d-89.dat	dcrat
behavioral12/files/0x0007000000024348-101.dat	dcrat
behavioral12/memory/1904-194-0x00000000006B0000-0x0000000000852000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3120	powershell.exe
3036	powershell.exe
4316	powershell.exe
6100	powershell.exe
3144	powershell.exe
5556	powershell.exe
2324	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Executes dropped EXE 13 IoCs

pid	Process
1904	taskhostw.exe
6120	taskhostw.exe
4536	taskhostw.exe
2784	taskhostw.exe
3688	taskhostw.exe
1208	taskhostw.exe
2680	taskhostw.exe
2596	taskhostw.exe
5112	taskhostw.exe
4276	taskhostw.exe
2316	taskhostw.exe
2024	taskhostw.exe
5896	taskhostw.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\RuntimeBroker.exe	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File created	C:\Program Files\edge_BITS_4664_724051295\6ccacd8608530f	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RCX8D7D.tmp	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RCX8DAC.tmp	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Program Files\edge_BITS_4664_724051295\RCX91D6.tmp	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Program Files\edge_BITS_4664_724051295\Idle.exe	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RuntimeBroker.exe	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File created	C:\Program Files (x86)\Windows NT\9e8d7a4ca61bd9	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File created	C:\Program Files\edge_BITS_4664_724051295\Idle.exe	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Program Files\edge_BITS_4664_724051295\RCX91E7.tmp	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\twain_32\RuntimeBroker.exe	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File created	C:\Windows\twain_32\9e8d7a4ca61bd9	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Windows\debug\spoolsv.exe	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Windows\twain_32\RCX93EB.tmp	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Windows\twain_32\RCX93EC.tmp	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Windows\twain_32\RuntimeBroker.exe	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File created	C:\Windows\debug\spoolsv.exe	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Windows\debug\RCX8FC1.tmp	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File opened for modification	C:\Windows\debug\RCX8FC2.tmp	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
File created	C:\Windows\debug\f3b6ecef712a24	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskhostw.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4356	schtasks.exe
4384	schtasks.exe
4464	schtasks.exe
1600	schtasks.exe
4884	schtasks.exe
4444	schtasks.exe
4388	schtasks.exe
5436	schtasks.exe
2100	schtasks.exe
3560	schtasks.exe
4320	schtasks.exe
6124	schtasks.exe
4860	schtasks.exe
3860	schtasks.exe
1332	schtasks.exe
444	schtasks.exe
1340	schtasks.exe
4332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
4316	powershell.exe
4316	powershell.exe
6100	powershell.exe
6100	powershell.exe
3144	powershell.exe
3144	powershell.exe
5556	powershell.exe
5556	powershell.exe
2324	powershell.exe
2324	powershell.exe
3120	powershell.exe
3120	powershell.exe
4316	powershell.exe
3036	powershell.exe
3036	powershell.exe
3036	powershell.exe
3120	powershell.exe
3144	powershell.exe
6100	powershell.exe
5556	powershell.exe
2324	powershell.exe
1904	taskhostw.exe
6120	taskhostw.exe
4536	taskhostw.exe
2784	taskhostw.exe
2784	taskhostw.exe
3688	taskhostw.exe
3688	taskhostw.exe
1208	taskhostw.exe
2680	taskhostw.exe
2596	taskhostw.exe
5112	taskhostw.exe
4276	taskhostw.exe
2316	taskhostw.exe
2024	taskhostw.exe
5896	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	1904	taskhostw.exe
Token: SeDebugPrivilege	6120	taskhostw.exe
Token: SeDebugPrivilege	4536	taskhostw.exe
Token: SeDebugPrivilege	2784	taskhostw.exe
Token: SeDebugPrivilege	3688	taskhostw.exe
Token: SeDebugPrivilege	1208	taskhostw.exe
Token: SeDebugPrivilege	2680	taskhostw.exe
Token: SeDebugPrivilege	2596	taskhostw.exe
Token: SeDebugPrivilege	5112	taskhostw.exe
Token: SeDebugPrivilege	4276	taskhostw.exe
Token: SeDebugPrivilege	2316	taskhostw.exe
Token: SeDebugPrivilege	2024	taskhostw.exe
Token: SeDebugPrivilege	5896	taskhostw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 4316	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	107
PID 1740 wrote to memory of 4316	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	107
PID 1740 wrote to memory of 3144	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	108
PID 1740 wrote to memory of 3144	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	108
PID 1740 wrote to memory of 6100	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	109
PID 1740 wrote to memory of 6100	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	109
PID 1740 wrote to memory of 5556	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	110
PID 1740 wrote to memory of 5556	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	110
PID 1740 wrote to memory of 3036	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	111
PID 1740 wrote to memory of 3036	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	111
PID 1740 wrote to memory of 3120	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	112
PID 1740 wrote to memory of 3120	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	112
PID 1740 wrote to memory of 2324	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	114
PID 1740 wrote to memory of 2324	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	114
PID 1740 wrote to memory of 5752	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	121
PID 1740 wrote to memory of 5752	1740	33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe	121
PID 5752 wrote to memory of 5364	5752	cmd.exe	123
PID 5752 wrote to memory of 5364	5752	cmd.exe	123
PID 5752 wrote to memory of 1904	5752	cmd.exe	127
PID 5752 wrote to memory of 1904	5752	cmd.exe	127
PID 1904 wrote to memory of 3988	1904	taskhostw.exe	129
PID 1904 wrote to memory of 3988	1904	taskhostw.exe	129
PID 1904 wrote to memory of 4348	1904	taskhostw.exe	130
PID 1904 wrote to memory of 4348	1904	taskhostw.exe	130
PID 3988 wrote to memory of 6120	3988	WScript.exe	132
PID 3988 wrote to memory of 6120	3988	WScript.exe	132
PID 6120 wrote to memory of 4560	6120	taskhostw.exe	134
PID 6120 wrote to memory of 4560	6120	taskhostw.exe	134
PID 6120 wrote to memory of 5880	6120	taskhostw.exe	135
PID 6120 wrote to memory of 5880	6120	taskhostw.exe	135
PID 4560 wrote to memory of 4536	4560	WScript.exe	136
PID 4560 wrote to memory of 4536	4560	WScript.exe	136
PID 4536 wrote to memory of 1480	4536	taskhostw.exe	137
PID 4536 wrote to memory of 1480	4536	taskhostw.exe	137
PID 4536 wrote to memory of 3128	4536	taskhostw.exe	138
PID 4536 wrote to memory of 3128	4536	taskhostw.exe	138
PID 1480 wrote to memory of 2784	1480	WScript.exe	142
PID 1480 wrote to memory of 2784	1480	WScript.exe	142
PID 2784 wrote to memory of 5956	2784	taskhostw.exe	143
PID 2784 wrote to memory of 5956	2784	taskhostw.exe	143
PID 2784 wrote to memory of 5036	2784	taskhostw.exe	144
PID 2784 wrote to memory of 5036	2784	taskhostw.exe	144
PID 5956 wrote to memory of 3688	5956	WScript.exe	147
PID 5956 wrote to memory of 3688	5956	WScript.exe	147
PID 3688 wrote to memory of 5592	3688	taskhostw.exe	148
PID 3688 wrote to memory of 5592	3688	taskhostw.exe	148
PID 3688 wrote to memory of 816	3688	taskhostw.exe	149
PID 3688 wrote to memory of 816	3688	taskhostw.exe	149
PID 5592 wrote to memory of 1208	5592	WScript.exe	150
PID 5592 wrote to memory of 1208	5592	WScript.exe	150
PID 1208 wrote to memory of 3792	1208	taskhostw.exe	151
PID 1208 wrote to memory of 3792	1208	taskhostw.exe	151
PID 1208 wrote to memory of 5816	1208	taskhostw.exe	152
PID 1208 wrote to memory of 5816	1208	taskhostw.exe	152
PID 3792 wrote to memory of 2680	3792	WScript.exe	154
PID 3792 wrote to memory of 2680	3792	WScript.exe	154
PID 2680 wrote to memory of 4568	2680	taskhostw.exe	155
PID 2680 wrote to memory of 4568	2680	taskhostw.exe	155
PID 2680 wrote to memory of 4868	2680	taskhostw.exe	156
PID 2680 wrote to memory of 4868	2680	taskhostw.exe	156
PID 4568 wrote to memory of 2596	4568	WScript.exe	160
PID 4568 wrote to memory of 2596	4568	WScript.exe	160
PID 2596 wrote to memory of 5728	2596	taskhostw.exe	161
PID 2596 wrote to memory of 5728	2596	taskhostw.exe	161

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
"C:\Users\Admin\AppData\Local\Temp\33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4664_724051295\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\4d7dcf6448637544ea7e961be1ad\TextInputHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e3weDEPsKd.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5364
- - C:\Recovery\WindowsRE\taskhostw.exe
    "C:\Recovery\WindowsRE\taskhostw.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d95b2bf2-6965-40a8-8177-7e0d8cf53459.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6120
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d725ad1-c660-4c43-9246-0344badfa787.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f12a6b39-01be-463d-a1a3-9b0ae14f5208.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4ef0d80-7753-4e3d-9cba-a94808f4c15a.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5956
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28f08391-2e49-451d-a49e-05d7ab08a8d5.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5592
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c5bdd02-93e6-4994-9f86-58052e743f32.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a91e5b4-b345-411a-9f68-6a3b25f7e5d5.vbs"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\852a057a-5279-4b02-8f29-f28f39004d99.vbs"
        18⤵
        
        PID:5728
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d88faf55-6262-4452-8d05-4357c92294c7.vbs"
        20⤵
        
        PID:3996
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9455832d-0517-4611-a1cb-1eddb7a5ccb9.vbs"
        22⤵
        
        PID:4016
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5365258-8370-473d-8ed1-eb3ee3ac7fd2.vbs"
        24⤵
        
        PID:5352
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\426c64a2-b4c9-4e6a-819e-b10190d9f4ec.vbs"
        26⤵
        
        PID:5404
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        C:\Recovery\WindowsRE\taskhostw.exe
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\408fbd9e-d99d-416c-9eb7-8dea856f1845.vbs"
        28⤵
        
        PID:1904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9cc92ac9-ef95-4f4a-ad53-b1455fae8f93.vbs"
        28⤵
        
        PID:4612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60ac8f3b-993c-4886-8562-84f1f42c2d5a.vbs"
        26⤵
        
        PID:4388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee0a2191-217f-44f6-80b9-1747c0a803ae.vbs"
        24⤵
        
        PID:2968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e8a6ec7-1b8d-4543-9784-74dc6bd948e3.vbs"
        22⤵
        
        PID:2052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ecffdc3-3da6-4af4-bd81-dfb8455d978b.vbs"
        20⤵
        
        PID:2112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d386f04-759f-429f-badb-10df210464d7.vbs"
        18⤵
        
        PID:704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c485c37f-a4b3-4ab9-b78c-a71816eb6ce0.vbs"
        16⤵
        
        PID:4868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9773440-f9c6-46eb-a592-bb70614489cc.vbs"
        14⤵
        
        PID:5816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ceb42803-0d60-4985-97fd-575af9c56d36.vbs"
        12⤵
        
        PID:816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c49fda3-ac8b-4d1d-b6d3-6e362e33e1f1.vbs"
        10⤵
        
        PID:5036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\904853c3-d1fa-448d-a5ed-eac128d7aeae.vbs"
        8⤵
        
        PID:3128
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8492dfa-2b68-4f82-8dac-a556669088a5.vbs"
        6⤵
        
        PID:5880
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75122bc2-4870-46ba-b071-4346d00c6882.vbs"
      4⤵
      PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\debug\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\debug\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\debug\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\edge_BITS_4664_724051295\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4664_724051295\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files\edge_BITS_4664_724051295\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\twain_32\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\twain_32\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\4d7dcf6448637544ea7e961be1ad\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\4d7dcf6448637544ea7e961be1ad\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\4d7dcf6448637544ea7e961be1ad\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\4d7dcf6448637544ea7e961be1ad\RCX96EC.tmp

Filesize
1.6MB

MD5
05a44993cca53aa6d501676757e5315a

SHA1
b0f1478d378e510df28fc5c510a5a1460043f24f

SHA256
cd353a0dd464403cf9239c85a366c1528671c9f2308568c8cb76b1685b953278

SHA512
97a526dc8dc807d8f20f4575990713a9f26a49e47cbf97d8645e66e61cb5a21dc560e495d124a14190b8ca265e44a67a4fbf388c4dbd5e7fb2516acf48a485c3

Download Submit
C:\4d7dcf6448637544ea7e961be1ad\TextInputHost.exe

Filesize
1.6MB

MD5
43460cdfde5083d6f692f08813ef6dd1

SHA1
55756e184df04ffe1c502a40f8f859de16d19003

SHA256
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b

SHA512
23dc4dc7bfa6f60da960b314c940e3e17e15e5719d5453a5ad1ca6f2c7f034357ad71a1a3a46b16b508076af878d7972c2d24cc3a6a7721a12bd851ff63c6e66

Download Submit
C:\Recovery\WindowsRE\taskhostw.exe

Filesize
1.6MB

MD5
a34da0ce1aed705d1e80fb59b9eb4c6f

SHA1
ed5f2f39d729a235a897e7de12a0a5c907c56f32

SHA256
10ca2e0837d550bd6a4dbcca73c47ef635a4b89b6f2dfdc5d09630edb4f20c7b

SHA512
f5d2470cab392a3e7cf0e5f6a39862cc64a34f7bb67e667bca200f1752c52a4d3e189260822c52b971dc100b23de2a3434015a7249a04cebc7f2b72dcf60e3d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
93771c301aacc738330a66a7e48b0c1b

SHA1
f7d7ac01f1f13620b1642d1638c1d212666abbae

SHA256
5512157a9ea31f455e244922910fcdb2b8116288d968b0e5e26c91b266d4de7c

SHA512
a51f43e335c8c6da130866115ee6d890f808379548b129e20e563c5ee0234cca186ecde4fd6bc609f0eba6e32b10d080f4f67483461cdd58ef0a60db78324309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
acd80d6d7114a61d8c01c77f78c805fb

SHA1
f0b79e5fd09ae019fe95d994a5b32a6a6922172d

SHA256
2d8d88440ac91d756e52b9029c25684ad2522f9dbb9c800f3929633529497818

SHA512
1cc189cbcdd80466b3418694e025e7ad00b8da0b882096a6e1274e0544b103c3bfcc717f4975ae03eda9f1bca94f7280dcc910ca207d04e44ef8db287ee6a266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c558a929f5c991ed7363b323d4eb0b90

SHA1
2563cd152880eab5bc780933905f854b29c9d566

SHA256
04e3abee01c1053e991b06858069e06ffc9722659cf3d6e024f5d1f34c05a474

SHA512
06f804d44298137f74cfcd30c64661a30c6c27ef00f370485d98cfdbcc43e23ea1a8ac1c9d7fd65af08671bbe466dcde017b174912c17609499490971763b7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c5bdd02-93e6-4994-9f86-58052e743f32.vbs

Filesize
711B

MD5
a03ed692fdbf0327908e8be0e177dc5c

SHA1
0d3cb7572cff2692629faf334152263fb4958a3e

SHA256
66471da5bc74372f7ce53c9eb7a25ca9545555e906e3080cf5d0ea44872ad8b4

SHA512
1c8b04c38e3afef7dd18b75e71086242e9db8dc4c3a73c518a56f761b388e693d032491a1fc2e021fdb97b5cdd4c1e3b977f6f6a3e354c255049b6c24c171095

Download Submit
C:\Users\Admin\AppData\Local\Temp\28f08391-2e49-451d-a49e-05d7ab08a8d5.vbs

Filesize
711B

MD5
656d5f607de7ff2bca6ff39eae15790f

SHA1
eca253e100839c8f13fe5c95703827936ffff794

SHA256
6d854ff67cd26dea52c000abf58da512b17f87e1cff75397c2779caed118c5d8

SHA512
9447cd702e5e35b357a3e94e605a469cd2bda8842c87015afe8bc947405201075f11d3e5d286c6ce0e94d2e4cc67c6b5aa5c69e9c2e2b18a31aa667d507e19c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\408fbd9e-d99d-416c-9eb7-8dea856f1845.vbs

Filesize
711B

MD5
c25058ca46ebe2e29c49563523ce34c1

SHA1
63ef3d8d07853975e374b6c6dd03bc3756097410

SHA256
4575ff47ab4f0d75c968833ff29d572e63c8bb5f38c14c6f3613c49cfbac9efb

SHA512
476e5bfab03e0879b870562d7d2af179977bb25011f665bfc9fa6c902574caee60c813a2b90d66a965ee264d7b09df2aee1722c3476ad23938f372de160a38a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\426c64a2-b4c9-4e6a-819e-b10190d9f4ec.vbs

Filesize
711B

MD5
417e3c01593c4763a9c139f4a8161d4f

SHA1
982fb0ef25e18b2a7f284aac6ab03f6ea6705c27

SHA256
68866961f29e5dbba5b8feb5aff71a19ce06aa98acb43fd36b386f32d55a2456

SHA512
ffe91482ee6ae764ba9156980139d6578787fd561a410cc7bae30e4b0fbd84cdc7a64a6f24c73563503dedb66ab876d13db660176975ac464364b501a1c2c6c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\4d725ad1-c660-4c43-9246-0344badfa787.vbs

Filesize
711B

MD5
5bf03dc847f8e38a1ba644b52bc922f0

SHA1
72f0859e3cb1b8413146457c19d8b37e8f95dcb9

SHA256
8b27f3c4d23e8d6a7fede8448475ea5bd7a4e50b4e49ebcb8728f694dcc37f61

SHA512
6523e68d2cd40f6759a00fabcc882e3ee11aadda3cea0fb312dfc4146871efc6b0a9438fd28a5f538371b1905f0933000997391464f68d70ee80f53f1107c3ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\6a91e5b4-b345-411a-9f68-6a3b25f7e5d5.vbs

Filesize
711B

MD5
dee6cad0738efd88398d1d5202c17bde

SHA1
3118c5a7de7d3a780753cf5e95c13b7c2b806dd2

SHA256
004565828bcc947866ce0fd26d19846b859a19e70a33cf2c6c6cf970a45a9e10

SHA512
42e70e91d81a1b5e237529fec935a96d58f0cd4f37f80ac28192e29e743994829da1214c7bd9fdba3583a8319be4d171dfa8b17462a6f2ffb4a058f9a7ea53ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\75122bc2-4870-46ba-b071-4346d00c6882.vbs

Filesize
487B

MD5
7fb54db7057d1587b1cd7dcbb3545820

SHA1
d49557ad7ce3e96533d38181c9bb877d37a2ccdb

SHA256
0b5e080a464a722d5dd3fdff0a4fa62324d76a9ea1ccc4aa986bffd1c48ab03f

SHA512
144139650b95fc7d7eaa4d3a00c23c86f8a11cff402280785ee2d2f847138990e4552cf4b76805b73ef9ce38a1bb0c9cb832d65c8787880faba9146f740f1e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\852a057a-5279-4b02-8f29-f28f39004d99.vbs

Filesize
711B

MD5
0570cd836fc17715dd1d1fc000c5380c

SHA1
6324db549a991767771cc5702b75733ae8296539

SHA256
fbd3c345361658d2612d5fe6e1f64e39d93746427e6e05861442304ef92e4881

SHA512
eae54bf9b8a959dcf61906b0afef904c54e0f0eb3f645da2ba70b425e6a00bb8190a58fc403113117a03335ad26f4846a2fad71f59a85d213006d7d875a42e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9455832d-0517-4611-a1cb-1eddb7a5ccb9.vbs

Filesize
711B

MD5
b2098a10666ee8dcbdb360736247c963

SHA1
b2d45ed5a4a78f636357cd252da3746343abbb24

SHA256
dd56c9eff3a6973852d3b4b7cb314c14581cbeb7c03364f451a83f285683fc7b

SHA512
b60778bee29067906b33cc6e636518176b9de9874f6d5e200c550dfac279229d28713b41cd93e4bc0e7acf2c97d39845edf9dd888139ae35666c9dbfb67c2f9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cyk1vy45.2zf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c4ef0d80-7753-4e3d-9cba-a94808f4c15a.vbs

Filesize
711B

MD5
220957a5c8777c251f6e1bd909b7c9b6

SHA1
8ae45230925d986be72e09fb8dbc8aa8a5d3fac6

SHA256
26d0e58428fc727381832876a41e6ea81a3cfc2584884fbf1404b6299d4b6c6b

SHA512
e636e89617c1897ebdab432743fa381c48080332c2d1b8292f878c0e9c4f189e1b6cdde52ed49a938285d0423068d4e743a35dfe6bfaae9c25556aeb5c9ec7c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5365258-8370-473d-8ed1-eb3ee3ac7fd2.vbs

Filesize
711B

MD5
46ce85ab1c9da7c761241be9b721c76d

SHA1
fd0d763d11ab6ede7f213a85a409d68dc1dff625

SHA256
ad6d0e05138fdc1919316224591a69ef026c03ffd3fe491651819720d2e026b7

SHA512
add2d464184cb6efd5c0eded669d12a4a4b0c50867bcfad80de78f1237773c925848e1469587e534b495710bec295f5b504a06f6dbf2aa8f209caae04790d1be

Download Submit
C:\Users\Admin\AppData\Local\Temp\d88faf55-6262-4452-8d05-4357c92294c7.vbs

Filesize
711B

MD5
f4f69c2ff3c2e0072c8f8de5e30ba263

SHA1
a64bd49dd749efd2fdccdbae68d0fab02af30d51

SHA256
3153496780a92ccaed2954ce1dc1ebfb2d918b9307dd2c6e042853e8ae7d1dd2

SHA512
651140821e223461183c4ebb77668dd04327fc9e11a88686f9859a4671a8732054fdabc2c434a063d8fc1c5c383a45afc59deda56145f6f827c521b4e9c7b04f

Download Submit
C:\Users\Admin\AppData\Local\Temp\d95b2bf2-6965-40a8-8177-7e0d8cf53459.vbs

Filesize
711B

MD5
5d0b923b80988ee9c1e1122b8deebcb4

SHA1
5c5de58917db6d24aeb971a34950316ee9382987

SHA256
ef30a3b35db56d8e04ab4dda5c27c9e75dff79ca5e57b43c0ee85f9c9c44e5dd

SHA512
3ec28c2b5b969b9cc3ad3bbc36826b4e4f478d6f1eab85ba344702367ccebd13d50ce9a4ba5fdbc50c322c8a2d473027ef3f73f115b8d8f95d106415f2c8bb6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\e3weDEPsKd.bat

Filesize
200B

MD5
314ae5945e154c5dd764c08243452a20

SHA1
b785e49abd88193c8398c30824f1f4af815d5413

SHA256
78772d40160b99a31ecb2428c60d4685689cc2a4bc4fd6983df450b2de5d869d

SHA512
6414846ab0ff0f4d09d089f1f90565b5a2cfd311960e57d2df3450832f0d8c63a08e9b6b028607c9b6bc6e24110c2166c98d352dace61abd87f665c755419e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\f12a6b39-01be-463d-a1a3-9b0ae14f5208.vbs

Filesize
711B

MD5
1905941aebb2348fad543379fd148fbe

SHA1
2903e31dc456839ef3826332bde2a28d33ea6985

SHA256
d61ff8f4f3695d4f5441fd7f9a7d1ace42e78a47b5f1c2f1751ff50c9dc50d58

SHA512
1df689b4304e8e252610360b4734ba8522f3305770d93143d1f598e0ae1e3e10681025bd2a132521518ba87feafa22fb0a8b68120ede4621e3ef5f76ae2ba387

Download Submit
memory/1740-4-0x000000001BC90000-0x000000001BCE0000-memory.dmp

Filesize
320KB

Download
memory/1740-7-0x000000001B540000-0x000000001B548000-memory.dmp

Filesize
32KB

Download
memory/1740-15-0x000000001BEE0000-0x000000001BEE8000-memory.dmp

Filesize
32KB

Download
memory/1740-16-0x000000001BEF0000-0x000000001BEFA000-memory.dmp

Filesize
40KB

Download
memory/1740-1-0x0000000000860000-0x0000000000A02000-memory.dmp

Filesize
1.6MB

Download
memory/1740-13-0x000000001BEC0000-0x000000001BECE000-memory.dmp

Filesize
56KB

Download
memory/1740-17-0x000000001BF00000-0x000000001BF0C000-memory.dmp

Filesize
48KB

Download
memory/1740-5-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/1740-6-0x000000001B520000-0x000000001B536000-memory.dmp

Filesize
88KB

Download
memory/1740-120-0x00007FF91ECC0000-0x00007FF91F781000-memory.dmp

Filesize
10.8MB

Download
memory/1740-0-0x00007FF91ECC3000-0x00007FF91ECC5000-memory.dmp

Filesize
8KB

Download
memory/1740-14-0x000000001BED0000-0x000000001BED8000-memory.dmp

Filesize
32KB

Download
memory/1740-9-0x000000001B560000-0x000000001B568000-memory.dmp

Filesize
32KB

Download
memory/1740-10-0x000000001BCE0000-0x000000001BCEC000-memory.dmp

Filesize
48KB

Download
memory/1740-11-0x000000001BEA0000-0x000000001BEAC000-memory.dmp

Filesize
48KB

Download
memory/1740-8-0x000000001B550000-0x000000001B560000-memory.dmp

Filesize
64KB

Download
memory/1740-2-0x00007FF91ECC0000-0x00007FF91F781000-memory.dmp

Filesize
10.8MB

Download
memory/1740-3-0x0000000000FD0000-0x0000000000FEC000-memory.dmp

Filesize
112KB

Download
memory/1740-12-0x000000001BEB0000-0x000000001BEBA000-memory.dmp

Filesize
40KB

Download
memory/1904-194-0x00000000006B0000-0x0000000000852000-memory.dmp

Filesize
1.6MB

Download
memory/4316-119-0x00000274A7EF0000-0x00000274A7F12000-memory.dmp

Filesize
136KB

Download