dcrat | 760f5ddd00760be411967d77224b29a48e00e1eed0e978ba4017979595d1637e

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64402f0d8e48be50cf9751b33f85d1c0.exe
Size

5.9MB
MD5

64402f0d8e48be50cf9751b33f85d1c0
SHA1

4f8de3bc5101be29cd10a767de05a8d2dc3c6988
SHA256

3ce38013669a1e91dc5222723bfc954c695fc08a3efa33bbe99076a9608efc64
SHA512

6e697cd890a95e87761ab0ac6e818a90980d1a0d2e80e03d77d29888a852d671e82210f05b0adba780db46be4f7af966eb2abf7372972ccfaf7355a8f7e651f7
SSDEEP

98304:xyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4C:xyeU11Rvqmu8TWKnF6N/1wb

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2944	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2944	schtasks.exe	29

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2780	powershell.exe
2444	powershell.exe
2904	powershell.exe
2516	powershell.exe
3020	powershell.exe
1796	powershell.exe
2272	powershell.exe
2848	powershell.exe
2892	powershell.exe
3036	powershell.exe
2748	powershell.exe
2920	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	64402f0d8e48be50cf9751b33f85d1c0.exe

Executes dropped EXE 3 IoCs

pid	Process
2644	explorer.exe
1268	explorer.exe
1672	explorer.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2644	explorer.exe
2644	explorer.exe
1268	explorer.exe
1268	explorer.exe
1672	explorer.exe
1672	explorer.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\fr-FR\OSPPSVC.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\Windows Mail\es-ES\7a0fd90576e088	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files (x86)\Windows Portable Devices\cc11b995f2a76d	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Microsoft Office\RCX150B.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\RCX1C23.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Windows Mail\es-ES\RCX254E.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Windows Mail\es-ES\RCX254F.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Windows Mail\es-ES\explorer.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\Microsoft Office\lsass.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\Microsoft Office\6203df4a6bafc7	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\Internet Explorer\fr-FR\1610b97d3ab4a7	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files\Windows Mail\es-ES\explorer.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Microsoft Office\RCX150C.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\RCX1C22.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\OSPPSVC.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX2763.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\winlogon.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files\Microsoft Office\lsass.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX2764.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\CSC\csrss.exe	64402f0d8e48be50cf9751b33f85d1c0.exe
File created	C:\Windows\CSC\886983d96e3d3e	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Windows\CSC\RCX178C.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Windows\CSC\RCX180A.tmp	64402f0d8e48be50cf9751b33f85d1c0.exe
File opened for modification	C:\Windows\CSC\csrss.exe	64402f0d8e48be50cf9751b33f85d1c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2684	schtasks.exe
2628	schtasks.exe
1964	schtasks.exe
1784	schtasks.exe
2188	schtasks.exe
2656	schtasks.exe
484	schtasks.exe
2496	schtasks.exe
2432	schtasks.exe
1112	schtasks.exe
2816	schtasks.exe
560	schtasks.exe
1496	schtasks.exe
2640	schtasks.exe
2996	schtasks.exe
2880	schtasks.exe
448	schtasks.exe
2712	schtasks.exe
1172	schtasks.exe
2104	schtasks.exe
2520	schtasks.exe
1692	schtasks.exe
2016	schtasks.exe
2264	schtasks.exe
548	schtasks.exe
2448	schtasks.exe
940	schtasks.exe
2480	schtasks.exe
1676	schtasks.exe
1944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2576	64402f0d8e48be50cf9751b33f85d1c0.exe
2904	powershell.exe
2272	powershell.exe
2444	powershell.exe
2780	powershell.exe
2516	powershell.exe
3020	powershell.exe
2920	powershell.exe
3036	powershell.exe
1796	powershell.exe
2892	powershell.exe
2848	powershell.exe
2748	powershell.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe
2644	explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	64402f0d8e48be50cf9751b33f85d1c0.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2644	explorer.exe
Token: SeDebugPrivilege	1268	explorer.exe
Token: SeDebugPrivilege	1672	explorer.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1796	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	60
PID 2576 wrote to memory of 1796	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	60
PID 2576 wrote to memory of 1796	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	60
PID 2576 wrote to memory of 2272	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	61
PID 2576 wrote to memory of 2272	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	61
PID 2576 wrote to memory of 2272	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	61
PID 2576 wrote to memory of 2780	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	62
PID 2576 wrote to memory of 2780	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	62
PID 2576 wrote to memory of 2780	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	62
PID 2576 wrote to memory of 2848	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	63
PID 2576 wrote to memory of 2848	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	63
PID 2576 wrote to memory of 2848	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	63
PID 2576 wrote to memory of 2892	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	64
PID 2576 wrote to memory of 2892	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	64
PID 2576 wrote to memory of 2892	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	64
PID 2576 wrote to memory of 3036	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	65
PID 2576 wrote to memory of 3036	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	65
PID 2576 wrote to memory of 3036	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	65
PID 2576 wrote to memory of 2444	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	66
PID 2576 wrote to memory of 2444	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	66
PID 2576 wrote to memory of 2444	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	66
PID 2576 wrote to memory of 2748	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	67
PID 2576 wrote to memory of 2748	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	67
PID 2576 wrote to memory of 2748	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	67
PID 2576 wrote to memory of 2904	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	68
PID 2576 wrote to memory of 2904	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	68
PID 2576 wrote to memory of 2904	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	68
PID 2576 wrote to memory of 2920	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	69
PID 2576 wrote to memory of 2920	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	69
PID 2576 wrote to memory of 2920	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	69
PID 2576 wrote to memory of 2516	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	70
PID 2576 wrote to memory of 2516	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	70
PID 2576 wrote to memory of 2516	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	70
PID 2576 wrote to memory of 3020	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	71
PID 2576 wrote to memory of 3020	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	71
PID 2576 wrote to memory of 3020	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	71
PID 2576 wrote to memory of 2644	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	84
PID 2576 wrote to memory of 2644	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	84
PID 2576 wrote to memory of 2644	2576	64402f0d8e48be50cf9751b33f85d1c0.exe	84
PID 2644 wrote to memory of 2560	2644	explorer.exe	85
PID 2644 wrote to memory of 2560	2644	explorer.exe	85
PID 2644 wrote to memory of 2560	2644	explorer.exe	85
PID 2644 wrote to memory of 2952	2644	explorer.exe	86
PID 2644 wrote to memory of 2952	2644	explorer.exe	86
PID 2644 wrote to memory of 2952	2644	explorer.exe	86
PID 2560 wrote to memory of 1268	2560	WScript.exe	87
PID 2560 wrote to memory of 1268	2560	WScript.exe	87
PID 2560 wrote to memory of 1268	2560	WScript.exe	87
PID 1268 wrote to memory of 3000	1268	explorer.exe	88
PID 1268 wrote to memory of 3000	1268	explorer.exe	88
PID 1268 wrote to memory of 3000	1268	explorer.exe	88
PID 1268 wrote to memory of 2800	1268	explorer.exe	89
PID 1268 wrote to memory of 2800	1268	explorer.exe	89
PID 1268 wrote to memory of 2800	1268	explorer.exe	89
PID 3000 wrote to memory of 1672	3000	WScript.exe	90
PID 3000 wrote to memory of 1672	3000	WScript.exe	90
PID 3000 wrote to memory of 1672	3000	WScript.exe	90
PID 1672 wrote to memory of 2664	1672	explorer.exe	91
PID 1672 wrote to memory of 2664	1672	explorer.exe	91
PID 1672 wrote to memory of 2664	1672	explorer.exe	91
PID 1672 wrote to memory of 836	1672	explorer.exe	92
PID 1672 wrote to memory of 836	1672	explorer.exe	92
PID 1672 wrote to memory of 836	1672	explorer.exe	92

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	64402f0d8e48be50cf9751b33f85d1c0.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\64402f0d8e48be50cf9751b33f85d1c0.exe
"C:\Users\Admin\AppData\Local\Temp\64402f0d8e48be50cf9751b33f85d1c0.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
  "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2644
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\035fa99c-bc78-4256-bc82-54617deb85ad.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
      "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1268
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e040256-87cc-423f-85ee-7b6d661d545b.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3000
      - C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe
        
        "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91e3eeda-d458-4dfa-b7ae-c363fcbcafd1.vbs"
        7⤵
        
        PID:2664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\858fe56b-082a-4a73-a318-c00dc8256175.vbs"
        7⤵
        
        PID:836
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80528627-4440-4383-83d0-09486492e0b8.vbs"
        5⤵
        
        PID:2800
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8aa003c5-ffd3-48da-95ea-89fc4a3842cc.vbs"
    3⤵
    PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "64402f0d8e48be50cf9751b33f85d1c06" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\64402f0d8e48be50cf9751b33f85d1c0.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "64402f0d8e48be50cf9751b33f85d1c0" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\64402f0d8e48be50cf9751b33f85d1c0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "64402f0d8e48be50cf9751b33f85d1c06" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\64402f0d8e48be50cf9751b33f85d1c0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\CSC\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\CSC\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\CSC\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\fr-FR\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\fr-FR\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\es-ES\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\es-ES\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Internet Explorer\fr-FR\OSPPSVC.exe

Filesize
5.9MB

MD5
64402f0d8e48be50cf9751b33f85d1c0

SHA1
4f8de3bc5101be29cd10a767de05a8d2dc3c6988

SHA256
3ce38013669a1e91dc5222723bfc954c695fc08a3efa33bbe99076a9608efc64

SHA512
6e697cd890a95e87761ab0ac6e818a90980d1a0d2e80e03d77d29888a852d671e82210f05b0adba780db46be4f7af966eb2abf7372972ccfaf7355a8f7e651f7

Download Submit
C:\Program Files\Windows Mail\es-ES\RCX254E.tmp

Filesize
5.9MB

MD5
9036c0ebde681a8d78fb6067dc825b9f

SHA1
741b35c60980ed38ac04d4f6103fa402efb3fd5d

SHA256
42055b3d91bbfa6e2f26aa8dbb940bb50c5304d76086eb1d65404ce810410acb

SHA512
416720e7789a314008da66c7c4698f6ff9ed9d5eaf2591ff24e25c98c652b9f2795976e65171bc5af3842f37576bf851f21165e7fba54b911cf1edd4c2f0c658

Download Submit
C:\Users\Admin\AppData\Local\Temp\035fa99c-bc78-4256-bc82-54617deb85ad.vbs

Filesize
751B

MD5
f7313e0664249bd728c6fd3c6711d05e

SHA1
558b54310f25b1093c6b85af252337808b44dd96

SHA256
c612a199be6030aea9bacd21dc6bc572d6dfcc8077fd76766558524fb5252a66

SHA512
e3bdd0955fba583dc21034607832cf509c02936ad932a640c04d5b06d752104010d07459a2072ee56e4c5e0b64a683116d919ff67e894b2fd4fcca796b84089f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4e040256-87cc-423f-85ee-7b6d661d545b.vbs

Filesize
751B

MD5
b52bb6eba62f56565dd2ee7db9b9b8eb

SHA1
a166aecb8c646268333b7332938e99a6b4ee91b9

SHA256
80cbb03fdaa37f2161f1ee97d5b40abb69d80c18767e9fcd0f8e88afe18b3daf

SHA512
d250d42a22cd36945a80634060b4ce0aad0b228e6d86ec715dffefb42f122b4a2b9fc989d8159db337ac2cceaae52d83868a182004fa00e2575e720128327069

Download Submit
C:\Users\Admin\AppData\Local\Temp\8aa003c5-ffd3-48da-95ea-89fc4a3842cc.vbs

Filesize
527B

MD5
73f3ee653033f78298c1fe0c676a7e6f

SHA1
8d0836289974d3acea1fedc7bd83aecb16b906be

SHA256
53acd4856e16491c970b9053246613db69f3938969cbfd40a364b7784390ce20

SHA512
81a988226eb99d18e7ed022cb208c8d9b68fdbecb04775309b6aa362e24525e1e23001ab260ae16c479337f48fcc938fb64c16f4f6c0eb33736d9d4e3eed5f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\91e3eeda-d458-4dfa-b7ae-c363fcbcafd1.vbs

Filesize
751B

MD5
b340ac1f84ad355deefa1f7ad7a25de8

SHA1
e8de41ac5745a5a69a424726bc9d3ecaee145287

SHA256
55ce6430f4c6474928f09642b1f391cf9fdbc454f513df4b6fe5bc9aff1ac648

SHA512
752379ecb9ea1b52d35988b802acb235508a60614601d25fd90667ceb0b9f1e47a409079381b70edc5c74338cfb5821a7909de061166b1c63aeb2f1a4f8eb4a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a5e5cb37d6b017eb9f698dee89fd67c5

SHA1
ed5ae6a6de988ebda2bf6d6c997554fa110c9f2d

SHA256
6499498550a882f920f7b1ceedc7f3997874e2b453ca26a2d7ee9c15205cb184

SHA512
42ee911eca7dd362dc7cc21e067fb9b98e5b0d6cb0ce213e94a5a22a78ca2c3e951a0ac155f00e7c5a66cf956bd7b3d3378019d5d86dfb28627b56bfaa35c413

Download Submit
C:\Windows\CSC\csrss.exe

Filesize
5.9MB

MD5
dea1b0e41c815f6471ff4854aadf1608

SHA1
d56f1e4513f733d41545c715b1d377fb351d55d2

SHA256
a6f658292f19f16b614eefd59dade64aefdf362aeb732b234cb9074cc547f0fc

SHA512
7b040aeccb9fd8ef6a1a203ade24fca4ddf37035034a4bf7ce86e89492611777e0dca0cfca0e0a1eeb7f28f20c930f0057aeb539d3751f4e112987d80da5094b

Download Submit
memory/1268-264-0x0000000000C40000-0x0000000000C52000-memory.dmp

Filesize
72KB

Download
memory/1672-277-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2576-15-0x0000000002900000-0x0000000002910000-memory.dmp

Filesize
64KB

Download
memory/2576-38-0x000000001BC00000-0x000000001BC0A000-memory.dmp

Filesize
40KB

Download
memory/2576-8-0x0000000000420000-0x0000000000428000-memory.dmp

Filesize
32KB

Download
memory/2576-0-0x000007FEF6323000-0x000007FEF6324000-memory.dmp

Filesize
4KB

Download
memory/2576-17-0x000000001B540000-0x000000001B596000-memory.dmp

Filesize
344KB

Download
memory/2576-18-0x0000000002920000-0x000000000292C000-memory.dmp

Filesize
48KB

Download
memory/2576-16-0x0000000002910000-0x000000000291A000-memory.dmp

Filesize
40KB

Download
memory/2576-23-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/2576-21-0x0000000002A50000-0x0000000002A58000-memory.dmp

Filesize
32KB

Download
memory/2576-24-0x000000001B350000-0x000000001B35C000-memory.dmp

Filesize
48KB

Download
memory/2576-20-0x0000000002A40000-0x0000000002A4C000-memory.dmp

Filesize
48KB

Download
memory/2576-19-0x0000000002A30000-0x0000000002A38000-memory.dmp

Filesize
32KB

Download
memory/2576-14-0x0000000000520000-0x0000000000528000-memory.dmp

Filesize
32KB

Download
memory/2576-13-0x00000000028F0000-0x00000000028FC000-memory.dmp

Filesize
48KB

Download
memory/2576-25-0x000000001B590000-0x000000001B59C000-memory.dmp

Filesize
48KB

Download
memory/2576-30-0x000000001B5E0000-0x000000001B5EC000-memory.dmp

Filesize
48KB

Download
memory/2576-31-0x000000001B990000-0x000000001B99A000-memory.dmp

Filesize
40KB

Download
memory/2576-34-0x000000001B9C0000-0x000000001B9CE000-memory.dmp

Filesize
56KB

Download
memory/2576-35-0x000000001B9D0000-0x000000001B9D8000-memory.dmp

Filesize
32KB

Download
memory/2576-36-0x000000001B9E0000-0x000000001B9EC000-memory.dmp

Filesize
48KB

Download
memory/2576-39-0x000000001BC10000-0x000000001BC1C000-memory.dmp

Filesize
48KB

Download
memory/2576-9-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/2576-37-0x000000001BBF0000-0x000000001BBF8000-memory.dmp

Filesize
32KB

Download
memory/2576-33-0x000000001B9B0000-0x000000001B9B8000-memory.dmp

Filesize
32KB

Download
memory/2576-32-0x000000001B9A0000-0x000000001B9AE000-memory.dmp

Filesize
56KB

Download
memory/2576-29-0x000000001B5D0000-0x000000001B5D8000-memory.dmp

Filesize
32KB

Download
memory/2576-28-0x000000001B5C0000-0x000000001B5CC000-memory.dmp

Filesize
48KB

Download
memory/2576-27-0x000000001B5B0000-0x000000001B5BC000-memory.dmp

Filesize
48KB

Download
memory/2576-26-0x000000001B5A0000-0x000000001B5A8000-memory.dmp

Filesize
32KB

Download
memory/2576-12-0x0000000000530000-0x0000000000542000-memory.dmp

Filesize
72KB

Download
memory/2576-11-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/2576-10-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/2576-6-0x0000000000410000-0x0000000000418000-memory.dmp

Filesize
32KB

Download
memory/2576-1-0x0000000000850000-0x0000000001148000-memory.dmp

Filesize
9.0MB

Download
memory/2576-225-0x000007FEF6320000-0x000007FEF6D0C000-memory.dmp

Filesize
9.9MB

Download
memory/2576-2-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2576-3-0x000007FEF6320000-0x000007FEF6D0C000-memory.dmp

Filesize
9.9MB

Download
memory/2576-4-0x0000000000370000-0x000000000037E000-memory.dmp

Filesize
56KB

Download
memory/2576-7-0x00000000004B0000-0x00000000004CC000-memory.dmp

Filesize
112KB

Download
memory/2576-5-0x0000000000380000-0x000000000038E000-memory.dmp

Filesize
56KB

Download
memory/2644-252-0x0000000000E90000-0x0000000000EA2000-memory.dmp

Filesize
72KB

Download
memory/2644-240-0x00000000010F0000-0x00000000019E8000-memory.dmp

Filesize
9.0MB

Download
memory/2892-202-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2904-208-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download