dcrat | 545403ae8941712ac4f021d5867ac8df35a554d5754192c54da66f7b2a2d4e5f

Analysis

max time kernel
116s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

692a24fa9e70407c4d311a134752a34b.exe
Size

5.9MB
MD5

692a24fa9e70407c4d311a134752a34b
SHA1

26e196e795d61f2054ff612c744807c39d83f5c4
SHA256

82fada6265676b0e76d9902aed25cda0431e992ba79d21cceb3dd1e2c6471227
SHA512

a6e6a2c1c8c3839542cf3e9f0012070809d7e30abbbc1c9f7b0c85f5bf1ce2974148784f2845fe724a36d5cf408e799b9265aa9fef4c65ea7342585e442c973e
SSDEEP

98304:ByeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw42:ByeU11Rvqmu8TWKnF6N/1wP

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6100	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	4888	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	4888	schtasks.exe	87

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	692a24fa9e70407c4d311a134752a34b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	692a24fa9e70407c4d311a134752a34b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	692a24fa9e70407c4d311a134752a34b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3612	powershell.exe
3584	powershell.exe
5196	powershell.exe
3324	powershell.exe
2900	powershell.exe
3800	powershell.exe
5304	powershell.exe
1700	powershell.exe
60	powershell.exe
5860	powershell.exe
4168	powershell.exe
5412	powershell.exe
5328	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	692a24fa9e70407c4d311a134752a34b.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	692a24fa9e70407c4d311a134752a34b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 3 IoCs

pid	Process
1196	Idle.exe
4572	Idle.exe
2776	Idle.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	692a24fa9e70407c4d311a134752a34b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	692a24fa9e70407c4d311a134752a34b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
1196	Idle.exe
1196	Idle.exe
4572	Idle.exe
4572	Idle.exe
2776	Idle.exe
2776	Idle.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\edge_BITS_4580_608751249\fontdrvhost.exe	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\edge_BITS_4580_608751249\fontdrvhost.exe	692a24fa9e70407c4d311a134752a34b.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\Idle.exe	692a24fa9e70407c4d311a134752a34b.exe
File created	C:\Program Files\edge_BITS_4580_480293751\dllhost.exe	692a24fa9e70407c4d311a134752a34b.exe
File created	C:\Program Files\edge_BITS_4580_480293751\5940a34987c991	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\RCX8F54.tmp	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX938D.tmp	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX940B.tmp	692a24fa9e70407c4d311a134752a34b.exe
File created	C:\Program Files\Windows Media Player\5940a34987c991	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\RCX8ED6.tmp	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\Idle.exe	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\edge_BITS_4580_480293751\dllhost.exe	692a24fa9e70407c4d311a134752a34b.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\6ccacd8608530f	692a24fa9e70407c4d311a134752a34b.exe
File created	C:\Program Files\Windows Media Player\dllhost.exe	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\edge_BITS_4580_608751249\RCX8CB1.tmp	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\edge_BITS_4580_608751249\RCX8CC2.tmp	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\edge_BITS_4580_480293751\RCX9179.tmp	692a24fa9e70407c4d311a134752a34b.exe
File created	C:\Program Files\edge_BITS_4580_608751249\5b884080fd4f94	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\edge_BITS_4580_480293751\RCX9169.tmp	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Program Files\Windows Media Player\dllhost.exe	692a24fa9e70407c4d311a134752a34b.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe	692a24fa9e70407c4d311a134752a34b.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\886983d96e3d3e	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCX9620.tmp	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCX9630.tmp	692a24fa9e70407c4d311a134752a34b.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe	692a24fa9e70407c4d311a134752a34b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	692a24fa9e70407c4d311a134752a34b.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	Idle.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2120	schtasks.exe
4424	schtasks.exe
4380	schtasks.exe
4624	schtasks.exe
3692	schtasks.exe
3512	schtasks.exe
4976	schtasks.exe
4896	schtasks.exe
4392	schtasks.exe
1780	schtasks.exe
3992	schtasks.exe
6100	schtasks.exe
4980	schtasks.exe
4024	schtasks.exe
4612	schtasks.exe
1672	schtasks.exe
1888	schtasks.exe
1984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
464	692a24fa9e70407c4d311a134752a34b.exe
5304	powershell.exe
5304	powershell.exe
5412	powershell.exe
5412	powershell.exe
5860	powershell.exe
5860	powershell.exe
3612	powershell.exe
3612	powershell.exe
2900	powershell.exe
2900	powershell.exe
3800	powershell.exe
3800	powershell.exe
60	powershell.exe
60	powershell.exe
1700	powershell.exe
1700	powershell.exe
5196	powershell.exe
5196	powershell.exe
5328	powershell.exe
5328	powershell.exe
3584	powershell.exe
3584	powershell.exe
4168	powershell.exe
4168	powershell.exe
3324	powershell.exe
3324	powershell.exe
3800	powershell.exe
5196	powershell.exe
3324	powershell.exe
5304	powershell.exe
5304	powershell.exe
5860	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	692a24fa9e70407c4d311a134752a34b.exe
Token: SeDebugPrivilege	5304	powershell.exe
Token: SeDebugPrivilege	5412	powershell.exe
Token: SeDebugPrivilege	5860	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	5196	powershell.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	1196	Idle.exe
Token: SeDebugPrivilege	4572	Idle.exe
Token: SeDebugPrivilege	2776	Idle.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 5328	464	692a24fa9e70407c4d311a134752a34b.exe	111
PID 464 wrote to memory of 5328	464	692a24fa9e70407c4d311a134752a34b.exe	111
PID 464 wrote to memory of 5412	464	692a24fa9e70407c4d311a134752a34b.exe	112
PID 464 wrote to memory of 5412	464	692a24fa9e70407c4d311a134752a34b.exe	112
PID 464 wrote to memory of 4168	464	692a24fa9e70407c4d311a134752a34b.exe	113
PID 464 wrote to memory of 4168	464	692a24fa9e70407c4d311a134752a34b.exe	113
PID 464 wrote to memory of 1700	464	692a24fa9e70407c4d311a134752a34b.exe	114
PID 464 wrote to memory of 1700	464	692a24fa9e70407c4d311a134752a34b.exe	114
PID 464 wrote to memory of 5304	464	692a24fa9e70407c4d311a134752a34b.exe	116
PID 464 wrote to memory of 5304	464	692a24fa9e70407c4d311a134752a34b.exe	116
PID 464 wrote to memory of 5860	464	692a24fa9e70407c4d311a134752a34b.exe	118
PID 464 wrote to memory of 5860	464	692a24fa9e70407c4d311a134752a34b.exe	118
PID 464 wrote to memory of 3800	464	692a24fa9e70407c4d311a134752a34b.exe	119
PID 464 wrote to memory of 3800	464	692a24fa9e70407c4d311a134752a34b.exe	119
PID 464 wrote to memory of 2900	464	692a24fa9e70407c4d311a134752a34b.exe	120
PID 464 wrote to memory of 2900	464	692a24fa9e70407c4d311a134752a34b.exe	120
PID 464 wrote to memory of 3324	464	692a24fa9e70407c4d311a134752a34b.exe	121
PID 464 wrote to memory of 3324	464	692a24fa9e70407c4d311a134752a34b.exe	121
PID 464 wrote to memory of 5196	464	692a24fa9e70407c4d311a134752a34b.exe	123
PID 464 wrote to memory of 5196	464	692a24fa9e70407c4d311a134752a34b.exe	123
PID 464 wrote to memory of 60	464	692a24fa9e70407c4d311a134752a34b.exe	124
PID 464 wrote to memory of 60	464	692a24fa9e70407c4d311a134752a34b.exe	124
PID 464 wrote to memory of 3584	464	692a24fa9e70407c4d311a134752a34b.exe	126
PID 464 wrote to memory of 3584	464	692a24fa9e70407c4d311a134752a34b.exe	126
PID 464 wrote to memory of 3612	464	692a24fa9e70407c4d311a134752a34b.exe	127
PID 464 wrote to memory of 3612	464	692a24fa9e70407c4d311a134752a34b.exe	127
PID 464 wrote to memory of 5616	464	692a24fa9e70407c4d311a134752a34b.exe	137
PID 464 wrote to memory of 5616	464	692a24fa9e70407c4d311a134752a34b.exe	137
PID 5616 wrote to memory of 3320	5616	cmd.exe	139
PID 5616 wrote to memory of 3320	5616	cmd.exe	139
PID 5616 wrote to memory of 1196	5616	cmd.exe	145
PID 5616 wrote to memory of 1196	5616	cmd.exe	145
PID 1196 wrote to memory of 2688	1196	Idle.exe	149
PID 1196 wrote to memory of 2688	1196	Idle.exe	149
PID 1196 wrote to memory of 5016	1196	Idle.exe	150
PID 1196 wrote to memory of 5016	1196	Idle.exe	150
PID 2688 wrote to memory of 4572	2688	WScript.exe	159
PID 2688 wrote to memory of 4572	2688	WScript.exe	159
PID 4572 wrote to memory of 5408	4572	Idle.exe	162
PID 4572 wrote to memory of 5408	4572	Idle.exe	162
PID 4572 wrote to memory of 5448	4572	Idle.exe	163
PID 4572 wrote to memory of 5448	4572	Idle.exe	163
PID 5408 wrote to memory of 2776	5408	WScript.exe	169
PID 5408 wrote to memory of 2776	5408	WScript.exe	169

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	692a24fa9e70407c4d311a134752a34b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	692a24fa9e70407c4d311a134752a34b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	692a24fa9e70407c4d311a134752a34b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\692a24fa9e70407c4d311a134752a34b.exe
"C:\Users\Admin\AppData\Local\Temp\692a24fa9e70407c4d311a134752a34b.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/2f3e0199fccb3f72e8a39924edc6a781/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/34c553de294c1d56d0a800105b/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:60
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vYNrLnHEtP.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3320
- - C:\Program Files\Windows Media Player\Network Sharing\Idle.exe
    "C:\Program Files\Windows Media Player\Network Sharing\Idle.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1196
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f698a7dd-0492-4005-8bee-9886ee1f05b7.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Program Files\Windows Media Player\Network Sharing\Idle.exe
        
        "C:\Program Files\Windows Media Player\Network Sharing\Idle.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4572
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0123e7e-a3b6-4bd4-be14-ec4ff0423b04.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5408
        
        C:\Program Files\Windows Media Player\Network Sharing\Idle.exe
        
        "C:\Program Files\Windows Media Player\Network Sharing\Idle.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\096be23f-b182-4810-9d40-c88e70ffd692.vbs"
        8⤵
        
        PID:2924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7bd068b8-723e-40a6-94b6-c393f1a6d953.vbs"
        8⤵
        
        PID:4296
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d75af6e5-14ea-4c0d-9e94-4b59290021ad.vbs"
        6⤵
        
        PID:5448
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54b93daa-749f-4216-983c-ac6671fe1cde.vbs"
      4⤵
      PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\edge_BITS_4580_608751249\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4580_608751249\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\edge_BITS_4580_608751249\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\Network Sharing\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\Network Sharing\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\edge_BITS_4580_480293751\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4580_480293751\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\edge_BITS_4580_480293751\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Media Player\Network Sharing\Idle.exe

Filesize
5.9MB

MD5
758a1fbe2897d9c9c60ab9054e57a187

SHA1
456eb3b1d0c47b8ce69b3cb31817696e0f0a468f

SHA256
8460611fc68b13d31b2b8164be1ceaedf9a39dafcf85312ddafedb59e8b646d4

SHA512
edb6195c22d262de2ae834156bcd5c3f8ae8c9206ab52714c8b9376603ce1332d220ded3bd4e4aa4628d27372473f10f7aeb8face6dd38b1334ef47360a89ad0

Download Submit
C:\Program Files\Windows Media Player\dllhost.exe

Filesize
5.9MB

MD5
77b89f890ec13d6ca6304bf4d1c5ef09

SHA1
869437afca9eafa9acddf873f098fe76ab96095b

SHA256
4d0f0754ab33b58ed11c8d8bef138b2b69ccf79388452d02a0d7dc1fd8544f65

SHA512
4d12c3c4f46c70090973e09b174a5b971245b1ce68383ad1afaa23844531e24fb63ad78b00b06dc31cc10cf927a73d8c1fe5ff34ee3e6b67ff1a21d1940b3ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

Filesize
1KB

MD5
229da4b4256a6a948830de7ee5f9b298

SHA1
8118b8ddc115689ca9dc2fe8c244350333c5ba8b

SHA256
3d63b4a66e80ed97a8d74ea9dee7645942aafbd4abf1b31afed1027e5967fe11

SHA512
3a4ec8f720000a32bb1555b32db13236a73bb6e654e35b4de8bdb0fc0de535584bc08ebe25c7066324e86faa33e8f571a11cc4e5ef00be78e2993e228f615224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f68785608a60c0961b2926f9c4d4ff87

SHA1
e90357d9a679b851acf30e5e7aa6f76f2e6d3bb4

SHA256
edeed8daa6363551c6ffe770dc95fc9a767da6a020004c61c8e3d81eccb9d673

SHA512
fa369a235b3d4375e7856e39f42b17fb118fadb0b48fbe71074fa47354d0713662b950142ab5083c01cc850f79bbb0abe154eefe0e754b9b76e8d3b330daf652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5e4343881dc5fcb6305d29ef34a5ce28

SHA1
823b588ad6905d682cc3b7ac7bf7184d71da3d45

SHA256
27e82cc6e13b0db3a8b74798dffe21837cd4ef1f519519227bbd41ef05f428ac

SHA512
7a8c265e8dc6b4ad85132c4182270322023b4d59c97b466b5cce24402426c32fe14500343938c069cb17f985c73ef00f06187669d5b0c2050839a4cf6eb91762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3f0db2be09ea50e93f81f83a58fdc049

SHA1
862883227880dde307538079454109d35f39723e

SHA256
b747c644e6479e6e921d09626c68d2df0d33d2a707f9432e5fc1b138e6c9387d

SHA512
a7f4644e8f4a0dd59f47645ba7afe312c9e714f923019add5cddf6491f3466731abd66c854bdaa497c0f162c1ae08df5c6506e2171ec9d74ae5c9ffcd69f0773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
47dc8ed1f00b2cf40d90efa529ee35cc

SHA1
851d6a181ebb44256367c73042ed4f774bce9bdd

SHA256
2a1fa5eb6fa8a3b821776f5db5d69d414ca120a4612e613ec6ad34d216b2223e

SHA512
3dc49732881a4c8d2edfd4619ea4d206cca74fabba7d00f2021a7e07dba47c436a10f2d591ca43930c674ffe6b5f528a9e10e543dd87edf97d3f2f078c23c928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
672e8b21617ca3b368c6c154913fcfff

SHA1
cb3dab8c008b5fba2af958ce2c416c01baa6a98b

SHA256
b6ce484f4dcfab37c7fac91278a1d66c8b122865f12511634b8c5eac3fc081ec

SHA512
98b45d5545237042c9d4e99e6aa2d514bb643c80cccd1f79ca8e6412a7949fc235f2f6a5fc12a7f772e1af2343ab2e2fb863d161f1d0da3326e636c52513c7ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
86ff644f9a06688655f1c9fab80c2287

SHA1
42a285e478bbf312195d5356f22064bc9195de97

SHA256
53c83b1ce3c2769f42b262235c766cdd07271385b0af9c295eee349418fa8834

SHA512
d26f6b7313d08ae832ed492c2a6fc60f83d0c1f2f444bd1d501a8d238c4772a9250e88405fc7a2a027e2d7a517a1f89f838096446f191349f7fa6df26457fd78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
98b98bc6f00c3502bc0bd833f44f6f35

SHA1
c925fdee8cfe33b0e316fdcf21958ddd1ce86309

SHA256
4efd9594c2af84f656a82aa8aa99efc9c399583d3b9fbca88cab0a3bc6c543af

SHA512
711d030b59a93e50f8e76dbe4e89f56ffec66f25878d819db61ae2148c877ad66643a82c49eadf0158f21bf0b6d5da8d2c38c85ed23815cfc09b2a678f6ea1cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\096be23f-b182-4810-9d40-c88e70ffd692.vbs

Filesize
738B

MD5
d1ff7d2196e1ca56beea541d74f0aa25

SHA1
c71b350c7cfda45bdcab5a91e2f9019087616c49

SHA256
aa77eca8b4f10bbb9e992ece8fc6b087bd818164cd3c64404e96d725fe761a5e

SHA512
1196d918187b8286a6dfe31c39c330bbd1c2c404c19489d457d250de1d24b4e08354e33950b8000808ec8a5be77a2de3e0995ddd81cbee951f31d04a6d598393

Download Submit
C:\Users\Admin\AppData\Local\Temp\54b93daa-749f-4216-983c-ac6671fe1cde.vbs

Filesize
514B

MD5
c6f44679bb8d294f432953059b892e7b

SHA1
e8aab4dd2aa7333b1cfece89f54c794cdf817338

SHA256
daadb04266aee24a72182a75e2fb385f429c263c3fcad8429b2d7abc33e6eb48

SHA512
d1a22bc2ad92a0c69b9cab901b93d337cd6057e0a6d00b9fd499d51f52fb515d30fd4694b2b92206f3f092d22bcf64109697c73a2163016dd028a31b498cb996

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vhfgblwk.u3k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b0123e7e-a3b6-4bd4-be14-ec4ff0423b04.vbs

Filesize
738B

MD5
5d8142bf3a0c0c8157607e56e1ddc6d3

SHA1
10e1f9c992874ac8a8da35037aeb1b255ebfbc37

SHA256
a8f9becbdb3434986dfce226153e84471f99543f2f415a7f0fc9d69e0cc8e370

SHA512
00d1078fc01d7deec94eb3b2f8f0715c3026eeab9f07a05f2c66a70ac8bbd7d7298e218e5f3995d4447b322fa255a3a2e37b7af42cc7d9b50f0fced366c60e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\f698a7dd-0492-4005-8bee-9886ee1f05b7.vbs

Filesize
738B

MD5
056a750e9566b42db26c94c02f0a26f3

SHA1
2db061ff18d50b4be9a610f2c0c65a256e96cae0

SHA256
0f31885eae7c27fb736f62f16fd2be3fe64a693c3d78c6c13699274b44da2faf

SHA512
8f8cc012830086c6f4877762f7673cc9ac53c38e51d1e9e436fbcd9dc89d2291a59fb9a5ac2e3650c0e818899434e6d67c986153d7efd3398a525870dac98ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vYNrLnHEtP.bat

Filesize
227B

MD5
616539dd2a8286cc80568d30ad415284

SHA1
b195a328b257cb25d3cf66ffeec4ef2e88c021d0

SHA256
532594d747df1e07f2d51de0392f87343d621ca3429c9459700bd8cff939767f

SHA512
9b0c1de27fe42b6663d1146f7471b2d76e440ae510d7ab974a9b4a787884ad321d600c94fd6c33ff02b26f65317084bbaa818e4ba014b4421ef46cb29483ee1e

Download Submit
C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe

Filesize
5.9MB

MD5
692a24fa9e70407c4d311a134752a34b

SHA1
26e196e795d61f2054ff612c744807c39d83f5c4

SHA256
82fada6265676b0e76d9902aed25cda0431e992ba79d21cceb3dd1e2c6471227

SHA512
a6e6a2c1c8c3839542cf3e9f0012070809d7e30abbbc1c9f7b0c85f5bf1ce2974148784f2845fe724a36d5cf408e799b9265aa9fef4c65ea7342585e442c973e

Download Submit
memory/464-21-0x000000001D6B0000-0x000000001D6BC000-memory.dmp

Filesize
48KB

Download
memory/464-6-0x0000000003250000-0x0000000003258000-memory.dmp

Filesize
32KB

Download
memory/464-36-0x000000001D9A0000-0x000000001D9AE000-memory.dmp

Filesize
56KB

Download
memory/464-35-0x000000001D990000-0x000000001D998000-memory.dmp

Filesize
32KB

Download
memory/464-34-0x000000001D880000-0x000000001D88E000-memory.dmp

Filesize
56KB

Download
memory/464-33-0x000000001D870000-0x000000001D87A000-memory.dmp

Filesize
40KB

Download
memory/464-32-0x000000001D860000-0x000000001D86C000-memory.dmp

Filesize
48KB

Download
memory/464-31-0x000000001D9D0000-0x000000001D9D8000-memory.dmp

Filesize
32KB

Download
memory/464-29-0x000000001D740000-0x000000001D74C000-memory.dmp

Filesize
48KB

Download
memory/464-28-0x000000001D720000-0x000000001D728000-memory.dmp

Filesize
32KB

Download
memory/464-25-0x000000001DC70000-0x000000001E198000-memory.dmp

Filesize
5.2MB

Download
memory/464-22-0x000000001D6C0000-0x000000001D6C8000-memory.dmp

Filesize
32KB

Download
memory/464-0-0x00007FFF46603000-0x00007FFF46605000-memory.dmp

Filesize
8KB

Download
memory/464-20-0x000000001D6A0000-0x000000001D6A8000-memory.dmp

Filesize
32KB

Download
memory/464-18-0x000000001D640000-0x000000001D696000-memory.dmp

Filesize
344KB

Download
memory/464-16-0x000000001D730000-0x000000001D740000-memory.dmp

Filesize
64KB

Download
memory/464-15-0x000000001D610000-0x000000001D618000-memory.dmp

Filesize
32KB

Download
memory/464-13-0x000000001BD40000-0x000000001BD52000-memory.dmp

Filesize
72KB

Download
memory/464-12-0x000000001BCE0000-0x000000001BCE8000-memory.dmp

Filesize
32KB

Download
memory/464-11-0x000000001BCC0000-0x000000001BCD6000-memory.dmp

Filesize
88KB

Download
memory/464-9-0x000000001BCA0000-0x000000001BCA8000-memory.dmp

Filesize
32KB

Download
memory/464-8-0x000000001BCF0000-0x000000001BD40000-memory.dmp

Filesize
320KB

Download
memory/464-7-0x0000000003260000-0x000000000327C000-memory.dmp

Filesize
112KB

Download
memory/464-38-0x000000001D9C0000-0x000000001D9CC000-memory.dmp

Filesize
48KB

Download
memory/464-39-0x000000001D9E0000-0x000000001D9E8000-memory.dmp

Filesize
32KB

Download
memory/464-40-0x000000001DAF0000-0x000000001DAFA000-memory.dmp

Filesize
40KB

Download
memory/464-1-0x0000000000740000-0x0000000001038000-memory.dmp

Filesize
9.0MB

Download
memory/464-41-0x000000001D9F0000-0x000000001D9FC000-memory.dmp

Filesize
48KB

Download
memory/464-189-0x00007FFF46600000-0x00007FFF470C1000-memory.dmp

Filesize
10.8MB

Download
memory/464-37-0x000000001D9B0000-0x000000001D9B8000-memory.dmp

Filesize
32KB

Download
memory/464-30-0x000000001D750000-0x000000001D75C000-memory.dmp

Filesize
48KB

Download
memory/464-26-0x000000001D700000-0x000000001D70C000-memory.dmp

Filesize
48KB

Download
memory/464-27-0x000000001D710000-0x000000001D71C000-memory.dmp

Filesize
48KB

Download
memory/464-24-0x000000001D6D0000-0x000000001D6E2000-memory.dmp

Filesize
72KB

Download
memory/464-19-0x000000001D690000-0x000000001D69C000-memory.dmp

Filesize
48KB

Download
memory/464-17-0x000000001D630000-0x000000001D63A000-memory.dmp

Filesize
40KB

Download
memory/464-14-0x000000001D620000-0x000000001D62C000-memory.dmp

Filesize
48KB

Download
memory/464-10-0x000000001BCB0000-0x000000001BCC0000-memory.dmp

Filesize
64KB

Download
memory/464-2-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download
memory/464-3-0x00007FFF46600000-0x00007FFF470C1000-memory.dmp

Filesize
10.8MB

Download
memory/464-5-0x0000000003230000-0x000000000323E000-memory.dmp

Filesize
56KB

Download
memory/464-4-0x0000000003220000-0x000000000322E000-memory.dmp

Filesize
56KB

Download
memory/1196-286-0x000000001C370000-0x000000001C382000-memory.dmp

Filesize
72KB

Download
memory/1196-284-0x0000000000540000-0x0000000000E38000-memory.dmp

Filesize
9.0MB

Download
memory/5860-139-0x000001C266B70000-0x000001C266B92000-memory.dmp

Filesize
136KB

Download