dcrat | 33ec0ab437a5c2a159ba1cb632074a627f0762c7d23307925c6f0df4c612c04b

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

33ec0ab437a5c2a159ba1cb632074a627f0762c7d23307925c6f0df4c612c04b.exe
Size

1.3MB
MD5

6b4c38d194540f0d4f7dfd122c5248eb
SHA1

da9057af4e44743392f3d44f04bcc39246ff47f0
SHA256

33ec0ab437a5c2a159ba1cb632074a627f0762c7d23307925c6f0df4c612c04b
SHA512

91cad280d69e100f201c156b422c2fcabc9000db9753eb575cf1802864ba6c1d83253d2ab2226bd2c6ed4aaa22caff77fc96a455e22c0019925c8455085014bd
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	3800	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	3800	schtasks.exe	21

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000022e0c-137.dat	dcrat
behavioral1/files/0x0006000000022e0c-138.dat	dcrat
behavioral1/memory/384-139-0x00000000000E0000-0x00000000001F0000-memory.dmp	dcrat
behavioral1/files/0x0006000000022e2b-188.dat	dcrat
behavioral1/files/0x0006000000022e2b-187.dat	dcrat
behavioral1/files/0x0006000000022e2b-195.dat	dcrat
behavioral1/files/0x0006000000022e2b-203.dat	dcrat
behavioral1/files/0x0006000000022e2b-210.dat	dcrat
behavioral1/files/0x0006000000022e2b-217.dat	dcrat
behavioral1/files/0x0006000000022e2b-224.dat	dcrat
behavioral1/files/0x0006000000022e2b-231.dat	dcrat
behavioral1/files/0x0006000000022e2b-238.dat	dcrat
behavioral1/files/0x0006000000022e2b-245.dat	dcrat

Executes dropped EXE 10 IoCs

pid	Process
384	DllCommonsvc.exe
4432	winlogon.exe
1140	winlogon.exe
5112	winlogon.exe
1636	winlogon.exe
3832	winlogon.exe
2920	winlogon.exe
1728	winlogon.exe
5116	winlogon.exe
1272	winlogon.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	33ec0ab437a5c2a159ba1cb632074a627f0762c7d23307925c6f0df4c612c04b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\c5b4cb5e9653cc	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\IME\es-ES\services.exe	DllCommonsvc.exe
File created	C:\Windows\IME\es-ES\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\ModemLogs\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\ModemLogs\cc11b995f2a76d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4804	schtasks.exe
3052	schtasks.exe
1504	schtasks.exe
2392	schtasks.exe
3572	schtasks.exe
4364	schtasks.exe
1840	schtasks.exe
3748	schtasks.exe
1168	schtasks.exe
4788	schtasks.exe
2152	schtasks.exe
4084	schtasks.exe
3796	schtasks.exe
3664	schtasks.exe
1872	schtasks.exe
1524	schtasks.exe
3460	schtasks.exe
4152	schtasks.exe
2096	schtasks.exe
2492	schtasks.exe
4012	schtasks.exe
3536	schtasks.exe
3452	schtasks.exe
4908	schtasks.exe
2060	schtasks.exe
116	schtasks.exe
1684	schtasks.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	33ec0ab437a5c2a159ba1cb632074a627f0762c7d23307925c6f0df4c612c04b.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
384	DllCommonsvc.exe
3428	powershell.exe
3428	powershell.exe
4264	powershell.exe
4264	powershell.exe
4584	powershell.exe
4584	powershell.exe
680	powershell.exe
680	powershell.exe
920	powershell.exe
920	powershell.exe
5108	powershell.exe
5108	powershell.exe
3648	powershell.exe
3648	powershell.exe
4716	powershell.exe
4716	powershell.exe
724	powershell.exe
724	powershell.exe
4168	powershell.exe
4168	powershell.exe
3428	powershell.exe
4264	powershell.exe
4584	powershell.exe
724	powershell.exe
3648	powershell.exe
920	powershell.exe
680	powershell.exe
4716	powershell.exe
5108	powershell.exe
4168	powershell.exe
4432	winlogon.exe
1140	winlogon.exe
5112	winlogon.exe
1636	winlogon.exe
3832	winlogon.exe
2920	winlogon.exe
1728	winlogon.exe
5116	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe
1272	winlogon.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	DllCommonsvc.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	724	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	4432	winlogon.exe
Token: SeDebugPrivilege	1140	winlogon.exe
Token: SeDebugPrivilege	5112	winlogon.exe
Token: SeDebugPrivilege	1636	winlogon.exe
Token: SeDebugPrivilege	3832	winlogon.exe
Token: SeDebugPrivilege	2920	winlogon.exe
Token: SeDebugPrivilege	1728	winlogon.exe
Token: SeDebugPrivilege	5116	winlogon.exe
Token: SeDebugPrivilege	1272	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 3548	1352	33ec0ab437a5c2a159ba1cb632074a627f0762c7d23307925c6f0df4c612c04b.exe	81
PID 1352 wrote to memory of 3548	1352	33ec0ab437a5c2a159ba1cb632074a627f0762c7d23307925c6f0df4c612c04b.exe	81
PID 1352 wrote to memory of 3548	1352	33ec0ab437a5c2a159ba1cb632074a627f0762c7d23307925c6f0df4c612c04b.exe	81
PID 3548 wrote to memory of 2136	3548	WScript.exe	85
PID 3548 wrote to memory of 2136	3548	WScript.exe	85
PID 3548 wrote to memory of 2136	3548	WScript.exe	85
PID 2136 wrote to memory of 384	2136	cmd.exe	87
PID 2136 wrote to memory of 384	2136	cmd.exe	87
PID 384 wrote to memory of 4168	384	DllCommonsvc.exe	116
PID 384 wrote to memory of 4168	384	DllCommonsvc.exe	116
PID 384 wrote to memory of 3428	384	DllCommonsvc.exe	117
PID 384 wrote to memory of 3428	384	DllCommonsvc.exe	117
PID 384 wrote to memory of 4264	384	DllCommonsvc.exe	118
PID 384 wrote to memory of 4264	384	DllCommonsvc.exe	118
PID 384 wrote to memory of 4584	384	DllCommonsvc.exe	124
PID 384 wrote to memory of 4584	384	DllCommonsvc.exe	124
PID 384 wrote to memory of 680	384	DllCommonsvc.exe	119
PID 384 wrote to memory of 680	384	DllCommonsvc.exe	119
PID 384 wrote to memory of 920	384	DllCommonsvc.exe	121
PID 384 wrote to memory of 920	384	DllCommonsvc.exe	121
PID 384 wrote to memory of 5108	384	DllCommonsvc.exe	130
PID 384 wrote to memory of 5108	384	DllCommonsvc.exe	130
PID 384 wrote to memory of 3648	384	DllCommonsvc.exe	129
PID 384 wrote to memory of 3648	384	DllCommonsvc.exe	129
PID 384 wrote to memory of 4716	384	DllCommonsvc.exe	128
PID 384 wrote to memory of 4716	384	DllCommonsvc.exe	128
PID 384 wrote to memory of 724	384	DllCommonsvc.exe	134
PID 384 wrote to memory of 724	384	DllCommonsvc.exe	134
PID 384 wrote to memory of 2796	384	DllCommonsvc.exe	136
PID 384 wrote to memory of 2796	384	DllCommonsvc.exe	136
PID 2796 wrote to memory of 4156	2796	cmd.exe	138
PID 2796 wrote to memory of 4156	2796	cmd.exe	138
PID 2796 wrote to memory of 4432	2796	cmd.exe	141
PID 2796 wrote to memory of 4432	2796	cmd.exe	141
PID 4432 wrote to memory of 740	4432	winlogon.exe	144
PID 4432 wrote to memory of 740	4432	winlogon.exe	144
PID 740 wrote to memory of 3532	740	cmd.exe	143
PID 740 wrote to memory of 3532	740	cmd.exe	143
PID 740 wrote to memory of 1140	740	cmd.exe	146
PID 740 wrote to memory of 1140	740	cmd.exe	146
PID 1140 wrote to memory of 380	1140	winlogon.exe	147
PID 1140 wrote to memory of 380	1140	winlogon.exe	147
PID 380 wrote to memory of 4560	380	cmd.exe	149
PID 380 wrote to memory of 4560	380	cmd.exe	149
PID 380 wrote to memory of 5112	380	cmd.exe	150
PID 380 wrote to memory of 5112	380	cmd.exe	150
PID 5112 wrote to memory of 4616	5112	winlogon.exe	151
PID 5112 wrote to memory of 4616	5112	winlogon.exe	151
PID 4616 wrote to memory of 1604	4616	cmd.exe	153
PID 4616 wrote to memory of 1604	4616	cmd.exe	153
PID 4616 wrote to memory of 1636	4616	cmd.exe	154
PID 4616 wrote to memory of 1636	4616	cmd.exe	154
PID 1636 wrote to memory of 2040	1636	winlogon.exe	155
PID 1636 wrote to memory of 2040	1636	winlogon.exe	155
PID 2040 wrote to memory of 4368	2040	cmd.exe	157
PID 2040 wrote to memory of 4368	2040	cmd.exe	157
PID 2040 wrote to memory of 3832	2040	cmd.exe	158
PID 2040 wrote to memory of 3832	2040	cmd.exe	158
PID 3832 wrote to memory of 2104	3832	winlogon.exe	159
PID 3832 wrote to memory of 2104	3832	winlogon.exe	159
PID 2104 wrote to memory of 2712	2104	cmd.exe	161
PID 2104 wrote to memory of 2712	2104	cmd.exe	161
PID 2104 wrote to memory of 2920	2104	cmd.exe	162
PID 2104 wrote to memory of 2920	2104	cmd.exe	162

C:\Users\Admin\AppData\Local\Temp\33ec0ab437a5c2a159ba1cb632074a627f0762c7d23307925c6f0df4c612c04b.exe
"C:\Users\Admin\AppData\Local\Temp\33ec0ab437a5c2a159ba1cb632074a627f0762c7d23307925c6f0df4c612c04b.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Music\SppExtComObj.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\es-ES\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\upfc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:724
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qlTNZm6TEt.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2796
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4156
      - C:\Windows\ModemLogs\winlogon.exe
        
        "C:\Windows\ModemLogs\winlogon.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\ModemLogs\winlogon.exe
        
        "C:\Windows\ModemLogs\winlogon.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4560
        
        C:\Windows\ModemLogs\winlogon.exe
        
        "C:\Windows\ModemLogs\winlogon.exe"
        10⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jobc5AEC9X.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1604
        
        C:\Windows\ModemLogs\winlogon.exe
        
        "C:\Windows\ModemLogs\winlogon.exe"
        12⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VeFqpJq3BV.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4368
        
        C:\Windows\ModemLogs\winlogon.exe
        
        "C:\Windows\ModemLogs\winlogon.exe"
        14⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uSuCPwp4Rh.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2712
        
        C:\Windows\ModemLogs\winlogon.exe
        
        "C:\Windows\ModemLogs\winlogon.exe"
        16⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3B2OAH3dio.bat"
        17⤵
        
        PID:4188
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:908
        
        C:\Windows\ModemLogs\winlogon.exe
        
        "C:\Windows\ModemLogs\winlogon.exe"
        18⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kXH0MsH7jV.bat"
        19⤵
        
        PID:4916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1764
        
        C:\Windows\ModemLogs\winlogon.exe
        
        "C:\Windows\ModemLogs\winlogon.exe"
        20⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tGPC7CVf0d.bat"
        21⤵
        
        PID:3716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1244
        
        C:\Windows\ModemLogs\winlogon.exe
        
        "C:\Windows\ModemLogs\winlogon.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\odt\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Music\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Music\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Music\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\es-ES\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\IME\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\ModemLogs\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\ModemLogs\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\odt\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4364

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:3532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B2OAH3dio.bat

Filesize
198B

MD5
f8646058b734f2ae60d595e561d34f6f

SHA1
7a82ea8456cc92fdb59b6888c0ad5758971fe156

SHA256
a12a69300bd59ab17626029851523b50e71cb7a047efad010c64d976d27522cf

SHA512
566a7c616eefe216105a90aecb5470a347c672d0c049d46c25f411e5982bc673c6c84b9de07fe0841711168fad090d6d042c82cc7bdaf8ba2d1ffe6ac62f84eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jobc5AEC9X.bat

Filesize
198B

MD5
1148cdbac62d4c4c07b6db0af0b73583

SHA1
1c55f31ffe4bdc27f8bd3b7934c66bb1ff796f37

SHA256
53ec936a207aa6c6a08281f1b01a0d9a1098ad0da0b246d256957d318bf74bec

SHA512
e0d42284ed9fd4f8dddd45c1605051ed7b9c433f99877128d033bad3687ea641e0bcf22164b491c1ad34ff11409c2c488d2e28725e4e0921dd1eb151e3172f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\VeFqpJq3BV.bat

Filesize
198B

MD5
0b34f59d83cfaa079d0da2f3c87b3c3d

SHA1
66f9dc8ed4eb91cd78b807de23de5f1c06d5a4c2

SHA256
144ebc2bf252b7e866d2cce49adf27eb051582afbdd5d3a6bcfc76f60dfdb740

SHA512
82f1f1adade94081e8bcaf513e28ebf135a8625318d706e08ecb3024b78d6eff12d73baefa18b17c25d53cdc84794ce1d2e537e19d968c3d45ed48c968bebe59

Download Submit
C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat

Filesize
198B

MD5
91f4cd7f31ab4b01290cfad618808bf2

SHA1
c9c56823c869e641df0dcdaa8626ae6d8432de79

SHA256
25083c8e366a0e0adddd1bdb45861398786a4014f4aa1c91667c6336688d3d4c

SHA512
18495d3d2b7fa7abb2566bae6a1a71015fc8a97c71441ce32359b9bd2af7235addf3192d5acb0821b9fa8d99e1d9d48c37d7d42dfbbdf2c0b076685835606e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\kXH0MsH7jV.bat

Filesize
198B

MD5
c7f5fee41014a6bb5e9735977792e6ff

SHA1
999be481f7dc127fd29d6296374a14fccee465bb

SHA256
37201e87b5a293a15f79412646558c60e30d5d8fdb5fcb4c69bec3b8f365fc51

SHA512
add0f02d50ea3b551d81fe00afcc12798f6a5b41452779b27a8bcd8415fba3b2694cb1cbd203dfe39def9803e962a9ed576adfed472fe38057b41d138fa855b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlTNZm6TEt.bat

Filesize
198B

MD5
51654fd013b9556ac0b74c4560def2b1

SHA1
34951f436b0463cec5bbf5c7d93cdf3989834411

SHA256
80a46d539927db10a2ac3646c9a7f92d02e2f7468d5369925e8249dc3522966c

SHA512
9e105454208f1212be20f39ddd293c27c430bc6f200df605934f3bee50c0642f5a4831497f92ca10831a466da3762d7c5ea5a714bf1882cbd1c96456049711c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat

Filesize
198B

MD5
1625394fd76852b404f5f5fb9054afc6

SHA1
bd94e5ad4d8f04110eeafdfd5aff706c0aacdef7

SHA256
2dccd048be51b7aafc39476c2a6c79c304b291b8d52b0909362d6580b3ec3ae9

SHA512
326808450b77aa12cd204b89d7193af69ddb719daff0147cdfddbe05e413958c2e3686f6548e17cc6006fb323da462c93dcec653734c38518f88f760c17b0747

Download Submit
C:\Users\Admin\AppData\Local\Temp\tGPC7CVf0d.bat

Filesize
198B

MD5
0982c3bf9fa55a0e655e2563915f1b92

SHA1
64186afef00ad365891fd51f0507ce7d6a8dd485

SHA256
08561a206992ecf8762d425927c49cb1a49ab4149445383700e323fb44c16662

SHA512
1e7ad4ba9f55838fd94811ca397b7515f6e378e534ca9abc67b5699fad2d97da0ce4cd48fca82469027ebd668e7a2dbd214b76475c5881a2a05c81c46286d1b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\uSuCPwp4Rh.bat

Filesize
198B

MD5
bb9949e23a435aef66763b74a4c81769

SHA1
90f9277bcb51ff37427378e478ac2ff1e4e336e9

SHA256
76362e33df854076c9dffad88f540e849588a5e06e57ca13ab374b57fb69f0be

SHA512
585065f8351b2ad1a531955868da497d248c05fa7eb611e88f5f6ace039fe9641f1f98ee3a854c72e03edd820fd0e0a07135a759ae456d0384a92fce6e52af7f

Download Submit
C:\Windows\ModemLogs\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ModemLogs\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ModemLogs\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ModemLogs\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ModemLogs\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ModemLogs\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ModemLogs\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ModemLogs\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ModemLogs\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ModemLogs\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/384-140-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/384-139-0x00000000000E0000-0x00000000001F0000-memory.dmp

Filesize
1.1MB

Download
memory/384-155-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/680-182-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/680-154-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/724-181-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/724-165-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/920-164-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/920-178-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/1140-201-0x00007FFAD9880000-0x00007FFADA341000-memory.dmp

Filesize
10.8MB

Download
memory/1140-197-0x00007FFAD9880000-0x00007FFADA341000-memory.dmp

Filesize
10.8MB

Download
memory/1272-247-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/1272-246-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/1636-215-0x00007FFAD9880000-0x00007FFADA341000-memory.dmp

Filesize
10.8MB

Download
memory/1636-211-0x00007FFAD9880000-0x00007FFADA341000-memory.dmp

Filesize
10.8MB

Download
memory/1728-236-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/1728-232-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2920-229-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2920-225-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3428-151-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3428-172-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3648-158-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3648-168-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3832-218-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3832-222-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4168-185-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4168-159-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4264-153-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4264-157-0x000001A80AAC0000-0x000001A80AAE2000-memory.dmp

Filesize
136KB

Download
memory/4264-174-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4432-193-0x00007FFAD9880000-0x00007FFADA341000-memory.dmp

Filesize
10.8MB

Download
memory/4432-189-0x00007FFAD9880000-0x00007FFADA341000-memory.dmp

Filesize
10.8MB

Download
memory/4584-171-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4584-163-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4716-160-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4716-180-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/5108-156-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/5108-183-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/5112-204-0x00007FFAD9880000-0x00007FFADA341000-memory.dmp

Filesize
10.8MB

Download
memory/5112-208-0x00007FFAD9880000-0x00007FFADA341000-memory.dmp

Filesize
10.8MB

Download
memory/5116-240-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download
memory/5116-241-0x00007FFAD9930000-0x00007FFADA3F1000-memory.dmp

Filesize
10.8MB

Download