dcrat | c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129.exe
Size

1.3MB
MD5

333f326141960b2bc7cb3afeb5af3212
SHA1

1dd3852cd413bf4b167d283c9cc1fc9f9f0a0969
SHA256

c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129
SHA512

39dc0e02578e520439260a3cc645288881e3767fd3126599e86f3dc50b1ebca023d3ccb3d1fb7de5f7eb7b245a8307e741777260f8b571c26882fa9450e974fb
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	4412	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	4412	schtasks.exe	28

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0001000000022e6d-137.dat	dcrat
behavioral1/files/0x0001000000022e6d-138.dat	dcrat
behavioral1/memory/5084-139-0x0000000000A40000-0x0000000000B50000-memory.dmp	dcrat
behavioral1/files/0x0001000000022e7a-154.dat	dcrat
behavioral1/files/0x0001000000022e7a-153.dat	dcrat
behavioral1/files/0x0001000000022e7a-188.dat	dcrat
behavioral1/files/0x0001000000022e7a-196.dat	dcrat
behavioral1/files/0x0001000000022e7a-203.dat	dcrat
behavioral1/files/0x0001000000022e7a-210.dat	dcrat
behavioral1/files/0x0001000000022e7a-217.dat	dcrat
behavioral1/files/0x0001000000022e7a-224.dat	dcrat
behavioral1/files/0x0001000000022e7a-231.dat	dcrat
behavioral1/files/0x0001000000022e7a-238.dat	dcrat
behavioral1/files/0x0001000000022e7a-245.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
5084	DllCommonsvc.exe
2568	RuntimeBroker.exe
1736	RuntimeBroker.exe
4832	RuntimeBroker.exe
1856	RuntimeBroker.exe
1144	RuntimeBroker.exe
3140	RuntimeBroker.exe
4256	RuntimeBroker.exe
2184	RuntimeBroker.exe
1932	RuntimeBroker.exe
3676	RuntimeBroker.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2212	schtasks.exe
4684	schtasks.exe
4880	schtasks.exe
1656	schtasks.exe
3984	schtasks.exe
3768	schtasks.exe
4836	schtasks.exe
5004	schtasks.exe
3312	schtasks.exe
3436	schtasks.exe
4188	schtasks.exe
3348	schtasks.exe
432	schtasks.exe
856	schtasks.exe
2372	schtasks.exe
3700	schtasks.exe
1732	schtasks.exe
928	schtasks.exe
2960	schtasks.exe
5016	schtasks.exe
2080	schtasks.exe
1512	schtasks.exe
2716	schtasks.exe
3752	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
5084	DllCommonsvc.exe
5084	DllCommonsvc.exe
5084	DllCommonsvc.exe
5084	DllCommonsvc.exe
5084	DllCommonsvc.exe
872	powershell.exe
872	powershell.exe
4060	powershell.exe
4060	powershell.exe
3868	powershell.exe
3868	powershell.exe
2016	powershell.exe
2016	powershell.exe
2236	powershell.exe
2236	powershell.exe
2244	powershell.exe
2244	powershell.exe
3664	powershell.exe
3664	powershell.exe
2240	powershell.exe
2240	powershell.exe
1668	powershell.exe
1668	powershell.exe
2568	RuntimeBroker.exe
2568	RuntimeBroker.exe
1668	powershell.exe
872	powershell.exe
4060	powershell.exe
3868	powershell.exe
2236	powershell.exe
2016	powershell.exe
2244	powershell.exe
3664	powershell.exe
2240	powershell.exe
1736	RuntimeBroker.exe
4832	RuntimeBroker.exe
1856	RuntimeBroker.exe
1144	RuntimeBroker.exe
3140	RuntimeBroker.exe
4256	RuntimeBroker.exe
2184	RuntimeBroker.exe
1932	RuntimeBroker.exe
3676	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	DllCommonsvc.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	2568	RuntimeBroker.exe
Token: SeDebugPrivilege	1736	RuntimeBroker.exe
Token: SeDebugPrivilege	4832	RuntimeBroker.exe
Token: SeDebugPrivilege	1856	RuntimeBroker.exe
Token: SeDebugPrivilege	1144	RuntimeBroker.exe
Token: SeDebugPrivilege	3140	RuntimeBroker.exe
Token: SeDebugPrivilege	4256	RuntimeBroker.exe
Token: SeDebugPrivilege	2184	RuntimeBroker.exe
Token: SeDebugPrivilege	1932	RuntimeBroker.exe
Token: SeDebugPrivilege	3676	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 308	4252	c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129.exe	82
PID 4252 wrote to memory of 308	4252	c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129.exe	82
PID 4252 wrote to memory of 308	4252	c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129.exe	82
PID 308 wrote to memory of 912	308	WScript.exe	86
PID 308 wrote to memory of 912	308	WScript.exe	86
PID 308 wrote to memory of 912	308	WScript.exe	86
PID 912 wrote to memory of 5084	912	cmd.exe	88
PID 912 wrote to memory of 5084	912	cmd.exe	88
PID 5084 wrote to memory of 872	5084	DllCommonsvc.exe	114
PID 5084 wrote to memory of 872	5084	DllCommonsvc.exe	114
PID 5084 wrote to memory of 3868	5084	DllCommonsvc.exe	115
PID 5084 wrote to memory of 3868	5084	DllCommonsvc.exe	115
PID 5084 wrote to memory of 4060	5084	DllCommonsvc.exe	117
PID 5084 wrote to memory of 4060	5084	DllCommonsvc.exe	117
PID 5084 wrote to memory of 2236	5084	DllCommonsvc.exe	119
PID 5084 wrote to memory of 2236	5084	DllCommonsvc.exe	119
PID 5084 wrote to memory of 3664	5084	DllCommonsvc.exe	120
PID 5084 wrote to memory of 3664	5084	DllCommonsvc.exe	120
PID 5084 wrote to memory of 2016	5084	DllCommonsvc.exe	122
PID 5084 wrote to memory of 2016	5084	DllCommonsvc.exe	122
PID 5084 wrote to memory of 2244	5084	DllCommonsvc.exe	125
PID 5084 wrote to memory of 2244	5084	DllCommonsvc.exe	125
PID 5084 wrote to memory of 2240	5084	DllCommonsvc.exe	126
PID 5084 wrote to memory of 2240	5084	DllCommonsvc.exe	126
PID 5084 wrote to memory of 1668	5084	DllCommonsvc.exe	127
PID 5084 wrote to memory of 1668	5084	DllCommonsvc.exe	127
PID 5084 wrote to memory of 2568	5084	DllCommonsvc.exe	132
PID 5084 wrote to memory of 2568	5084	DllCommonsvc.exe	132
PID 2568 wrote to memory of 1656	2568	RuntimeBroker.exe	135
PID 2568 wrote to memory of 1656	2568	RuntimeBroker.exe	135
PID 1656 wrote to memory of 4776	1656	cmd.exe	137
PID 1656 wrote to memory of 4776	1656	cmd.exe	137
PID 1656 wrote to memory of 1736	1656	cmd.exe	139
PID 1656 wrote to memory of 1736	1656	cmd.exe	139
PID 1736 wrote to memory of 4448	1736	RuntimeBroker.exe	140
PID 1736 wrote to memory of 4448	1736	RuntimeBroker.exe	140
PID 4448 wrote to memory of 4680	4448	cmd.exe	142
PID 4448 wrote to memory of 4680	4448	cmd.exe	142
PID 4448 wrote to memory of 4832	4448	cmd.exe	143
PID 4448 wrote to memory of 4832	4448	cmd.exe	143
PID 4832 wrote to memory of 2004	4832	RuntimeBroker.exe	144
PID 4832 wrote to memory of 2004	4832	RuntimeBroker.exe	144
PID 2004 wrote to memory of 4192	2004	cmd.exe	146
PID 2004 wrote to memory of 4192	2004	cmd.exe	146
PID 2004 wrote to memory of 1856	2004	cmd.exe	147
PID 2004 wrote to memory of 1856	2004	cmd.exe	147
PID 1856 wrote to memory of 3660	1856	RuntimeBroker.exe	148
PID 1856 wrote to memory of 3660	1856	RuntimeBroker.exe	148
PID 3660 wrote to memory of 2836	3660	cmd.exe	150
PID 3660 wrote to memory of 2836	3660	cmd.exe	150
PID 3660 wrote to memory of 1144	3660	cmd.exe	151
PID 3660 wrote to memory of 1144	3660	cmd.exe	151
PID 1144 wrote to memory of 4572	1144	RuntimeBroker.exe	152
PID 1144 wrote to memory of 4572	1144	RuntimeBroker.exe	152
PID 4572 wrote to memory of 4924	4572	cmd.exe	154
PID 4572 wrote to memory of 4924	4572	cmd.exe	154
PID 4572 wrote to memory of 3140	4572	cmd.exe	155
PID 4572 wrote to memory of 3140	4572	cmd.exe	155
PID 3140 wrote to memory of 4804	3140	RuntimeBroker.exe	156
PID 3140 wrote to memory of 4804	3140	RuntimeBroker.exe	156
PID 4804 wrote to memory of 1704	4804	cmd.exe	158
PID 4804 wrote to memory of 1704	4804	cmd.exe	158
PID 4804 wrote to memory of 4256	4804	cmd.exe	159
PID 4804 wrote to memory of 4256	4804	cmd.exe	159

C:\Users\Admin\AppData\Local\Temp\c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129.exe
"C:\Users\Admin\AppData\Local\Temp\c1fc41bcadee30fdfc52b2c44aadde6cdee41e437a834886f0dbfd3950dde129.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\upfc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
    - - C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2568
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pI0EcicZAo.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4776
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ddqzBJK7Zu.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4680
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pkopelt31u.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4192
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tA3KztjMoN.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2836
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HmDgHlPzdV.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4924
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\826UXRAQMN.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1704
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat"
        18⤵
        
        PID:404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4536
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2zXOrWkEHk.bat"
        20⤵
        
        PID:4980
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2080
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat"
        22⤵
        
        PID:5084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1152
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        23⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UTkrWZWekQ.bat"
        24⤵
        
        PID:1736
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\odt\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\odt\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\odt\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Music\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Music\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Music\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2zXOrWkEHk.bat

Filesize
204B

MD5
56d38854eced5e841520ee8ab3782f1d

SHA1
45f6399cf87ec12609d9eccf9915206318c29e33

SHA256
f6e5f62777ce3ab9ad7a9c4482ef5cfa5b17217b90488f1992887a60d10f386d

SHA512
4059b57fee25fff3da11e70caebfd9c9f56de1a16eef83aa19ce37a9a289e0ffc42ea11ef0e2b4a0a4328b4d7e94398d467dcba75d376d0ca5626c5f3b302d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\826UXRAQMN.bat

Filesize
204B

MD5
2ddcd6034c4d045f618032cac0ffc541

SHA1
af060e579dabd3e350d0845ed353c46131e69ad9

SHA256
609a60ed0be2bc123bb799fd3b529cfa533acb424c864dfdd283c07267551a25

SHA512
f36ff40eeb4ab24cf2789ab61b271397cbcb1f98a761b8849722c946e9a0862e6e2d0949fb14a79f8c5a6bf0171ed6ec9f65757c6990035eb0f07a1264f1d3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\HmDgHlPzdV.bat

Filesize
204B

MD5
eb0af6839b9d133530d9ebfdf3d2e59c

SHA1
642ee8cd8e9a0d2196918b4e88f3450eba13e7fd

SHA256
8c97f620782b7ece2710b34795a54c6b14128adbca1cc1d7be2b331e4bf14338

SHA512
9378db12abf9d701c1769aa7fbc8c8ed06350246f76ae4e9e375628d7406aeee8f2701b8813fa1ef95a6fa7dd66dbab5580210bf3c82ef4e479498e6f5e31bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pkopelt31u.bat

Filesize
204B

MD5
01c3cab7338eb61e5d4ef9a86c00e8ef

SHA1
6a56be1dab7878df45f08a864f55e33daeffdd77

SHA256
07ad5d47a99c628114c4f598a6eedf480b6d9707189e8538f12a14098b731a18

SHA512
b000a7bd1936cc78605faf30483292f2521852b02dafa24663714c7730d2342805a083999e68b9e5cdce9098fb7510b7d9585df371df8a5beafd369344fd4284

Download Submit
C:\Users\Admin\AppData\Local\Temp\UTkrWZWekQ.bat

Filesize
204B

MD5
76c71ddb8eb4d7b3c32d9fb03c29000d

SHA1
4860bbebd268059ef687a62cadc1319c7a1ab314

SHA256
72edca15908d9610f269ce58e70c11d861cfee97295efc2858f4b4544f42935a

SHA512
d3a590f1d4ce2e6d79b75b1be11154c87f22a2a23d71e3e3208d00c48b503c391ba9cff53bf42c5c4e4764c7775d77be0ef94a77b3c78b6439ff521478093e55

Download Submit
C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat

Filesize
204B

MD5
7e9f770250fda1d5dc71b9e7666c51fe

SHA1
82345fe2746bd0b0eacaf0d16b634ed624b79bdf

SHA256
a0c3d1881fcdf1c27e8e01fb0022a8de7c7da20c9c52a921025768b4defafb8c

SHA512
9c8fb6e1dbff3cbfe838e288c25b340902ece4709f30f18d37dda1cec08c89e53c3b7256003ceb07c2eb569c97aebd55bbefa67a6d5ce9708bc1e3f96d12ddff

Download Submit
C:\Users\Admin\AppData\Local\Temp\ddqzBJK7Zu.bat

Filesize
204B

MD5
ca773f3edfc13db60ee11c8479861907

SHA1
0c44b5cedea8d48fa0d976f08b64e846c7c14ffc

SHA256
b45abb1f174085b21e7382cde4d0d908d375b96036ebf6d552cbcbbbbee9fab9

SHA512
905287349f1c8e0c49ce03d3063f23b86cbe215df0fb5ccd784a84839dc9eaa3266ca5d73a95fc0659037f94fa905230f80028d402415f3b0092294e90565e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pI0EcicZAo.bat

Filesize
204B

MD5
08601c0477595bea7ed657d8b5418128

SHA1
2e8c38e239ac7424cfdba0ac0cf4ab38501dc6da

SHA256
446338d821a698f3eb04c4af397f7ca6728d1ebc25dda3bc1c1922547b13fabb

SHA512
61612cad1fea819f5a13d6c31d9c8829c8733c63d8094ca621e8d99855904dd1f9a6d5e4e0f1e29714e8960c24f7f2ed37f2c8c4b80d848952c66678731ee75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tA3KztjMoN.bat

Filesize
204B

MD5
4d1b859557959dd3a719f327628084e5

SHA1
d005aaa232b0d06aa7f7459ed6447e78d045502c

SHA256
ab8aa3d404a154f1f61e9ecbad94d1878bad0c32935c6f55227cf44c61c8ac67

SHA512
5bca0bad62b61aa6211545c6c6b77d5207618256cd6b7389ecfcd24da2de7a097fd59dd476cd7edba5b53131df44531f759bdd68ea8efa6c2aa8d8548146f462

Download Submit
C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat

Filesize
204B

MD5
86117a2242b0cd4eae3473ac041e6696

SHA1
065a348ae9e257a7cbe0163bfc52917dae8c4936

SHA256
fc02cd7b306d37f01a59e2da6062d4fd00d424c4c172e965491bc89eba179ecf

SHA512
1c052dcf386ebfefff09d45de095c021a6f19783c0224ed9757967542b0ab847d5abcfe45ed10a9967ee47d912926930b80e150616f577b571e958ffce5804e5

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/872-167-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/872-150-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/872-152-0x000001B7FD660000-0x000001B7FD682000-memory.dmp

Filesize
136KB

Download
memory/1144-215-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/1144-211-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/1668-168-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/1668-164-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/1736-190-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/1736-194-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/1856-204-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/1856-208-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/1932-243-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/1932-239-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2016-177-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2016-158-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2184-236-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2184-232-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2236-170-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2236-159-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2240-181-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2240-160-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2244-161-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2244-182-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2568-162-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/2568-184-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/3140-218-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/3140-222-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/3664-179-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/3664-163-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/3676-250-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/3676-246-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/3868-155-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/3868-174-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/4060-157-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/4060-175-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/4256-225-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/4256-229-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/4832-197-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/4832-201-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-156-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-140-0x00007FF8F8820000-0x00007FF8F92E1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-139-0x0000000000A40000-0x0000000000B50000-memory.dmp

Filesize
1.1MB

Download