dcrat | c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe
Size

1.3MB
MD5

b8c412d799e0ba5dbd0eba2db4866d13
SHA1

b1b526412090b7c01cdfc53df3e5c846e6ba0b62
SHA256

c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e
SHA512

fe3bfb648824d9e698d1f7c7c6967236f3884a9dea1020f742d3ba99f9102ae3b6f6d136ca17d6e824ebbb903ceae8a70123616aade6416147afc6bfacd48e28
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	356	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	3944	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	3944	schtasks.exe	17

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000200000001e2c7-138.dat	dcrat
behavioral1/files/0x000200000001e2c7-139.dat	dcrat
behavioral1/memory/2080-140-0x0000000000B50000-0x0000000000C60000-memory.dmp	dcrat
behavioral1/files/0x0006000000022e5d-153.dat	dcrat
behavioral1/files/0x0006000000022e5d-152.dat	dcrat
behavioral1/files/0x0006000000022e5d-188.dat	dcrat
behavioral1/files/0x0006000000022e5d-196.dat	dcrat
behavioral1/files/0x0006000000022e5d-203.dat	dcrat
behavioral1/files/0x0006000000022e5d-210.dat	dcrat
behavioral1/files/0x0006000000022e5d-217.dat	dcrat
behavioral1/files/0x0006000000022e5d-224.dat	dcrat
behavioral1/files/0x0006000000022e5d-231.dat	dcrat
behavioral1/files/0x0006000000022e5d-238.dat	dcrat
behavioral1/files/0x0006000000022e5d-245.dat	dcrat
behavioral1/files/0x0006000000022e5d-253.dat	dcrat

Executes dropped EXE 12 IoCs

pid	Process
2080	DllCommonsvc.exe
2216	WaaSMedicAgent.exe
4184	WaaSMedicAgent.exe
4744	WaaSMedicAgent.exe
1636	WaaSMedicAgent.exe
3760	WaaSMedicAgent.exe
2600	WaaSMedicAgent.exe
2740	WaaSMedicAgent.exe
2192	WaaSMedicAgent.exe
848	WaaSMedicAgent.exe
4388	WaaSMedicAgent.exe
1776	WaaSMedicAgent.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sru\explorer.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\SysWOW64\sru\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\SysWOW64\sru\7a0fd90576e088	DllCommonsvc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\5940a34987c991	DllCommonsvc.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\addins\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\Containers\serviced\WaaSMedicAgent.exe	DllCommonsvc.exe
File created	C:\Windows\Containers\serviced\c82b8037eab33d	DllCommonsvc.exe
File created	C:\Windows\ShellExperiences\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\ShellExperiences\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\AppReadiness\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\AppReadiness\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Windows\addins\conhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4308	schtasks.exe
5064	schtasks.exe
4468	schtasks.exe
4880	schtasks.exe
356	schtasks.exe
1092	schtasks.exe
2772	schtasks.exe
3792	schtasks.exe
772	schtasks.exe
4944	schtasks.exe
3804	schtasks.exe
1416	schtasks.exe
2900	schtasks.exe
4284	schtasks.exe
3716	schtasks.exe
2828	schtasks.exe
4280	schtasks.exe
4848	schtasks.exe
3276	schtasks.exe
5100	schtasks.exe
1272	schtasks.exe
1292	schtasks.exe
3588	schtasks.exe
1332	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
2080	DllCommonsvc.exe
1936	powershell.exe
1936	powershell.exe
2504	powershell.exe
2504	powershell.exe
2176	powershell.exe
2176	powershell.exe
4612	powershell.exe
4612	powershell.exe
1340	powershell.exe
1340	powershell.exe
1516	powershell.exe
1516	powershell.exe
4680	powershell.exe
4680	powershell.exe
4500	powershell.exe
4500	powershell.exe
5044	powershell.exe
5044	powershell.exe
2216	WaaSMedicAgent.exe
2216	WaaSMedicAgent.exe
1936	powershell.exe
2504	powershell.exe
4612	powershell.exe
2176	powershell.exe
1516	powershell.exe
1340	powershell.exe
4680	powershell.exe
4500	powershell.exe
5044	powershell.exe
4184	WaaSMedicAgent.exe
4744	WaaSMedicAgent.exe
1636	WaaSMedicAgent.exe
3760	WaaSMedicAgent.exe
2600	WaaSMedicAgent.exe
2740	WaaSMedicAgent.exe
2192	WaaSMedicAgent.exe
848	WaaSMedicAgent.exe
4388	WaaSMedicAgent.exe
1776	WaaSMedicAgent.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	DllCommonsvc.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	2216	WaaSMedicAgent.exe
Token: SeDebugPrivilege	4184	WaaSMedicAgent.exe
Token: SeDebugPrivilege	4744	WaaSMedicAgent.exe
Token: SeDebugPrivilege	1636	WaaSMedicAgent.exe
Token: SeDebugPrivilege	3760	WaaSMedicAgent.exe
Token: SeDebugPrivilege	2600	WaaSMedicAgent.exe
Token: SeDebugPrivilege	2740	WaaSMedicAgent.exe
Token: SeDebugPrivilege	2192	WaaSMedicAgent.exe
Token: SeDebugPrivilege	848	WaaSMedicAgent.exe
Token: SeDebugPrivilege	4388	WaaSMedicAgent.exe
Token: SeDebugPrivilege	1776	WaaSMedicAgent.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3744	2268	c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe	80
PID 2268 wrote to memory of 3744	2268	c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe	80
PID 2268 wrote to memory of 3744	2268	c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe	80
PID 3744 wrote to memory of 4888	3744	WScript.exe	84
PID 3744 wrote to memory of 4888	3744	WScript.exe	84
PID 3744 wrote to memory of 4888	3744	WScript.exe	84
PID 4888 wrote to memory of 2080	4888	cmd.exe	86
PID 4888 wrote to memory of 2080	4888	cmd.exe	86
PID 2080 wrote to memory of 1516	2080	DllCommonsvc.exe	112
PID 2080 wrote to memory of 1516	2080	DllCommonsvc.exe	112
PID 2080 wrote to memory of 1936	2080	DllCommonsvc.exe	113
PID 2080 wrote to memory of 1936	2080	DllCommonsvc.exe	113
PID 2080 wrote to memory of 2176	2080	DllCommonsvc.exe	114
PID 2080 wrote to memory of 2176	2080	DllCommonsvc.exe	114
PID 2080 wrote to memory of 2504	2080	DllCommonsvc.exe	116
PID 2080 wrote to memory of 2504	2080	DllCommonsvc.exe	116
PID 2080 wrote to memory of 4612	2080	DllCommonsvc.exe	119
PID 2080 wrote to memory of 4612	2080	DllCommonsvc.exe	119
PID 2080 wrote to memory of 4680	2080	DllCommonsvc.exe	121
PID 2080 wrote to memory of 4680	2080	DllCommonsvc.exe	121
PID 2080 wrote to memory of 1340	2080	DllCommonsvc.exe	122
PID 2080 wrote to memory of 1340	2080	DllCommonsvc.exe	122
PID 2080 wrote to memory of 4500	2080	DllCommonsvc.exe	127
PID 2080 wrote to memory of 4500	2080	DllCommonsvc.exe	127
PID 2080 wrote to memory of 5044	2080	DllCommonsvc.exe	123
PID 2080 wrote to memory of 5044	2080	DllCommonsvc.exe	123
PID 2080 wrote to memory of 2216	2080	DllCommonsvc.exe	130
PID 2080 wrote to memory of 2216	2080	DllCommonsvc.exe	130
PID 2216 wrote to memory of 1272	2216	WaaSMedicAgent.exe	135
PID 2216 wrote to memory of 1272	2216	WaaSMedicAgent.exe	135
PID 1272 wrote to memory of 2432	1272	cmd.exe	134
PID 1272 wrote to memory of 2432	1272	cmd.exe	134
PID 1272 wrote to memory of 4184	1272	cmd.exe	137
PID 1272 wrote to memory of 4184	1272	cmd.exe	137
PID 4184 wrote to memory of 3656	4184	WaaSMedicAgent.exe	138
PID 4184 wrote to memory of 3656	4184	WaaSMedicAgent.exe	138
PID 3656 wrote to memory of 640	3656	cmd.exe	140
PID 3656 wrote to memory of 640	3656	cmd.exe	140
PID 3656 wrote to memory of 4744	3656	cmd.exe	141
PID 3656 wrote to memory of 4744	3656	cmd.exe	141
PID 4744 wrote to memory of 396	4744	WaaSMedicAgent.exe	142
PID 4744 wrote to memory of 396	4744	WaaSMedicAgent.exe	142
PID 396 wrote to memory of 1064	396	cmd.exe	144
PID 396 wrote to memory of 1064	396	cmd.exe	144
PID 396 wrote to memory of 1636	396	cmd.exe	145
PID 396 wrote to memory of 1636	396	cmd.exe	145
PID 1636 wrote to memory of 1128	1636	WaaSMedicAgent.exe	146
PID 1636 wrote to memory of 1128	1636	WaaSMedicAgent.exe	146
PID 1128 wrote to memory of 744	1128	cmd.exe	148
PID 1128 wrote to memory of 744	1128	cmd.exe	148
PID 1128 wrote to memory of 3760	1128	cmd.exe	149
PID 1128 wrote to memory of 3760	1128	cmd.exe	149
PID 3760 wrote to memory of 1444	3760	WaaSMedicAgent.exe	150
PID 3760 wrote to memory of 1444	3760	WaaSMedicAgent.exe	150
PID 1444 wrote to memory of 4660	1444	cmd.exe	152
PID 1444 wrote to memory of 4660	1444	cmd.exe	152
PID 1444 wrote to memory of 2600	1444	cmd.exe	153
PID 1444 wrote to memory of 2600	1444	cmd.exe	153
PID 2600 wrote to memory of 1456	2600	WaaSMedicAgent.exe	154
PID 2600 wrote to memory of 1456	2600	WaaSMedicAgent.exe	154
PID 1456 wrote to memory of 4680	1456	cmd.exe	156
PID 1456 wrote to memory of 4680	1456	cmd.exe	156
PID 1456 wrote to memory of 2740	1456	cmd.exe	157
PID 1456 wrote to memory of 2740	1456	cmd.exe	157

C:\Users\Admin\AppData\Local\Temp\c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe
"C:\Users\Admin\AppData\Local\Temp\c2951f3235965e1e63051cad63ab3334b6203d5d140530592f54a791b12d2e4e.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\sru\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppReadiness\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\WaaSMedicAgent.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4500
    - - C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2216
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5irhJyFUC1.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hGpPWS23Hw.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:640
        
        C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hGpPWS23Hw.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1064
        
        C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:744
        
        C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4660
        
        C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4680
        
        C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1kSioVLOLD.bat"
        18⤵
        
        PID:1956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3744
        
        C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DhSpfyjZaR.bat"
        20⤵
        
        PID:4564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4336
        
        C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat"
        22⤵
        
        PID:1972
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:3128
        
        C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        23⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat"
        24⤵
        
        PID:4280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2000
        
        C:\Windows\Containers\serviced\WaaSMedicAgent.exe
        
        "C:\Windows\Containers\serviced\WaaSMedicAgent.exe"
        25⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat"
        26⤵
        
        PID:3712
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\SysWOW64\sru\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\SysWOW64\sru\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\SysWOW64\sru\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\ShellExperiences\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellExperiences\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\AppReadiness\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1272
- C:\Windows\system32\w32tm.exe
  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
  2⤵
  PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\AppReadiness\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\AppReadiness\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\addins\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\Windows\Containers\serviced\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WaaSMedicAgent.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\1kSioVLOLD.bat

Filesize
214B

MD5
de483b14346ae5f77726803114e4a2b4

SHA1
bb57bb08bba8a4a9e6f85ce09679192a306269ba

SHA256
daa957b16c7b5e6ace0d8dc47077ab59112c50d62292bbdfbf4b32b5f695665d

SHA512
0c73cc5da1bef4ca3dc7deeaaab5b95fc5fd44488ce3ae2835861ae9aa7655b1c0ae0a44627935af145c7e61d9836c672cd2be5a67044fba320ecc034a27a61e

Download Submit
C:\Users\Admin\AppData\Local\Temp\5irhJyFUC1.bat

Filesize
214B

MD5
1bc6cc28da6a1c6195460ea8e2f85cf5

SHA1
17c413d27b395d2a141f05c065240fe15d831c44

SHA256
d63247609a68a39b9ea9f08c7d98c737cbe425b0f9b7d86a2a78e4acbf649bf1

SHA512
310b23f7cc4b60855ec3580d43b37f2f4951c15485021a0fd21dbbbb6057caa752fa7089f8702adcb06a74a22bdd0305396e7b9b9cb1a20986fa7bf7f369b2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat

Filesize
214B

MD5
c552bcffe85a8ae6d3131e21104bf749

SHA1
fb929a635c1853f696b93d3aa3ad0ccf4036d69f

SHA256
16ee4500ae0cbc0333d29ff63b5bdcf608b928e47a5b5242705eba29e971c73d

SHA512
b3d451bb6acfc221d005daa195eb2555895d4c3e03af2898d9da2af8630a88bf7df15575266b5f3dd0a71d0eb04cfdf4a69c6e4262bc7af5d8ea93cfc449b16a

Download Submit
C:\Users\Admin\AppData\Local\Temp\DhSpfyjZaR.bat

Filesize
214B

MD5
eb2b78533bf255c12fe77cc803358c7a

SHA1
573401d3c48724ffb32776304b6af581e0607afb

SHA256
8abcce3f48fdec8a517c284a8c5f5aabb6fd0f784ecb39e8fe0bcf34c605bfd6

SHA512
7748586914bdecdaf8f449d12ff29542ff9b63482d20752a54ba01f0104f8cc3e611afc79359e15d0f67d4dde7a06c342972fd12fb525f02d251b26e6e787fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat

Filesize
214B

MD5
aca3c1aef5e6cd043b9be6dacda5e60e

SHA1
b168d4589ac20404e581a347de46c5506eb27289

SHA256
854034fb028109fb6641a09e09c397ca127cbdf8158b1e840504f8d8b8b123bd

SHA512
980deef553e3e1e3246b353862a568d9184afc31f553ea69ad9085f2a8c6322e943447b6cbb1d9871a84a8133dd98151c78f7ed61eaa0837d6c8f0694a52a9df

Download Submit
C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat

Filesize
214B

MD5
bf7c09e8f409ba2e56b89f4bc62f08e5

SHA1
f03aca14b840949c0299e0e5630f8bf0ad0d0e12

SHA256
ee917e73bf035673b267280e0c724ea4fa55ed17ad68cae3a0b361cf6f9d9b56

SHA512
2594a0b3c3315fe53b29ae99abddbbc78a78dc340f462ef53676adc2c9029bcff9a232055ad2f3407856ba36d72bcdf036cfd4ff34e5514c39c06922b37234e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hGpPWS23Hw.bat

Filesize
214B

MD5
460d0a3d86aab7c066467037dd4de409

SHA1
12ea7758a9f978d70a4e3e45e1f48d33d5eadb08

SHA256
380c4bf8070b14139b0fec576baf3a4701255a650203359f2967511120d1beb5

SHA512
96df441cac8233f2d94bad42f67ca269e2be5e2490350dc0e15b0c09937f303a86b31d2e705b8833a78df62c8a6eb284d2a87b9eeab0225343e6cade03c702ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\hGpPWS23Hw.bat

Filesize
214B

MD5
460d0a3d86aab7c066467037dd4de409

SHA1
12ea7758a9f978d70a4e3e45e1f48d33d5eadb08

SHA256
380c4bf8070b14139b0fec576baf3a4701255a650203359f2967511120d1beb5

SHA512
96df441cac8233f2d94bad42f67ca269e2be5e2490350dc0e15b0c09937f303a86b31d2e705b8833a78df62c8a6eb284d2a87b9eeab0225343e6cade03c702ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat

Filesize
214B

MD5
7a6ff3f2a3c96ab4c80fc98903e59b51

SHA1
ad7a20e541f8ce3bf231e8cd3eea9e319b3a6283

SHA256
fcc44326b2222887210f364c50e6aa656e7d9fdc7da1dcd496edf1d1db149ffb

SHA512
efd50a6a2dcd6ac03cc9102ee9f9ed66044f45fbca1eedd5ace379821d3c45619101fda684d487551162bfd1c951b6fb5b03a9c68dc708d2924bc817f466d9a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat

Filesize
214B

MD5
31aa2b8b1d93eb975078befea3affbca

SHA1
7f348cf8f6ed9973157cb7064cea4be51eb2c44e

SHA256
e60b6b2595d23ff6d7d26e86c5134aef75c3ddf44b74d382e5a498ef8b88f8ae

SHA512
067f3d303762d49bcd62034ff82279857cd3f817c899266a56e411f29a39886e3efb83916cdfdab26790be3054f204af83a5c2cdca40709d35888451b82c0e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat

Filesize
214B

MD5
31aa2b8b1d93eb975078befea3affbca

SHA1
7f348cf8f6ed9973157cb7064cea4be51eb2c44e

SHA256
e60b6b2595d23ff6d7d26e86c5134aef75c3ddf44b74d382e5a498ef8b88f8ae

SHA512
067f3d303762d49bcd62034ff82279857cd3f817c899266a56e411f29a39886e3efb83916cdfdab26790be3054f204af83a5c2cdca40709d35888451b82c0e77

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/848-243-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/848-239-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/1340-180-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/1340-161-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/1516-162-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/1516-176-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/1636-208-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/1636-204-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/1776-254-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/1776-258-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/1936-155-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/1936-174-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2080-156-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2080-140-0x0000000000B50000-0x0000000000C60000-memory.dmp

Filesize
1.1MB

Download
memory/2080-141-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2176-175-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2176-157-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2192-232-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2192-236-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2216-165-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2216-186-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2504-154-0x00000186FD850000-0x00000186FD872000-memory.dmp

Filesize
136KB

Download
memory/2504-158-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2504-168-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2600-222-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2600-218-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2740-225-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/2740-229-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/3760-211-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/3760-215-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4184-194-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4184-190-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4388-251-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4388-247-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4388-246-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4500-163-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4500-178-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4612-159-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4612-171-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4680-177-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4680-160-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4744-197-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/4744-201-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/5044-182-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download
memory/5044-164-0x00007FFBFE530000-0x00007FFBFEFF1000-memory.dmp

Filesize
10.8MB

Download