dcrat | 810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exe
Size

1.3MB
MD5

ce70a016a30891490587d97be8a44aa6
SHA1

d42141330f643689906aaaf4bc16382de4168877
SHA256

810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570
SHA512

2eb425928e9b4c95d61f53d9c44c9262d24a176a456b94160fa2d1c275c1ea7ec7c50d3668767f560e99be77c9555136be8c05f68acdf617e46602bf5e502353
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	668	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	668	schtasks.exe

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral1/memory/1524-139-0x00000000003E0000-0x00000000004F0000-memory.dmp	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat
C:\Windows\appcompat\Programs\dllhost.exe	dcrat

Executes dropped EXE 12 IoCs

Processes:

DllCommonsvc.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe

pid	process
1524	DllCommonsvc.exe
4360	dllhost.exe
452	dllhost.exe
4428	dllhost.exe
3596	dllhost.exe
452	dllhost.exe
5072	dllhost.exe
1776	dllhost.exe
4588	dllhost.exe
3668	dllhost.exe
4328	dllhost.exe
4908	dllhost.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exeDllCommonsvc.exedllhost.exedllhost.exedllhost.exedllhost.exe810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 3 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\spoolsv.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Schema\spoolsv.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\appcompat\Programs\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\appcompat\Programs\5940a34987c991	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4744	schtasks.exe
3324	schtasks.exe
1316	schtasks.exe
3632	schtasks.exe
116	schtasks.exe
3780	schtasks.exe
1828	schtasks.exe
4612	schtasks.exe
3188	schtasks.exe
4084	schtasks.exe
4944	schtasks.exe
3124	schtasks.exe
2500	schtasks.exe
112	schtasks.exe
3488	schtasks.exe
3808	schtasks.exe
764	schtasks.exe
4512	schtasks.exe
5100	schtasks.exe
1232	schtasks.exe
4652	schtasks.exe

Modifies registry class 12 IoCs

Processes:

dllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	dllhost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exe

pid	process
1524	DllCommonsvc.exe
1524	DllCommonsvc.exe
1524	DllCommonsvc.exe
5104	powershell.exe
5104	powershell.exe
2692	powershell.exe
1300	powershell.exe
2692	powershell.exe
1300	powershell.exe
2688	powershell.exe
2688	powershell.exe
2140	powershell.exe
2140	powershell.exe
2884	powershell.exe
2884	powershell.exe
3524	powershell.exe
3524	powershell.exe
4416	powershell.exe
4416	powershell.exe
2688	powershell.exe
4360	dllhost.exe
4360	dllhost.exe
5104	powershell.exe
2692	powershell.exe
1300	powershell.exe
2140	powershell.exe
2884	powershell.exe
3524	powershell.exe
4416	powershell.exe
452	dllhost.exe
4428	dllhost.exe
3596	dllhost.exe
452	dllhost.exe
5072	dllhost.exe
1776	dllhost.exe
4588	dllhost.exe
3668	dllhost.exe
4328	dllhost.exe
4908	dllhost.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	1524	DllCommonsvc.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	4360	dllhost.exe
Token: SeDebugPrivilege	452	dllhost.exe
Token: SeDebugPrivilege	4428	dllhost.exe
Token: SeDebugPrivilege	3596	dllhost.exe
Token: SeDebugPrivilege	452	dllhost.exe
Token: SeDebugPrivilege	5072	dllhost.exe
Token: SeDebugPrivilege	1776	dllhost.exe
Token: SeDebugPrivilege	4588	dllhost.exe
Token: SeDebugPrivilege	3668	dllhost.exe
Token: SeDebugPrivilege	4328	dllhost.exe
Token: SeDebugPrivilege	4908	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exeWScript.execmd.exeDllCommonsvc.exedllhost.execmd.exedllhost.execmd.exedllhost.execmd.exedllhost.execmd.exedllhost.execmd.exedllhost.execmd.exedllhost.exe

description	pid	process	target process
PID 2276 wrote to memory of 2156	2276	810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exe	WScript.exe
PID 2276 wrote to memory of 2156	2276	810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exe	WScript.exe
PID 2276 wrote to memory of 2156	2276	810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exe	WScript.exe
PID 2156 wrote to memory of 4588	2156	WScript.exe	cmd.exe
PID 2156 wrote to memory of 4588	2156	WScript.exe	cmd.exe
PID 2156 wrote to memory of 4588	2156	WScript.exe	cmd.exe
PID 4588 wrote to memory of 1524	4588	cmd.exe	DllCommonsvc.exe
PID 4588 wrote to memory of 1524	4588	cmd.exe	DllCommonsvc.exe
PID 1524 wrote to memory of 5104	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 5104	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 2692	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 2692	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 1300	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 1300	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 2688	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 2688	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 2140	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 2140	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 2884	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 2884	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 3524	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 3524	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 4416	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 4416	1524	DllCommonsvc.exe	powershell.exe
PID 1524 wrote to memory of 4360	1524	DllCommonsvc.exe	dllhost.exe
PID 1524 wrote to memory of 4360	1524	DllCommonsvc.exe	dllhost.exe
PID 4360 wrote to memory of 4264	4360	dllhost.exe	cmd.exe
PID 4360 wrote to memory of 4264	4360	dllhost.exe	cmd.exe
PID 4264 wrote to memory of 3920	4264	cmd.exe	w32tm.exe
PID 4264 wrote to memory of 3920	4264	cmd.exe	w32tm.exe
PID 4264 wrote to memory of 452	4264	cmd.exe	dllhost.exe
PID 4264 wrote to memory of 452	4264	cmd.exe	dllhost.exe
PID 452 wrote to memory of 4724	452	dllhost.exe	cmd.exe
PID 452 wrote to memory of 4724	452	dllhost.exe	cmd.exe
PID 4724 wrote to memory of 1752	4724	cmd.exe	w32tm.exe
PID 4724 wrote to memory of 1752	4724	cmd.exe	w32tm.exe
PID 4724 wrote to memory of 4428	4724	cmd.exe	dllhost.exe
PID 4724 wrote to memory of 4428	4724	cmd.exe	dllhost.exe
PID 4428 wrote to memory of 4232	4428	dllhost.exe	cmd.exe
PID 4428 wrote to memory of 4232	4428	dllhost.exe	cmd.exe
PID 4232 wrote to memory of 1116	4232	cmd.exe	w32tm.exe
PID 4232 wrote to memory of 1116	4232	cmd.exe	w32tm.exe
PID 4232 wrote to memory of 3596	4232	cmd.exe	dllhost.exe
PID 4232 wrote to memory of 3596	4232	cmd.exe	dllhost.exe
PID 3596 wrote to memory of 4652	3596	dllhost.exe	cmd.exe
PID 3596 wrote to memory of 4652	3596	dllhost.exe	cmd.exe
PID 4652 wrote to memory of 2360	4652	cmd.exe	w32tm.exe
PID 4652 wrote to memory of 2360	4652	cmd.exe	w32tm.exe
PID 4652 wrote to memory of 452	4652	cmd.exe	dllhost.exe
PID 4652 wrote to memory of 452	4652	cmd.exe	dllhost.exe
PID 452 wrote to memory of 3680	452	dllhost.exe	cmd.exe
PID 452 wrote to memory of 3680	452	dllhost.exe	cmd.exe
PID 3680 wrote to memory of 900	3680	cmd.exe	w32tm.exe
PID 3680 wrote to memory of 900	3680	cmd.exe	w32tm.exe
PID 3680 wrote to memory of 5072	3680	cmd.exe	dllhost.exe
PID 3680 wrote to memory of 5072	3680	cmd.exe	dllhost.exe
PID 5072 wrote to memory of 3956	5072	dllhost.exe	cmd.exe
PID 5072 wrote to memory of 3956	5072	dllhost.exe	cmd.exe
PID 3956 wrote to memory of 2572	3956	cmd.exe	w32tm.exe
PID 3956 wrote to memory of 2572	3956	cmd.exe	w32tm.exe
PID 3956 wrote to memory of 1776	3956	cmd.exe	dllhost.exe
PID 3956 wrote to memory of 1776	3956	cmd.exe	dllhost.exe
PID 1776 wrote to memory of 2396	1776	dllhost.exe	cmd.exe
PID 1776 wrote to memory of 2396	1776	dllhost.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exe
"C:\Users\Admin\AppData\Local\Temp\810cbb8cead7e9671bb30e86cb051635aef08e7150850fd76c037b38df242570.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:4588

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Configuration\Schema\spoolsv.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\lsass.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\OfficeClickToRun.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\appcompat\Programs\dllhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rBMLF9HJtT.bat"
6⤵
- Suspicious use of WriteProcessMemory
PID:4264

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\w2PRcJO5W1.bat"
8⤵
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:1752

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
9⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YXbxSkVmu9.bat"
10⤵
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
11⤵
PID:1116

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
11⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xEvQv3iUx6.bat"
12⤵
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
13⤵
PID:2360

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
13⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat"
14⤵
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
15⤵
PID:900

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
15⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t6OOvELCCF.bat"
16⤵
- Suspicious use of WriteProcessMemory
PID:3956

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
17⤵
PID:2572

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
17⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NczlPfxoCy.bat"
18⤵
PID:2396

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
19⤵
PID:5068

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
19⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GrfoiSU1wP.bat"
20⤵
PID:4912

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
21⤵
PID:2152

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
21⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gPrDhQDX5J.bat"
22⤵
PID:3536

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
23⤵
PID:1112

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
23⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat"
24⤵
PID:112

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
25⤵
PID:220

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
25⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zcl4dB2r8y.bat"
26⤵
PID:1924

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
27⤵
PID:2128

C:\Windows\appcompat\Programs\dllhost.exe
"C:\Windows\appcompat\Programs\dllhost.exe"
27⤵
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\odt\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\appcompat\Programs\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\appcompat\Programs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\appcompat\Programs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1316

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:3920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\GrfoiSU1wP.bat
Filesize
206B

MD5
2c7adfd2fc2b586716920b012facfdc8

SHA1
5cfba072cf519309f4317e75c605972b13ce3ad8

SHA256
6e83730b7b3a447873fedd84332ef01975556542e91b7440d19841e69bfcee3a

SHA512
3e704dcc8896d70711d54d9770dc8016ac63c1a66ddbd7d8503cf911df3cfac550aa54f2fa821aac33d4dcdd1ed472d2952db998730dd60ca2e97d3efc8a0496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat
Filesize
206B

MD5
462d8b715ee715878008051d5110f976

SHA1
83d625d873fde78493376effd044863efd10414d

SHA256
90860b07a95c049ec144bc93d286cad0fdcdf837d9ca0bd9d407787ee6fbbac7

SHA512
5e76a531ec963ba64f24ddd626a36542ec73c6af1c7090529a283be7a31bddade86aff06f85b5fab393acf0e73eb69f609d2e5e50ceab993f61ea24a0f8b503c

Download Submit
C:\Users\Admin\AppData\Local\Temp\NczlPfxoCy.bat
Filesize
206B

MD5
7b4779f2758ee0d6bb02ac3f6068bc38

SHA1
a929c7e7ff07f7b6cc2d6c9be79ff113a77615d7

SHA256
12cf9368a1eb23c600d0d1ca26cda69e75d25c4ab7a117cf0b367decd4bedcbf

SHA512
bf06e8a05f839ba999fc7a17c341a0596ccfe2aec78b48d357a625e14db2a3a1a52396600d2a15f6ac47a3d685c4035d5749ef9e90e18e2454ec231796cfe557

Download Submit
C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat
Filesize
206B

MD5
e6a5a62cdaa4adc760bac25baa7e7d70

SHA1
e326168f4fd0e41aaba09e210d47efe59471c5f1

SHA256
8bd4f661088dcc1953a01f02fc29fb203da2dabcd19e8ecec38e2f04161f1d8b

SHA512
8110babf909d7d772e20f9212720da15cbbb2f32c98307b8c8b444d70b42626737fab8dacaf883396d27bc0549bfb541b80ab761873efeee49e621781e847d1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\YXbxSkVmu9.bat
Filesize
206B

MD5
50cb63b8f75c12a1bd998054eab7da6d

SHA1
b10e5d4e14628576ec78f95684d9618721e63bea

SHA256
c109357626a67107c821905e0058132542041e38f7951beafbadb784f380091e

SHA512
d5d1b5335b81299ff9d8305d7bfbeb31d33024c25f5add8241e733ebb95cf3c9e3db6b0b9bf260406908fb1181a4ada768efbada1d95e0f679834d801e0f36cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zcl4dB2r8y.bat
Filesize
206B

MD5
43524bb954b6fd1a5cf5629e3a53cbd1

SHA1
66ebc9ba3b8b2382627775e47f46aa187a7f0493

SHA256
235a7aa9b6599152fb4bb351e12333d8453aa2a061159257d63d6a012f97214c

SHA512
ff1170d632fcc5ee488d4e1a645c5468be64021dc8a7776d48fd7dda68401c0f6679eea8674b915b63d6107a29c9f3e65f5d0715d28e7efe14000d279464d2bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\gPrDhQDX5J.bat
Filesize
206B

MD5
e1e50cb55c7b2db34f63a6f052e00770

SHA1
c4ac35bc3c37610936a1c381c13f3a9d0658b876

SHA256
530b39569ff9342c5d9f3c14915d4c6886c1fb57137f47ae8b912feefbf45e2e

SHA512
cbb5c3571c12c6b56b692dbd0c2424ed1d8ba65906c75bbff8750e56ee2095328a8da9482fad821d000a2707766c2ee431e57f6babe2c5351a223caf8db73475

Download Submit
C:\Users\Admin\AppData\Local\Temp\rBMLF9HJtT.bat
Filesize
206B

MD5
79378b5c319a39e1860e9bd5877d89c2

SHA1
0c07055ac38cc38ded9848b3363503d09f97b508

SHA256
c22aef6a65accad4809a58f9ed2145d9f2b11e601a708a99f4c2c818aec6036a

SHA512
95a1507dd00b05ea3ea71075df7edb282fb037f5dd1a04e960d7326c6d6818054d9918a0eacfdfef0631e427d5de1a9d56ab830f96bd6e59a0b77026ad6a19a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\t6OOvELCCF.bat
Filesize
206B

MD5
fe07645085edde57d44c106d12bc90d0

SHA1
6fde7e92f579bf9f5819e4f01df9e436f6c0a047

SHA256
4fb59945b38e0a39635c92ff8dfa0985e48167eff99c25d4eae2530681a1ffb6

SHA512
1ad8424629ac7807f5594ee6c58982dfa74cab3e033eab76d1d60ad356903aab0a78b9ae065aa4b18e3d057ca90798874d8ca9d2b0421fef6370d044012b7d7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\w2PRcJO5W1.bat
Filesize
206B

MD5
baca8b6eb4b3037d7aea132450edff90

SHA1
c646b805bf5711b3d2a82d425816349c7ee73fed

SHA256
bdeea4cae8aa1a6979d101b3b4a87b02fa2e911d3d80db8443f629f5215f487b

SHA512
ea8d88b49758ded9b389481b0ef896c291cd746b7db534d7567c457c3f6809874c23d2128fe820e83624e753fec03656a8fe0db4e786209c6a5970f167ad7160

Download Submit
C:\Users\Admin\AppData\Local\Temp\xEvQv3iUx6.bat
Filesize
206B

MD5
8398ce0aa2841b0f03e1e6463000f4a4

SHA1
ba2306c076041767b328fbc70a41a61149fc2254

SHA256
45218120c622aca96683d4c7583e10ab998777f10e48f4a7cdcf27038f4fc3c0

SHA512
cc0e01d7525ab70ede4b34fd5f82e6644c7c43b169dee967890b31a5a32032a054aeafe67ef68e80979106e201400b33853176a361387c492fd50109f10b13dc

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\appcompat\Programs\dllhost.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat
Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/112-243-0x0000000000000000-mapping.dmp

Download
memory/220-245-0x0000000000000000-mapping.dmp

Download
memory/452-207-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/452-188-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/452-205-0x0000000000000000-mapping.dmp

Download
memory/452-211-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/452-183-0x0000000000000000-mapping.dmp

Download
memory/452-186-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/900-210-0x0000000000000000-mapping.dmp

Download
memory/1112-238-0x0000000000000000-mapping.dmp

Download
memory/1116-196-0x0000000000000000-mapping.dmp

Download
memory/1300-155-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/1300-172-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/1300-143-0x0000000000000000-mapping.dmp

Download
memory/1524-140-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/1524-153-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/1524-139-0x00000000003E0000-0x00000000004F0000-memory.dmp

Filesize
1.1MB

Download
memory/1524-136-0x0000000000000000-mapping.dmp

Download
memory/1752-190-0x0000000000000000-mapping.dmp

Download
memory/1776-221-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/1776-225-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/1776-219-0x0000000000000000-mapping.dmp

Download
memory/1924-250-0x0000000000000000-mapping.dmp

Download
memory/2128-252-0x0000000000000000-mapping.dmp

Download
memory/2140-145-0x0000000000000000-mapping.dmp

Download
memory/2140-158-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/2140-168-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/2152-231-0x0000000000000000-mapping.dmp

Download
memory/2156-132-0x0000000000000000-mapping.dmp

Download
memory/2360-203-0x0000000000000000-mapping.dmp

Download
memory/2396-222-0x0000000000000000-mapping.dmp

Download
memory/2572-217-0x0000000000000000-mapping.dmp

Download
memory/2688-157-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/2688-144-0x0000000000000000-mapping.dmp

Download
memory/2688-163-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/2692-170-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/2692-142-0x0000000000000000-mapping.dmp

Download
memory/2692-156-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/2884-159-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/2884-178-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/2884-146-0x0000000000000000-mapping.dmp

Download
memory/3524-147-0x0000000000000000-mapping.dmp

Download
memory/3524-160-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/3524-174-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/3536-236-0x0000000000000000-mapping.dmp

Download
memory/3596-198-0x0000000000000000-mapping.dmp

Download
memory/3596-200-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/3596-204-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/3668-235-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/3668-239-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/3668-233-0x0000000000000000-mapping.dmp

Download
memory/3680-208-0x0000000000000000-mapping.dmp

Download
memory/3920-181-0x0000000000000000-mapping.dmp

Download
memory/3956-215-0x0000000000000000-mapping.dmp

Download
memory/4232-194-0x0000000000000000-mapping.dmp

Download
memory/4264-179-0x0000000000000000-mapping.dmp

Download
memory/4328-242-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-246-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/4328-240-0x0000000000000000-mapping.dmp

Download
memory/4344-254-0x0000000000000000-mapping.dmp

Download
memory/4360-162-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/4360-182-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/4360-149-0x0000000000000000-mapping.dmp

Download
memory/4416-148-0x0000000000000000-mapping.dmp

Download
memory/4416-177-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/4416-161-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/4428-197-0x00007FFD76DB0000-0x00007FFD77871000-memory.dmp

Filesize
10.8MB

Download
memory/4428-193-0x00007FFD76DB0000-0x00007FFD77871000-memory.dmp

Filesize
10.8MB

Download
memory/4428-191-0x0000000000000000-mapping.dmp

Download
memory/4588-135-0x0000000000000000-mapping.dmp

Download
memory/4588-232-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/4588-226-0x0000000000000000-mapping.dmp

Download
memory/4588-228-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/4652-201-0x0000000000000000-mapping.dmp

Download
memory/4724-187-0x0000000000000000-mapping.dmp

Download
memory/4908-247-0x0000000000000000-mapping.dmp

Download
memory/4908-249-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/4908-253-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/4912-229-0x0000000000000000-mapping.dmp

Download
memory/5068-224-0x0000000000000000-mapping.dmp

Download
memory/5072-212-0x0000000000000000-mapping.dmp

Download
memory/5072-214-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/5072-218-0x00007FFD76810000-0x00007FFD772D1000-memory.dmp

Filesize
10.8MB

Download
memory/5104-169-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/5104-154-0x00007FFD77460000-0x00007FFD77F21000-memory.dmp

Filesize
10.8MB

Download
memory/5104-150-0x0000011B6F960000-0x0000011B6F982000-memory.dmp

Filesize
136KB

Download
memory/5104-141-0x0000000000000000-mapping.dmp

Download