dcrat | 4dc98610abc00825a886fd1df758c458170ed2442b1e5a096b4c0b3b70031a26

Analysis

max time kernel
145s
max time network
86s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
13/06/2024, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
softcheck.exe
Size 1.5MB
Sample240613-q3e91a1eqf
SHA256 4dc98610abc00825a886fd1df758c458170ed2442b1e5a096b4c0b3b70031a26
MD5 836ec0990b84d743fe6b1ede5562a296
SHA1 e20ea1e584d09c30aa18f72280aedd4caf02df56
SHA512 3b33d7fb3266e669b38155c770fc6909702321434fe55ba0be83e8e82a7cf8d9cc19a2eff943ee60d77b810dcd194ef9cc6fe76972c7e5865cc5d306076d29ea
SSDEEP 24576:U2G/nvxW3Ww0tLe8J3AmbB/p6QvREKKjgDbBhRnT29I44IDBj8QjfUr:UbA30LeCD6osqRnKHF8QK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	2252	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2252	schtasks.exe	81

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x004900000002ab3e-10.dat	dcrat
behavioral2/memory/2612-13-0x0000000000170000-0x00000000002A2000-memory.dmp	dcrat

Executes dropped EXE 27 IoCs

pid	Process
2612	WebSessionhost.exe
1040	csrss.exe
4016	csrss.exe
3928	csrss.exe
1104	csrss.exe
1684	csrss.exe
2056	csrss.exe
1040	csrss.exe
2604	csrss.exe
4200	csrss.exe
1128	csrss.exe
3600	csrss.exe
2044	csrss.exe
2892	csrss.exe
2416	csrss.exe
2076	csrss.exe
2652	csrss.exe
1488	csrss.exe
3408	csrss.exe
3524	csrss.exe
3640	csrss.exe
800	csrss.exe
2240	csrss.exe
1068	csrss.exe
3888	csrss.exe
1692	csrss.exe
4752	csrss.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Oracle\csrss.exe	WebSessionhost.exe
File created	C:\Program Files (x86)\Common Files\Oracle\886983d96e3d3e	WebSessionhost.exe
File created	C:\Program Files\Mozilla Firefox\fonts\RuntimeBroker.exe	WebSessionhost.exe
File created	C:\Program Files\Mozilla Firefox\fonts\9e8d7a4ca61bd9	WebSessionhost.exe
File created	C:\Program Files\WindowsPowerShell\conhost.exe	WebSessionhost.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\OfficeClickToRun.exe	WebSessionhost.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\e6c9b481da804f	WebSessionhost.exe
File created	C:\Program Files\WindowsPowerShell\088424020bedd6	WebSessionhost.exe
File created	C:\Program Files\7-Zip\Lang\SppExtComObj.exe	WebSessionhost.exe
File created	C:\Program Files\7-Zip\Lang\e1ef82546f0b02	WebSessionhost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4024	schtasks.exe
1896	schtasks.exe
2456	schtasks.exe
4892	schtasks.exe
4360	schtasks.exe
3828	schtasks.exe
4952	schtasks.exe
4652	schtasks.exe
2400	schtasks.exe
1572	schtasks.exe
1652	schtasks.exe
3308	schtasks.exe
4572	schtasks.exe
2492	schtasks.exe
692	schtasks.exe
2080	schtasks.exe
8	schtasks.exe
2876	schtasks.exe
2472	schtasks.exe
4056	schtasks.exe
1520	schtasks.exe
1528	schtasks.exe
5056	schtasks.exe
4132	schtasks.exe
3528	schtasks.exe
2632	schtasks.exe
2832	schtasks.exe
2404	schtasks.exe
3992	schtasks.exe
1312	schtasks.exe
1480	schtasks.exe
3612	schtasks.exe
5000	schtasks.exe
4832	schtasks.exe
1684	schtasks.exe
4100	schtasks.exe
2836	schtasks.exe
2512	schtasks.exe
840	schtasks.exe
784	schtasks.exe
900	schtasks.exe
4900	schtasks.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	softcheck.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	csrss.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2612	WebSessionhost.exe
2612	WebSessionhost.exe
2612	WebSessionhost.exe
2612	WebSessionhost.exe
2612	WebSessionhost.exe
2612	WebSessionhost.exe
2612	WebSessionhost.exe
2612	WebSessionhost.exe
2612	WebSessionhost.exe
1040	csrss.exe
4016	csrss.exe
3928	csrss.exe
1104	csrss.exe
1684	csrss.exe
2056	csrss.exe
1040	csrss.exe
2604	csrss.exe
4200	csrss.exe
1128	csrss.exe
3600	csrss.exe
2044	csrss.exe
2892	csrss.exe
2416	csrss.exe
2076	csrss.exe
2652	csrss.exe
1488	csrss.exe
3408	csrss.exe
3524	csrss.exe
3640	csrss.exe
800	csrss.exe
2240	csrss.exe
1068	csrss.exe
3888	csrss.exe
1692	csrss.exe
4752	csrss.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	WebSessionhost.exe
Token: SeDebugPrivilege	1040	csrss.exe
Token: SeDebugPrivilege	4016	csrss.exe
Token: SeDebugPrivilege	3928	csrss.exe
Token: SeDebugPrivilege	1104	csrss.exe
Token: SeDebugPrivilege	1684	csrss.exe
Token: SeDebugPrivilege	2056	csrss.exe
Token: SeDebugPrivilege	1040	csrss.exe
Token: SeDebugPrivilege	2604	csrss.exe
Token: SeDebugPrivilege	4200	csrss.exe
Token: SeDebugPrivilege	1128	csrss.exe
Token: SeDebugPrivilege	3600	csrss.exe
Token: SeDebugPrivilege	2044	csrss.exe
Token: SeDebugPrivilege	2892	csrss.exe
Token: SeDebugPrivilege	2416	csrss.exe
Token: SeDebugPrivilege	2076	csrss.exe
Token: SeDebugPrivilege	2652	csrss.exe
Token: SeDebugPrivilege	1488	csrss.exe
Token: SeDebugPrivilege	3408	csrss.exe
Token: SeDebugPrivilege	3524	csrss.exe
Token: SeDebugPrivilege	3640	csrss.exe
Token: SeDebugPrivilege	800	csrss.exe
Token: SeDebugPrivilege	2240	csrss.exe
Token: SeDebugPrivilege	1068	csrss.exe
Token: SeDebugPrivilege	3888	csrss.exe
Token: SeDebugPrivilege	1692	csrss.exe
Token: SeDebugPrivilege	4752	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 2200	3932	softcheck.exe	77
PID 3932 wrote to memory of 2200	3932	softcheck.exe	77
PID 3932 wrote to memory of 2200	3932	softcheck.exe	77
PID 2200 wrote to memory of 4060	2200	WScript.exe	78
PID 2200 wrote to memory of 4060	2200	WScript.exe	78
PID 2200 wrote to memory of 4060	2200	WScript.exe	78
PID 4060 wrote to memory of 2612	4060	cmd.exe	80
PID 4060 wrote to memory of 2612	4060	cmd.exe	80
PID 2612 wrote to memory of 1040	2612	WebSessionhost.exe	124
PID 2612 wrote to memory of 1040	2612	WebSessionhost.exe	124
PID 1040 wrote to memory of 3292	1040	csrss.exe	125
PID 1040 wrote to memory of 3292	1040	csrss.exe	125
PID 3292 wrote to memory of 3412	3292	cmd.exe	127
PID 3292 wrote to memory of 3412	3292	cmd.exe	127
PID 3292 wrote to memory of 4016	3292	cmd.exe	128
PID 3292 wrote to memory of 4016	3292	cmd.exe	128
PID 4016 wrote to memory of 1084	4016	csrss.exe	129
PID 4016 wrote to memory of 1084	4016	csrss.exe	129
PID 1084 wrote to memory of 2992	1084	cmd.exe	131
PID 1084 wrote to memory of 2992	1084	cmd.exe	131
PID 1084 wrote to memory of 3928	1084	cmd.exe	132
PID 1084 wrote to memory of 3928	1084	cmd.exe	132
PID 3928 wrote to memory of 1904	3928	csrss.exe	133
PID 3928 wrote to memory of 1904	3928	csrss.exe	133
PID 1904 wrote to memory of 1128	1904	cmd.exe	135
PID 1904 wrote to memory of 1128	1904	cmd.exe	135
PID 1904 wrote to memory of 1104	1904	cmd.exe	136
PID 1904 wrote to memory of 1104	1904	cmd.exe	136
PID 1104 wrote to memory of 3816	1104	csrss.exe	137
PID 1104 wrote to memory of 3816	1104	csrss.exe	137
PID 3816 wrote to memory of 4324	3816	cmd.exe	139
PID 3816 wrote to memory of 4324	3816	cmd.exe	139
PID 3816 wrote to memory of 1684	3816	cmd.exe	145
PID 3816 wrote to memory of 1684	3816	cmd.exe	145
PID 1684 wrote to memory of 4900	1684	csrss.exe	146
PID 1684 wrote to memory of 4900	1684	csrss.exe	146
PID 4900 wrote to memory of 2404	4900	cmd.exe	148
PID 4900 wrote to memory of 2404	4900	cmd.exe	148
PID 4900 wrote to memory of 2056	4900	cmd.exe	152
PID 4900 wrote to memory of 2056	4900	cmd.exe	152
PID 2056 wrote to memory of 2564	2056	csrss.exe	153
PID 2056 wrote to memory of 2564	2056	csrss.exe	153
PID 2564 wrote to memory of 3624	2564	cmd.exe	155
PID 2564 wrote to memory of 3624	2564	cmd.exe	155
PID 2564 wrote to memory of 1040	2564	cmd.exe	156
PID 2564 wrote to memory of 1040	2564	cmd.exe	156
PID 1040 wrote to memory of 5060	1040	csrss.exe	157
PID 1040 wrote to memory of 5060	1040	csrss.exe	157
PID 5060 wrote to memory of 1952	5060	cmd.exe	159
PID 5060 wrote to memory of 1952	5060	cmd.exe	159
PID 5060 wrote to memory of 2604	5060	cmd.exe	160
PID 5060 wrote to memory of 2604	5060	cmd.exe	160
PID 2604 wrote to memory of 5028	2604	csrss.exe	161
PID 2604 wrote to memory of 5028	2604	csrss.exe	161
PID 5028 wrote to memory of 4376	5028	cmd.exe	163
PID 5028 wrote to memory of 4376	5028	cmd.exe	163
PID 5028 wrote to memory of 4200	5028	cmd.exe	164
PID 5028 wrote to memory of 4200	5028	cmd.exe	164
PID 4200 wrote to memory of 1388	4200	csrss.exe	165
PID 4200 wrote to memory of 1388	4200	csrss.exe	165
PID 1388 wrote to memory of 876	1388	cmd.exe	167
PID 1388 wrote to memory of 876	1388	cmd.exe	167
PID 1388 wrote to memory of 1128	1388	cmd.exe	168
PID 1388 wrote to memory of 1128	1388	cmd.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\softcheck.exe
"C:\Users\Admin\AppData\Local\Temp\softcheck.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Perfnet\pcwfnmokkxtJ3Iyb.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Perfnet\6BXg6z.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Perfnet\WebSessionhost.exe
      "C:\Perfnet\WebSessionhost.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1040
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3412
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jBrSCX6wbi.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2992
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1128
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN1wkOWwnv.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4324
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2404
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8YXrskW4JY.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3624
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SNnEytbzjv.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1952
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4376
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\etpQuxQFPn.bat"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:876
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\epFjAgKouK.bat"
        24⤵
        
        PID:4736
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1624
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uSow6ZWML2.bat"
        26⤵
        
        PID:2040
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1508
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        27⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8UyA8TRco5.bat"
        28⤵
        
        PID:788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:8
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        29⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\grdey4A1QM.bat"
        30⤵
        
        PID:5076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:1876
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        31⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fg7ffKrc0I.bat"
        32⤵
        
        PID:3724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:1720
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        33⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"
        34⤵
        
        PID:3008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        35⤵
        
        PID:1984
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        35⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UucX7bnqC8.bat"
        36⤵
        
        PID:3632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        37⤵
        
        PID:4752
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        37⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Or3SRhMf8V.bat"
        38⤵
        
        PID:4708
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        39⤵
        
        PID:1228
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        39⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xZLz5Ote6t.bat"
        40⤵
        
        PID:2208
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        41⤵
        
        PID:3860
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        41⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ys2Wc5gw2w.bat"
        42⤵
        
        PID:1580
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        43⤵
        
        PID:4852
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        43⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8UyA8TRco5.bat"
        44⤵
        
        PID:1312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        45⤵
        
        PID:4816
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        45⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\N7XO3McAFn.bat"
        46⤵
        
        PID:652
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        47⤵
        
        PID:2844
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        47⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Mw1PlbJmoj.bat"
        48⤵
        
        PID:3128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        49⤵
        
        PID:2612
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        49⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"
        50⤵
        
        PID:776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        51⤵
        
        PID:1724
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        51⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sWmtPUST1G.bat"
        52⤵
        
        PID:4112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        53⤵
        
        PID:1380
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        53⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\moqrXfpsIj.bat"
        54⤵
        
        PID:4532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        55⤵
        
        PID:3328
        
        C:\Program Files (x86)\Common Files\Oracle\csrss.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\csrss.exe"
        55⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat"
        56⤵
        
        PID:4392
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        57⤵
        
        PID:3316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Documents\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Documents\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Documents\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Oracle\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Oracle\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\fonts\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\fonts\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Desktop\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Desktop\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Desktop\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2520

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4892

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6BXg6z.bat

Path C:\Perfnet\6BXg6z.bat
Size 31B
SHA256 9333737accaf07c57f50d70be7b06c4c60fad33035c71112dcc610fbc8913440
MD5 3076d7d9c9deac080fbfcd12e945f009
SHA1 133d81d6216447dadb8d059e5df0bfa2df859ba4
SHA512 4efadeee2b208cf938edffaaef5fedfd0f0011761ae138d314f6c3ced3561efff10a68db458d1c356e7ade7e06dff524c72bd7cc19f9a5858699f7c9c3479b21
MD5 SHA1 SHA512

Submit Download

WebSessionhost.exe

Path C:\Perfnet\WebSessionhost.exe
Size 1.2MB
SHA256 29343e96342523dd16e657266758de5d584ce53510fce30c303e062e670a79cf
MD5 40b198e7b7da71056b8972df9c95024f
SHA1 76dd178bb42182fb76e8aa7e3fbb30457f195397
SHA512 1803afb1e091899912419f46c46ee187ed3e863294d5948c3d6a2d41107e393927f9bb512c74c36d7230d80909ffdb9ff20592527ce1dc04d31695af0d014ef6
SSDEEP 24576:+e8J3AmbB/p6QvREKKjgDbBhRnT29I44IDBj8QjfU:+eCD6osqRnKHF8Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

pcwfnmokkxtJ3Iyb.vbe

Path C:\Perfnet\pcwfnmokkxtJ3Iyb.vbe
Size 190B
SHA256 c248e5c444ee9f19482070f3abee66c52862e5edaf02899d58dd8d7e7e06beeb
MD5 adf6d6e4a70236f9b1dc8091a11b4f35
SHA1 5d8806d907a881cec768e8175c40ed83dcc5f794
SHA512 411be798e4de069f2941c863738d170ff22a6377bed8ea5900abe7def8ecf55fd851e9e00c6cccd93b7c98fc07efe2306b277c69baaf2cbaa29f1110cb01bd2b
MD5 SHA1 SHA512

Submit Download

csrss.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
Size 1KB
SHA256 bec0ab4eb37381f22befc0da26d55243fd4119274568d2d310f0d869beb4c31c
MD5 3aac0e4fd743749f96ad00fc6c414e45
SHA1 818139805b91d65e33b31de1d5c58054ce450925
SHA512 e75398d42017e3dabe2d2acb9fafd249f1dfcee7e6654107bafc777c19cc5a2f8e403c3eb1e6af83fb04d6600c67635ea51c7a4b1eff86f3ff3c364a98c635b1
MD5 SHA1 SHA512

Submit Download

3gUlVaPHfz.bat

Path C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat
Size 217B
SHA256 17cdf2bb21f54290d92989aa80d7e7322c34c0148a66dce60c960ef7293aa3fe
MD5 1260f64a3f97a6702750bf54109d9ff1
SHA1 8d40f9efc6049b9265823902755cbed91d1789b8
SHA512 fc820055fb874dc464f5ece4b716f01ccdb6ff157201714b514bea0370946e365f76eaff82755dd5985ec4670d6744608e43a1dc01939aa904e351e767283f8f
MD5 SHA1 SHA512

Submit Download

8UyA8TRco5.bat

Path C:\Users\Admin\AppData\Local\Temp\8UyA8TRco5.bat
Size 217B
SHA256 21c6ae3cf6948f0eba9679b2bcfd46519b4e23f67b85913660b1de97976412b3
MD5 6cf383437de505b4106f1291381e6547
SHA1 a608022d842702a3ee180deac3b0245545bc46f9
SHA512 4bb4e424a5b60575325c1a3eb38e55c7c9dd29aab67cf135afb1ca66185bec92782107ac3ed32bf708d5eee65ac9eb949ad5cd0d91c7e1f2624540514bcc2b33
MD5 SHA1 SHA512

Submit Download

8YXrskW4JY.bat

Path C:\Users\Admin\AppData\Local\Temp\8YXrskW4JY.bat
Size 217B
SHA256 508801b1a577db0e4bea2bf3ac9710ac995e186c342ad7c8bd850e5766d7274b
MD5 538b6fd4b79956ea8f00857742fc5db5
SHA1 1ef8e19a7c85804ce9c6f335e2e2255655a988f2
SHA512 d0dc8969559a8543b67fb7458d3306210de3baa5309ba2021101b35e77b285b25438398c9160967d49ca4674ee3e945a9324fc2312e25904131ea8fe458d113d
MD5 SHA1 SHA512

Submit Download

GN1wkOWwnv.bat

Path C:\Users\Admin\AppData\Local\Temp\GN1wkOWwnv.bat
Size 217B
SHA256 56d4d9b4b09d65eb1d2d4bdd02dbb6dfbc6abfefa463524a64f6d3da0d620cf8
MD5 6693937f270c880191c17e39ec643ec6
SHA1 3f010d45cb649c42c990af7767805463ce0684b0
SHA512 1c0ac9a7f2f8ffe17d4249c4c4756e654d859f15ef564da96d09f04958ea2163cd2a420d0b80605d9eca0de329ba71567aec2b708fe0a5c2aae9552679a24c8b
MD5 SHA1 SHA512

Submit Download

HD5NsnfB5C.bat

Path C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat
Size 217B
SHA256 bb2149f2c15b794128c42667163799caf0efc2a12811cc409e981a37a2f4f313
MD5 8893d658951128a58197aa573b907a09
SHA1 9ce541e67d8955c2877537f33b4dc6735c087aad
SHA512 ed6d23be71c92d0096ae238c6a239ade5b579097b79169807a32adf7d7f0840f6395f0df3602778795ec4f0513262e09757ee87457b1c7da32d12faae18dcf0e
MD5 SHA1 SHA512

Submit Download

HZWv28qLDz.bat

Path C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat
Size 217B
SHA256 034c56be5829ba2f86221f9dfc17243a49a0738a8225103a94b7c5bf250fb153
MD5 e3fbb8aa48bd0592ab469e9ad3ce7123
SHA1 d39d51dbd558ad9837651e9a9d4ed260d70b36bc
SHA512 4fd269f5d844031ebfa84a99f803095827069998270a72855763cc82f4e9cd1763b98fd0a329b1b6af67769c4b9941fa28f545de84dfd9ee870b3e38ba65d95d
MD5 SHA1 SHA512

Submit Download

Mw1PlbJmoj.bat

Path C:\Users\Admin\AppData\Local\Temp\Mw1PlbJmoj.bat
Size 217B
SHA256 c74478ba92e86eea8c32026aeebece626d1c86f56a104db5a4b243d2af5cd0c0
MD5 1a0bca2e477e9ac1f1e6bdab0748ad2e
SHA1 76a525f95f3edf313aa5fe08c5330476c65c93fc
SHA512 a4a075c89ec16569e09552be9045a04122f907e408cf79950db3604187fe1752cc9866cc99d1d00e0d63deef9e6f5c4b10ea13f50c451608c520bc6d1f86e28d
MD5 SHA1 SHA512

Submit Download

N7XO3McAFn.bat

Path C:\Users\Admin\AppData\Local\Temp\N7XO3McAFn.bat
Size 217B
SHA256 f4e73145f0118fceb638753ff83b34fae1edc7f2a45ac30b6ebbcee89dcf4c0b
MD5 3b61096f4ecdb2b97788f6605ca07a99
SHA1 f4173d798dd7bf169012d28dd7617f1c323e4e51
SHA512 793701d523c30a505ae596d001d9be6c9d723b15d08b9b207dfd6a53bd90596eaa32598d15e2b6b3a5937d134b67d07ae69e6c02575b5f983f756d570918b029
MD5 SHA1 SHA512

Submit Download

Or3SRhMf8V.bat

Path C:\Users\Admin\AppData\Local\Temp\Or3SRhMf8V.bat
Size 217B
SHA256 101c2d3cbe298234b27d4b128dfe67fee153ba65476b2f2d3ff31bb5f4901606
MD5 fe3e4039dcd3a3c00d4f8023eb7172fc
SHA1 358d330b0a1785415c54e9ce0de93a88ff0a4432
SHA512 57cd2974746c4c3c3e19af241cf826c2b2d0556f741fa259aa13a638fc335abd9dfd9dde0689c37cbae0cd16f5be1e6eaac47c85a19b9d052c2077a68e47b4a8
MD5 SHA1 SHA512

Submit Download

Q3ZRkRg4YZ.bat

Path C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat
Size 217B
SHA256 55a4067619776e9c524d6b019a8364a0b34cf87711e4911c8c91f3d5519a35b0
MD5 2d6eaaca615ac593af5982479a97c6e1
SHA1 fa3f0bbdf10b46311ff7a3d7acc93bbcd6a2c1e7
SHA512 bf5967f6d00ed02953ca16f9cba9ac5cbd7e107291eab608a9a2761d0d050f6f2441fe52e6295b2d56b9950bd428541929569f7d7f652a0e37b694106ad1821c
MD5 SHA1 SHA512

Submit Download

RId7nS4uU7.bat

Path C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat
Size 217B
SHA256 58195d79a8b0edd8432e5855976f1351f5faf84cc4ce9632285505e8bb9d84b6
MD5 198e3f6a85046cf02294f3e034e34e2b
SHA1 1a86a5d162f3cbd6ccc06d32d1e58d394ecaa875
SHA512 abdfa1c0b5198052a4bd8438d64d5dce8f4a258330356d1746453d6b8e0c2d1855bed3ee451f64e315d8224f00e03949107a118276d35fd674ddf8ad82a19f56
MD5 SHA1 SHA512

Submit Download

SNnEytbzjv.bat

Path C:\Users\Admin\AppData\Local\Temp\SNnEytbzjv.bat
Size 217B
SHA256 d1b4df8fea318dd49a6e43e008ae3500faa13eab4098c0d0a246e38bbfc08438
MD5 b57ab32cb0ad64c289548fd6e3e01376
SHA1 86d24bfd9ff65e5efc14f1e5a7f6d55ffad0a8d8
SHA512 79a2953bab042b83d93ee4dd7203ed14f44b64fa304845f9f16a06e03e2cd663b22ebb6da1651d848591eb8f2c8e6b9e5b7fbad9701c9826faa158f26eba75a0
MD5 SHA1 SHA512

Submit Download

UucX7bnqC8.bat

Path C:\Users\Admin\AppData\Local\Temp\UucX7bnqC8.bat
Size 217B
SHA256 dd65c1ee3db86cb6aad3dc850f7ac74e6ad6a937f710becdd9131db978a419a7
MD5 cc045efd9e724017c302ca2664ecfacc
SHA1 be1c1132a20635b1f293b4f3ac04ed5508229553
SHA512 ba0dc567e4322d00e97bc3a6b1d50fb8284663b815f5e77f8efb7d364ed9a465ff12bc21d2e3a5728ab22cbc223f6395d56fc9d2e67c9998acb4db7d69443dd8
MD5 SHA1 SHA512

Submit Download

XErLL4imMU.bat

Path C:\Users\Admin\AppData\Local\Temp\XErLL4imMU.bat
Size 217B
SHA256 295729ccdee70dc36e9266db1363395051783c9dd458b7c6f667aaa13b70781a
MD5 01a55abb7e39444c5c22ae335124d1c6
SHA1 5655b6ed0f19b15ab0268ece88d87947110f3e67
SHA512 af068b72def8e39680693f2e1d51d42391f4e6f30b99554b44e71dbc8fd1c72bdaa9df9f11c5a47360ccbbd945fdc6ff72cdec14aa5ad78adfd79a4fe46a9749
MD5 SHA1 SHA512

Submit Download

Ys2Wc5gw2w.bat

Path C:\Users\Admin\AppData\Local\Temp\Ys2Wc5gw2w.bat
Size 217B
SHA256 2878a2ff849194d04f639afe9c376a22a4501d2965e66db52cd6a0c8b136d36a
MD5 06aeb5cd1a83e0c610cee12f8beafcc8
SHA1 75e2acfef7a079f061da9ab514dbbf708766b8bd
SHA512 7350fc68540d3f72edbeffbcdea7c493755c4303733f423deee0b787a92212f120d08009b32f92b4450fb60b0498db190380e4e64d7fe62a013bdc9b4302d573
MD5 SHA1 SHA512

Submit Download

epFjAgKouK.bat

Path C:\Users\Admin\AppData\Local\Temp\epFjAgKouK.bat
Size 217B
SHA256 b6ed667fc18e0bf19032e0f953133c982948d2191a8f9984220f41c64bfe7111
MD5 2fb55aaae3ec784a60f185bc827042bf
SHA1 c1bfe4d5f371f0c36af4a66ee28886b725ecc802
SHA512 d43182ce64e0a7cc39fedcdff8472298be932d042099254e39b5f30a62f60a334a45c26628e76eaa1d9c7888ab6378ab4455a132fcd51a331d8b9c653e8e9f05
MD5 SHA1 SHA512

Submit Download

etpQuxQFPn.bat

Path C:\Users\Admin\AppData\Local\Temp\etpQuxQFPn.bat
Size 217B
SHA256 54a66dc4c293a120518fbf6c153c80324d51986dc6684deef5ce6942c16416b9
MD5 54b8304d7b83f929fc4179003f15a7d9
SHA1 f12711f58ee91be75d079124d0d2ab0870d5edbe
SHA512 91ccbda88f52856b1999fc8312d80885556fb7a38949d81543b0438c26381c7f6d09c1f11825fb1161b614dc6b45892031c4ca9e714ea7c5e8427aa90a24d7fe
MD5 SHA1 SHA512

Submit Download

fg7ffKrc0I.bat

Path C:\Users\Admin\AppData\Local\Temp\fg7ffKrc0I.bat
Size 217B
SHA256 4ca59dd9305f7d6d2ddace8c8b2310c17656cb4a15e60ede3295f3a963ee8814
MD5 78cdbe1ecd25cdc7b931f679fd95bc70
SHA1 a1a4fd8518e4f80e9fdacc4bc50dde442c922798
SHA512 373f23b60f4c7e3a08ec29356b39b728a137e78880c290cb5011165f30bee7934c4a36a36870ccf46d2c31a16ca576426c6082e9b135a803b1ee443429dc17f4
MD5 SHA1 SHA512

Submit Download

grdey4A1QM.bat

Path C:\Users\Admin\AppData\Local\Temp\grdey4A1QM.bat
Size 217B
SHA256 0de802b5f73956448b2c8fa8d9b4e2cf5c3966bb8e4de1d83ed1361dcd458929
MD5 1a95a15312f41c31117c4a1fa5f155bb
SHA1 aac387a1a8b2264d9d9c883a2011a01f524868c7
SHA512 acd81e07c4c969d16ba9da5731cc111d609aee57566755f340f44bdc76e8da21a3a1c18c3ce2399210c796e3966f25e32cb2cdf8f3afbe4e0ec9e04449e382a4
MD5 SHA1 SHA512

Submit Download

jBrSCX6wbi.bat

Path C:\Users\Admin\AppData\Local\Temp\jBrSCX6wbi.bat
Size 217B
SHA256 e637530fea979c62e0fa9506d9c3eb7dbc19aececb775012e3fe00b7f6311fbe
MD5 208fb59e8e314e708835226c82d2c765
SHA1 d0a5f1c03d461bddc21af0e75ba884323aa5c759
SHA512 8c4891e9f5000f1f41f443147af32846f844a82e841e5f90864355fd06d288a11dee4c9645c0e9ece6da1b8a201451473cfb956fbb0f076079bd98725caf5118
MD5 SHA1 SHA512

Submit Download

moqrXfpsIj.bat

Path C:\Users\Admin\AppData\Local\Temp\moqrXfpsIj.bat
Size 217B
SHA256 c71cce15de1ce33edea608ffb01f8fe4c212be4cd0d1c0fdf04865f3086613f8
MD5 621948494ad4e678f77386de3f84158e
SHA1 5d61d91ac6f606600319cbaa032313cf3e1fdbbf
SHA512 3d523b24e21d7ee5b42b6cde92c1d9f4ed334bae0f8d3d2a0166d8be00214aad08b091d8d5e75f295150448661b483641dcd77ac5063c34ed81e511b3e528bd5
MD5 SHA1 SHA512

Submit Download

sWmtPUST1G.bat

Path C:\Users\Admin\AppData\Local\Temp\sWmtPUST1G.bat
Size 217B
SHA256 a9afb8f8f8f7f7ce85596307893e8ecf77c3d2e1d2db874d58bdb9434b9c2695
MD5 58ea4b0512b692cb91c7436f445f31eb
SHA1 4190951b21fed02c5069f290f26eb552f8725e09
SHA512 91f6e923947a6c17a3747805dfa2bde21bbde7ff86a7ed984bf28e2c1c4d8fd3f5fb5f2d142e879d9b4e378ff79a26da23883f07645831d63bc7b47efff8ad41
MD5 SHA1 SHA512

Submit Download

uSow6ZWML2.bat

Path C:\Users\Admin\AppData\Local\Temp\uSow6ZWML2.bat
Size 217B
SHA256 7335572f7674cbb0220d47ee39ff3d50b5a9c35ba7919c88da866f8693aea4cd
MD5 fb8a59e582cce98408d0773e605c79a7
SHA1 46dd2e2369f418a5491ea3a71da5cf277edc579b
SHA512 1180dee54ca638c210b4879de4e953ede58e279caf38eafdb57c2ddc5e75c77a0f07409b817c90f8a1c1f41cfd2449a88798cce8c757b4a04df16a5400c17524
MD5 SHA1 SHA512

Submit Download

xZLz5Ote6t.bat

Path C:\Users\Admin\AppData\Local\Temp\xZLz5Ote6t.bat
Size 217B
SHA256 dc4a3bb2e3095db464fbe1e25b7389f2d27d73c82c9e80220e973177979f7d2e
MD5 54275d0a4f7566b60d8c2c3c8cf61cc2
SHA1 315ff85f610c82c3a7b083890d2db4271899794e
SHA512 ffb0c39312a94911596b7c9d923256cab93174fe8c031250c7766f87b23647b4d45bfebe1f1fee2c9302010d4fd731f4d52f47530ea71d5af99f0717a40d035f
MD5 SHA1 SHA512

Submit Download

memory/2612-15-0x000000001B5E0000-0x000000001B630000-memory.dmp

Download

memory/2612-14-0x000000001AF20000-0x000000001AF3C000-memory.dmp

Download

memory/2612-13-0x0000000000170000-0x00000000002A2000-memory.dmp

Download

memory/2612-17-0x000000001B470000-0x000000001B47C000-memory.dmp

Download

memory/2612-16-0x000000001B450000-0x000000001B466000-memory.dmp

Download

memory/2612-12-0x00007FFB360B3000-0x00007FFB360B5000-memory.dmp

Download