dcrat | 619f85e67208f3639eacc3121636208ce043ce5cf1f5204b86857cb03b5a004a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cheeto.exe
Size

1.8MB
MD5

42b89874d3138f40f32285be945f2ceb
SHA1

1766b4c4a040ba19afc4318e9b2eab775fee88d7
SHA256

619f85e67208f3639eacc3121636208ce043ce5cf1f5204b86857cb03b5a004a
SHA512

df44c7f5677a0b8e181f52b5c865315672b7c90b37f99c3b5e31714bdbb47d32d652073c42f1e614d2911faddc0394411aa3e1b8c3f832549c0d52f409722ca9
SSDEEP

49152:QdBn+oix+Z7vL4tzzQVGVzDd3Omjq+FLof:QdB+jx+Jv6zQVy1FLof

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	720	4336	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	4336	schtasks.exe	83

Checks computer location settings 2 TTPs 19 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	cheeto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 18 IoCs

pid	Process
4880	RuntimeBroker.exe
4328	RuntimeBroker.exe
1224	RuntimeBroker.exe
3968	RuntimeBroker.exe
4716	RuntimeBroker.exe
2400	RuntimeBroker.exe
4280	RuntimeBroker.exe
1756	RuntimeBroker.exe
684	RuntimeBroker.exe
2828	RuntimeBroker.exe
332	RuntimeBroker.exe
1520	RuntimeBroker.exe
3168	RuntimeBroker.exe
1732	RuntimeBroker.exe
4044	RuntimeBroker.exe
1740	RuntimeBroker.exe
2768	RuntimeBroker.exe
64	RuntimeBroker.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\dwm.exe	cheeto.exe
File created	C:\Program Files\Windows NT\6cb0b6c459d5d3	cheeto.exe
File created	C:\Program Files\Windows Media Player\RuntimeBroker.exe	cheeto.exe
File created	C:\Program Files\Windows Media Player\9e8d7a4ca61bd9	cheeto.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\dllhost.exe	cheeto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
908	PING.EXE
4204	PING.EXE
4160	PING.EXE
316	PING.EXE
968	PING.EXE
2616	PING.EXE
5064	PING.EXE
2312	PING.EXE

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	cheeto.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	RuntimeBroker.exe

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
4204	PING.EXE
4160	PING.EXE
316	PING.EXE
968	PING.EXE
2616	PING.EXE
5064	PING.EXE
2312	PING.EXE
908	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3368	schtasks.exe
1552	schtasks.exe
1476	schtasks.exe
2916	schtasks.exe
3360	schtasks.exe
1732	schtasks.exe
4156	schtasks.exe
1496	schtasks.exe
640	schtasks.exe
3268	schtasks.exe
4812	schtasks.exe
2628	schtasks.exe
2096	schtasks.exe
2880	schtasks.exe
3024	schtasks.exe
1064	schtasks.exe
1584	schtasks.exe
720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe
540	cheeto.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	cheeto.exe
Token: SeDebugPrivilege	4880	RuntimeBroker.exe
Token: SeDebugPrivilege	4328	RuntimeBroker.exe
Token: SeDebugPrivilege	1224	RuntimeBroker.exe
Token: SeDebugPrivilege	3968	RuntimeBroker.exe
Token: SeDebugPrivilege	4716	RuntimeBroker.exe
Token: SeDebugPrivilege	2400	RuntimeBroker.exe
Token: SeDebugPrivilege	4280	RuntimeBroker.exe
Token: SeDebugPrivilege	1756	RuntimeBroker.exe
Token: SeDebugPrivilege	684	RuntimeBroker.exe
Token: SeDebugPrivilege	2828	RuntimeBroker.exe
Token: SeDebugPrivilege	332	RuntimeBroker.exe
Token: SeDebugPrivilege	1520	RuntimeBroker.exe
Token: SeDebugPrivilege	3168	RuntimeBroker.exe
Token: SeDebugPrivilege	1732	RuntimeBroker.exe
Token: SeDebugPrivilege	4044	RuntimeBroker.exe
Token: SeDebugPrivilege	1740	RuntimeBroker.exe
Token: SeDebugPrivilege	2768	RuntimeBroker.exe
Token: SeDebugPrivilege	64	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4296	540	cheeto.exe	102
PID 540 wrote to memory of 4296	540	cheeto.exe	102
PID 4296 wrote to memory of 4600	4296	cmd.exe	104
PID 4296 wrote to memory of 4600	4296	cmd.exe	104
PID 4296 wrote to memory of 316	4296	cmd.exe	105
PID 4296 wrote to memory of 316	4296	cmd.exe	105
PID 4296 wrote to memory of 4880	4296	cmd.exe	106
PID 4296 wrote to memory of 4880	4296	cmd.exe	106
PID 4880 wrote to memory of 3400	4880	RuntimeBroker.exe	108
PID 4880 wrote to memory of 3400	4880	RuntimeBroker.exe	108
PID 3400 wrote to memory of 2188	3400	cmd.exe	110
PID 3400 wrote to memory of 2188	3400	cmd.exe	110
PID 3400 wrote to memory of 3764	3400	cmd.exe	111
PID 3400 wrote to memory of 3764	3400	cmd.exe	111
PID 3400 wrote to memory of 4328	3400	cmd.exe	118
PID 3400 wrote to memory of 4328	3400	cmd.exe	118
PID 4328 wrote to memory of 3448	4328	RuntimeBroker.exe	120
PID 4328 wrote to memory of 3448	4328	RuntimeBroker.exe	120
PID 3448 wrote to memory of 3860	3448	cmd.exe	122
PID 3448 wrote to memory of 3860	3448	cmd.exe	122
PID 3448 wrote to memory of 64	3448	cmd.exe	124
PID 3448 wrote to memory of 64	3448	cmd.exe	124
PID 3448 wrote to memory of 1224	3448	cmd.exe	130
PID 3448 wrote to memory of 1224	3448	cmd.exe	130
PID 1224 wrote to memory of 3568	1224	RuntimeBroker.exe	132
PID 1224 wrote to memory of 3568	1224	RuntimeBroker.exe	132
PID 3568 wrote to memory of 4008	3568	cmd.exe	134
PID 3568 wrote to memory of 4008	3568	cmd.exe	134
PID 3568 wrote to memory of 968	3568	cmd.exe	135
PID 3568 wrote to memory of 968	3568	cmd.exe	135
PID 3568 wrote to memory of 3968	3568	cmd.exe	140
PID 3568 wrote to memory of 3968	3568	cmd.exe	140
PID 3968 wrote to memory of 2028	3968	RuntimeBroker.exe	142
PID 3968 wrote to memory of 2028	3968	RuntimeBroker.exe	142
PID 2028 wrote to memory of 4368	2028	cmd.exe	144
PID 2028 wrote to memory of 4368	2028	cmd.exe	144
PID 2028 wrote to memory of 3340	2028	cmd.exe	145
PID 2028 wrote to memory of 3340	2028	cmd.exe	145
PID 2028 wrote to memory of 4716	2028	cmd.exe	147
PID 2028 wrote to memory of 4716	2028	cmd.exe	147
PID 4716 wrote to memory of 2588	4716	RuntimeBroker.exe	149
PID 4716 wrote to memory of 2588	4716	RuntimeBroker.exe	149
PID 2588 wrote to memory of 4364	2588	cmd.exe	151
PID 2588 wrote to memory of 4364	2588	cmd.exe	151
PID 2588 wrote to memory of 1616	2588	cmd.exe	152
PID 2588 wrote to memory of 1616	2588	cmd.exe	152
PID 2588 wrote to memory of 2400	2588	cmd.exe	154
PID 2588 wrote to memory of 2400	2588	cmd.exe	154
PID 2400 wrote to memory of 2152	2400	RuntimeBroker.exe	156
PID 2400 wrote to memory of 2152	2400	RuntimeBroker.exe	156
PID 2152 wrote to memory of 4620	2152	cmd.exe	158
PID 2152 wrote to memory of 4620	2152	cmd.exe	158
PID 2152 wrote to memory of 2416	2152	cmd.exe	159
PID 2152 wrote to memory of 2416	2152	cmd.exe	159
PID 2152 wrote to memory of 4280	2152	cmd.exe	161
PID 2152 wrote to memory of 4280	2152	cmd.exe	161
PID 4280 wrote to memory of 2132	4280	RuntimeBroker.exe	163
PID 4280 wrote to memory of 2132	4280	RuntimeBroker.exe	163
PID 2132 wrote to memory of 964	2132	cmd.exe	165
PID 2132 wrote to memory of 964	2132	cmd.exe	165
PID 2132 wrote to memory of 1556	2132	cmd.exe	166
PID 2132 wrote to memory of 1556	2132	cmd.exe	166
PID 2132 wrote to memory of 1756	2132	cmd.exe	169
PID 2132 wrote to memory of 1756	2132	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cheeto.exe
"C:\Users\Admin\AppData\Local\Temp\cheeto.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9elc8vH3H.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4600
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:316
- - C:\Program Files\Windows Media Player\RuntimeBroker.exe
    "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tnXcb7QBZk.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3400
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2188
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:3764
    - - C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4328
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oqD6e5Rlo4.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:64
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zd3m5m79sA.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4008
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:968
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Tx5bI8CrM8.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3340
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PTUnOlLS5m.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:4364
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1616
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uhjF8j8k7U.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:4620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2416
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cHG0lItX2O.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1556
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7p8ySQy6iH.bat"
        18⤵
        
        PID:4640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2616
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lbSQETZDjd.bat"
        20⤵
        
        PID:1312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1884
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KWBHRiM3K6.bat"
        22⤵
        
        PID:4700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2808
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cHG0lItX2O.bat"
        24⤵
        
        PID:3904
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:2768
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2940
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aocknmtqfY.bat"
        26⤵
        
        PID:2108
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:1552
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5064
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VQkrGeCZky.bat"
        28⤵
        
        PID:2788
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:2156
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4128
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\N0qXQFLliw.bat"
        30⤵
        
        PID:1672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:4156
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        31⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2312
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wvZOdU8aJP.bat"
        32⤵
        
        PID:2488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:3340
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:228
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        33⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gzlPEas6c9.bat"
        34⤵
        
        PID:2948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:1764
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        35⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:908
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        35⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\N0qXQFLliw.bat"
        36⤵
        
        PID:1452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:4516
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        37⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4204
        
        C:\Program Files\Windows Media Player\RuntimeBroker.exe
        
        "C:\Program Files\Windows Media Player\RuntimeBroker.exe"
        37⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:64
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p52E8qRc0z.bat"
        38⤵
        
        PID:4844
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:3360
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        39⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows NT\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cheetoc" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\cheeto.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cheeto" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\cheeto.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cheetoc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\cheeto.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Media Player\RuntimeBroker.exe

Filesize
1.8MB

MD5
42b89874d3138f40f32285be945f2ceb

SHA1
1766b4c4a040ba19afc4318e9b2eab775fee88d7

SHA256
619f85e67208f3639eacc3121636208ce043ce5cf1f5204b86857cb03b5a004a

SHA512
df44c7f5677a0b8e181f52b5c865315672b7c90b37f99c3b5e31714bdbb47d32d652073c42f1e614d2911faddc0394411aa3e1b8c3f832549c0d52f409722ca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
f8b2fca3a50771154571c11f1c53887b

SHA1
2e83b0c8e2f4c10b145b7fb4832ed1c78743de3f

SHA256
0efa72802031a8f902c3a4ab18fe3d667dafc71c93eb3a1811e78353ecf4a6b6

SHA512
b98b8d5516593d13415199d4ac6fbe4ff924488487c4bd863cb677601048785d872a3ff30129148e2961cb6fb2fc33117540302980a132f57f7ec9a497813f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7p8ySQy6iH.bat

Filesize
183B

MD5
f1029f16a7c653ef642edde64498e459

SHA1
0b37d0a9bb3f932b2113a74dcdd35d99768287b3

SHA256
ecd27ecc632c04b4b8d8769cfb272939eb7ad2f49506328598179a19a9ffe3c4

SHA512
8d8fe6c4f5c380713e2a0e4738a5a981a5a15e3375598cd9d026845d84d6f8bc5d5e4bafd2c91d4a47e3d5421f78239b355d80dfd03bc12e108113b12aa6591a

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9elc8vH3H.bat

Filesize
183B

MD5
d29aa450d5a12a6e6caca22eafb6e03b

SHA1
b4ffe8b4fc2a146974dbc5077c18219a7f8689e5

SHA256
d7d9f0c8d3d809c551be7e478711b4c67d2bdfb81d723f9ae252fd4e8150ca0e

SHA512
d20188e50350cd5fb54d98439b445bc677589ff9d08cd4dbdfd9778d69bc288c53bd2f33066f307600312d5552a874a976d09fd4287f64aeb350290c4a4756df

Download Submit
C:\Users\Admin\AppData\Local\Temp\KWBHRiM3K6.bat

Filesize
231B

MD5
aed45d47b6dccba98f0c98b539cb6b01

SHA1
2dad50cc9f95fb0ce32022d20bfdcfe0d7465a8b

SHA256
6fdf516ef7ac2870c1e52128730300479293ebcdd46da09ba543a3d8cb5034ae

SHA512
f7fe7df92458b74baf7bc62d355a23f9487c01f26d2939499cc970a1bc0a343c7f21af496c4c895663eb292ed68b21fbacc1a5edf50c8d80261e167e8d963436

Download Submit
C:\Users\Admin\AppData\Local\Temp\N0qXQFLliw.bat

Filesize
183B

MD5
95e0e5050ae869a534fa6fd103dda183

SHA1
b66bcbf994060ed6d9c90656e98c088ca68d1d3f

SHA256
5fde7d58c61395f9ddb9a09eeddc4808bf91a869e57b2bcd38ded7634d12ff7b

SHA512
6a8f87b7b706535ec610ba8d66e782c199697854795286531a0f7694791d87566fe4b9221953e1eb85ac7eb2d0d02aa1e039ce658bc07ce51970c2c3d94ef72f

Download Submit
C:\Users\Admin\AppData\Local\Temp\PTUnOlLS5m.bat

Filesize
231B

MD5
69829ab6d49060f6bd3a9ee9f6df828f

SHA1
4874b39fbccdb1bde28cd065fec1d804b6472423

SHA256
665a9109e1326abea3c3a5b997e7f7d5314a7abcfa53d9da053df7e6b02454c3

SHA512
0bef081ff46763b79251977762b1e25a2b860011bd506e028aad8ee816b61118387aaaccb3b798271160679247af27a3c6722c3292b58a679fa852e961527435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tx5bI8CrM8.bat

Filesize
231B

MD5
9094e792e94732c0647e23ae124d5215

SHA1
fc83109e6e0fd7de5f188f7479530627d2589fdf

SHA256
e14d9b46a585a2b177186e68fb02adf5b01082210453c759edfc8c11a94de1f1

SHA512
024c1705a1a0723f712c0cf2a35c3909aefa0a3ecb59719183a01049f9505c9aba21364080dd6a1cd3eedcbac909bea1774ef390d52a22f7fc92f598c8ceae80

Download Submit
C:\Users\Admin\AppData\Local\Temp\VQkrGeCZky.bat

Filesize
231B

MD5
05c6473f1af2bb2ecdf28ece791943c8

SHA1
b290e3befe6c4dfc22e427b8fb0b5c813c3ca187

SHA256
d5bdb3859561900279ff0811a605457d1843bc3ce81d46d25a1707f46ad0ce1a

SHA512
a9ed353bc841cc9b296df2f7391cc46adff1f9f9f85ac77b65a5a981a0466b07df0f5ef5946738f72223c4550449678a772da9c748f51ca274fc6af818d1558e

Download Submit
C:\Users\Admin\AppData\Local\Temp\aocknmtqfY.bat

Filesize
183B

MD5
8349d9ff2d41a1d8a2b9db1f7e2f1954

SHA1
970d376b9c199c645b3e6ca8995ab701a7767f28

SHA256
c39467bffae9b23a74a117c902e2f33767ca71c889ddcfd9dce70097a95b9c0d

SHA512
214f25d1cd188e0e70c389f8c0627c653609e27ce04355d2ace172521b73adc580008980590dc7684f4260b6a5e8b5baa2d27b4dbc5f1178e096d90c6b2c6154

Download Submit
C:\Users\Admin\AppData\Local\Temp\cHG0lItX2O.bat

Filesize
231B

MD5
781404abbf37102b5933408882a886a2

SHA1
072fe19a08eaa7e8022bb83a032606cc539edb6d

SHA256
dc3e59c545d3b0648beef9c91030c699d852a1c74f82e91c1d7a2af98fda03fe

SHA512
ce170134094aff19ec187a7deccec99769f76463add683eb9bc47d441c84096d22e747d027c5e5b838a0ea79c67ba707e59567f1a4f3075bed04bcc790cca410

Download Submit
C:\Users\Admin\AppData\Local\Temp\gzlPEas6c9.bat

Filesize
183B

MD5
8b7fd990bf12ce5706beba57f3d890c8

SHA1
428f8396c685fc598749bed73ad977654dac63be

SHA256
42af590b2bb22563559972c5582c822d83a673e9b1e85e2037abc5be3e56830d

SHA512
009a948a97d56d0d3188349fd487fb12d6959070f55eda506a92a9741288e57529fa898f5e4673abdd86e21ecc10192881bed000e991a1f71dac82487be7229f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lbSQETZDjd.bat

Filesize
231B

MD5
18d9d8f7ea953c4944c7ca9dd8e88bb3

SHA1
c68a0baaa9b7afdb06970eaceeea2b4c96b5ded1

SHA256
7e319e75e50636a0397d360e67b152f745797ea1921136801521cd4162dac81f

SHA512
4fe2aa49075d6a7188286d98da50964049deb5e378923b7366ceb0957e405894e5ad179a75a33a2ae5aec4d4fa284fce166e7e9b17358338fce972d112a3bf0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\oqD6e5Rlo4.bat

Filesize
231B

MD5
591413cf3ce6693a0899c7e75b06e9b4

SHA1
ece5821cd4da0ffa948dfce676f9fd56894c0964

SHA256
97e1496c9238e127146402fbe275b922444471bca80256412ba098dac7d199d5

SHA512
83eba4075df728bc9deb719ef996b0a0ed95e2b3c447f686d63c4ee8a818d57dbbf7122f044637a453d26f334237e26ab92ffde91258fa4aff0884afe51e1faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\p52E8qRc0z.bat

Filesize
183B

MD5
5824504b79b6cb117453afe2caaaa800

SHA1
0faf890dc3ad13e599a2e6c7321337849cc750bc

SHA256
974d34616d8ca50be5830cc41f61c87fc4075cf5ff688920dd9938759910109f

SHA512
15529af9f753581d24a1099799dec1f3e605fba242151f06931d3141dd6dbd35504cf9af5312561fae3ece1cb463af272086400d3fb2321e16bcbe027ae45693

Download Submit
C:\Users\Admin\AppData\Local\Temp\tnXcb7QBZk.bat

Filesize
231B

MD5
20d90e94c570558093bbce8aa74380e8

SHA1
8c71825ff7db4dc5c930b95b6fa530bcc7a0df38

SHA256
0c6502fc4af0d36a46306df49ac2ec397384a6f07d5bbbca559c85a94d5cedb2

SHA512
6ae2a499c5102c7f5596e8370c15c5a5eb3349ee6eb842a99cf2222dbe3ee84424721618d2d43cd80dc44484f53a0ab4368d3226b9b1a1e3440cab5ccecd7f14

Download Submit
C:\Users\Admin\AppData\Local\Temp\uhjF8j8k7U.bat

Filesize
231B

MD5
5826cba59b36c389c4b52562f96eb113

SHA1
8ede54ca8479f01d2561952c6dfd522c793a596e

SHA256
53681413481fe75bf3eaef01b703b8d79f4a36da22f725f47fba794ab5ac3cec

SHA512
813e9753c93a6cc70bc9fab5bdbb73699b6ab867a562a85d1c80232f44167fa5f013a37cf9cf7133e3d0592a745e2d8b1b56419f61def7a9040fc2223198b2a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\wvZOdU8aJP.bat

Filesize
231B

MD5
a34a928ccfca69d6dc25bcecf85f0d82

SHA1
5b65602fe216ec9d3b833ba0220c04c8b833d33c

SHA256
1ec74cc74d8103ccf024881b90667707958d29b275ea6131c55548209ef93a7b

SHA512
7e3fc9c4bfaf2d8c88173e03db230e3113bfa7bc90767a48d5b9e5b317f44186850a78cdc0fcffb4ef49cd32ffa35c7e83c21a1d966737247a4e4a3a6874e8c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\zd3m5m79sA.bat

Filesize
183B

MD5
00ef51f376e6c031eac6dada54174613

SHA1
5b4d22bf6d60effbbe2681719614549c23ed19aa

SHA256
55cdd8f814223c578538b389ee8ad8f0fefe7dbcbdd0d21be72e871d3a12dde0

SHA512
b8a65435944c582efeb625ac30df47b8f574c86fdd3ce173f0a9076a0b9695e758ff3e9a19d32e075712822325362c4f17add51d045e05db8a6cae2defa61931

Download Submit
memory/332-138-0x000000001CE90000-0x000000001D039000-memory.dmp

Filesize
1.7MB

Download
memory/540-10-0x000000001BB20000-0x000000001BB70000-memory.dmp

Filesize
320KB

Download
memory/540-9-0x000000001BAB0000-0x000000001BACC000-memory.dmp

Filesize
112KB

Download
memory/540-23-0x00007FFADA100000-0x00007FFADABC1000-memory.dmp

Filesize
10.8MB

Download
memory/540-15-0x00007FFADA100000-0x00007FFADABC1000-memory.dmp

Filesize
10.8MB

Download
memory/540-27-0x00007FFADA100000-0x00007FFADABC1000-memory.dmp

Filesize
10.8MB

Download
memory/540-12-0x000000001BAD0000-0x000000001BAE8000-memory.dmp

Filesize
96KB

Download
memory/540-28-0x00007FFADA100000-0x00007FFADABC1000-memory.dmp

Filesize
10.8MB

Download
memory/540-26-0x00007FFADA100000-0x00007FFADABC1000-memory.dmp

Filesize
10.8MB

Download
memory/540-7-0x00007FFADA100000-0x00007FFADABC1000-memory.dmp

Filesize
10.8MB

Download
memory/540-0-0x00007FFADA103000-0x00007FFADA105000-memory.dmp

Filesize
8KB

Download
memory/540-6-0x0000000001490000-0x000000000149E000-memory.dmp

Filesize
56KB

Download
memory/540-4-0x00007FFADA100000-0x00007FFADABC1000-memory.dmp

Filesize
10.8MB

Download
memory/540-3-0x00007FFADA100000-0x00007FFADABC1000-memory.dmp

Filesize
10.8MB

Download
memory/540-34-0x00007FFADA100000-0x00007FFADABC1000-memory.dmp

Filesize
10.8MB

Download
memory/540-2-0x00007FFADA100000-0x00007FFADABC1000-memory.dmp

Filesize
10.8MB

Download
memory/540-1-0x0000000000980000-0x0000000000B52000-memory.dmp

Filesize
1.8MB

Download