dcrat | 3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinPerfcommon.exe
Size

1.9MB
MD5

6b9554367a439d39a00a0dff9a08b123
SHA1

e1d22cde90c297c10f4fcba5b3980e5d551eb0b3
SHA256

3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9
SHA512

72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720
SSDEEP

49152:xh0kcmcdp/caMMlawkBXRInaKYRouPbWGQ2:xhbcmcfM/N1RSavoujWH

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\services.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\services.exe\", \"C:\\Program Files\\Microsoft Games\\Chess\\explorer.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\services.exe\", \"C:\\Program Files\\Microsoft Games\\Chess\\explorer.exe\", \"C:\\Windows\\fr-FR\\System.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\services.exe\", \"C:\\Program Files\\Microsoft Games\\Chess\\explorer.exe\", \"C:\\Windows\\fr-FR\\System.exe\", \"C:\\Users\\Default User\\lsass.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\services.exe\", \"C:\\Program Files\\Microsoft Games\\Chess\\explorer.exe\", \"C:\\Windows\\fr-FR\\System.exe\", \"C:\\Users\\Default User\\lsass.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\System.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\services.exe\", \"C:\\Program Files\\Microsoft Games\\Chess\\explorer.exe\", \"C:\\Windows\\fr-FR\\System.exe\", \"C:\\Users\\Default User\\lsass.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\System.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinPerfcommon.exe\""	WinPerfcommon.exe

Process spawned unexpected child process 17 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2660	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2660	schtasks.exe	30

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2356	powershell.exe
2212	powershell.exe
2648	powershell.exe
2032	powershell.exe
1080	powershell.exe
1108	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
1636	System.exe
1728	System.exe
2204	System.exe
924	System.exe
1908	System.exe
2040	System.exe
2588	System.exe
2536	System.exe
2016	System.exe
1424	System.exe
2184	System.exe
852	System.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\services.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Media Player\\ja-JP\\services.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Microsoft Games\\Chess\\explorer.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default User\\lsass.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\System.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\System.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Microsoft Games\\Chess\\explorer.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\fr-FR\\System.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\fr-FR\\System.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default User\\lsass.exe\""	WinPerfcommon.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC53EFD4193610491C9A3B2BA576AE4BDC.TMP	csc.exe
File created	\??\c:\Windows\System32\wa0wg5.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Chess\explorer.exe	WinPerfcommon.exe
File created	C:\Program Files\Microsoft Games\Chess\7a0fd90576e088	WinPerfcommon.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\services.exe	WinPerfcommon.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\c5b4cb5e9653cc	WinPerfcommon.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\fr-FR\System.exe	WinPerfcommon.exe
File created	C:\Windows\fr-FR\27d1bcfc3c54e0	WinPerfcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
288	PING.EXE
580	PING.EXE
2260	PING.EXE
2428	PING.EXE
3024	PING.EXE
1804	PING.EXE
804	PING.EXE

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
2428	PING.EXE
3024	PING.EXE
1804	PING.EXE
804	PING.EXE
288	PING.EXE
580	PING.EXE
2260	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2892	schtasks.exe
2512	schtasks.exe
2316	schtasks.exe
2276	schtasks.exe
2136	schtasks.exe
1048	schtasks.exe
536	schtasks.exe
816	schtasks.exe
2880	schtasks.exe
2684	schtasks.exe
2872	schtasks.exe
3032	schtasks.exe
1628	schtasks.exe
2956	schtasks.exe
2768	schtasks.exe
1892	schtasks.exe
2016	schtasks.exe
2908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe
2888	WinPerfcommon.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	WinPerfcommon.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	1636	System.exe
Token: SeDebugPrivilege	1728	System.exe
Token: SeDebugPrivilege	2204	System.exe
Token: SeDebugPrivilege	924	System.exe
Token: SeDebugPrivilege	1908	System.exe
Token: SeDebugPrivilege	2040	System.exe
Token: SeDebugPrivilege	2588	System.exe
Token: SeDebugPrivilege	2536	System.exe
Token: SeDebugPrivilege	2016	System.exe
Token: SeDebugPrivilege	1424	System.exe
Token: SeDebugPrivilege	2184	System.exe
Token: SeDebugPrivilege	852	System.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 956	2888	WinPerfcommon.exe	34
PID 2888 wrote to memory of 956	2888	WinPerfcommon.exe	34
PID 2888 wrote to memory of 956	2888	WinPerfcommon.exe	34
PID 956 wrote to memory of 2140	956	csc.exe	36
PID 956 wrote to memory of 2140	956	csc.exe	36
PID 956 wrote to memory of 2140	956	csc.exe	36
PID 2888 wrote to memory of 1080	2888	WinPerfcommon.exe	52
PID 2888 wrote to memory of 1080	2888	WinPerfcommon.exe	52
PID 2888 wrote to memory of 1080	2888	WinPerfcommon.exe	52
PID 2888 wrote to memory of 2032	2888	WinPerfcommon.exe	53
PID 2888 wrote to memory of 2032	2888	WinPerfcommon.exe	53
PID 2888 wrote to memory of 2032	2888	WinPerfcommon.exe	53
PID 2888 wrote to memory of 2648	2888	WinPerfcommon.exe	54
PID 2888 wrote to memory of 2648	2888	WinPerfcommon.exe	54
PID 2888 wrote to memory of 2648	2888	WinPerfcommon.exe	54
PID 2888 wrote to memory of 2212	2888	WinPerfcommon.exe	56
PID 2888 wrote to memory of 2212	2888	WinPerfcommon.exe	56
PID 2888 wrote to memory of 2212	2888	WinPerfcommon.exe	56
PID 2888 wrote to memory of 2356	2888	WinPerfcommon.exe	58
PID 2888 wrote to memory of 2356	2888	WinPerfcommon.exe	58
PID 2888 wrote to memory of 2356	2888	WinPerfcommon.exe	58
PID 2888 wrote to memory of 1108	2888	WinPerfcommon.exe	60
PID 2888 wrote to memory of 1108	2888	WinPerfcommon.exe	60
PID 2888 wrote to memory of 1108	2888	WinPerfcommon.exe	60
PID 2888 wrote to memory of 1904	2888	WinPerfcommon.exe	64
PID 2888 wrote to memory of 1904	2888	WinPerfcommon.exe	64
PID 2888 wrote to memory of 1904	2888	WinPerfcommon.exe	64
PID 1904 wrote to memory of 1736	1904	cmd.exe	66
PID 1904 wrote to memory of 1736	1904	cmd.exe	66
PID 1904 wrote to memory of 1736	1904	cmd.exe	66
PID 1904 wrote to memory of 2100	1904	cmd.exe	67
PID 1904 wrote to memory of 2100	1904	cmd.exe	67
PID 1904 wrote to memory of 2100	1904	cmd.exe	67
PID 1904 wrote to memory of 1636	1904	cmd.exe	68
PID 1904 wrote to memory of 1636	1904	cmd.exe	68
PID 1904 wrote to memory of 1636	1904	cmd.exe	68
PID 1636 wrote to memory of 2592	1636	System.exe	69
PID 1636 wrote to memory of 2592	1636	System.exe	69
PID 1636 wrote to memory of 2592	1636	System.exe	69
PID 2592 wrote to memory of 584	2592	cmd.exe	71
PID 2592 wrote to memory of 584	2592	cmd.exe	71
PID 2592 wrote to memory of 584	2592	cmd.exe	71
PID 2592 wrote to memory of 580	2592	cmd.exe	72
PID 2592 wrote to memory of 580	2592	cmd.exe	72
PID 2592 wrote to memory of 580	2592	cmd.exe	72
PID 2592 wrote to memory of 1728	2592	cmd.exe	73
PID 2592 wrote to memory of 1728	2592	cmd.exe	73
PID 2592 wrote to memory of 1728	2592	cmd.exe	73
PID 1728 wrote to memory of 3032	1728	System.exe	75
PID 1728 wrote to memory of 3032	1728	System.exe	75
PID 1728 wrote to memory of 3032	1728	System.exe	75
PID 3032 wrote to memory of 2600	3032	cmd.exe	77
PID 3032 wrote to memory of 2600	3032	cmd.exe	77
PID 3032 wrote to memory of 2600	3032	cmd.exe	77
PID 3032 wrote to memory of 2260	3032	cmd.exe	78
PID 3032 wrote to memory of 2260	3032	cmd.exe	78
PID 3032 wrote to memory of 2260	3032	cmd.exe	78
PID 3032 wrote to memory of 2204	3032	cmd.exe	79
PID 3032 wrote to memory of 2204	3032	cmd.exe	79
PID 3032 wrote to memory of 2204	3032	cmd.exe	79
PID 2204 wrote to memory of 2880	2204	System.exe	80
PID 2204 wrote to memory of 2880	2204	System.exe	80
PID 2204 wrote to memory of 2880	2204	System.exe	80
PID 2880 wrote to memory of 568	2880	cmd.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe
"C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fz1matwa\fz1matwa.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BDD.tmp" "c:\Windows\System32\CSC53EFD4193610491C9A3B2BA576AE4BDC.TMP"
    3⤵
    PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\ja-JP\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Chess\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\fr-FR\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tuVwPRNB65.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1736
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2100
- - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
    "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n8fHs36pOy.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2592
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:584
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:580
    - - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1728
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\21MOevrO8R.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2600
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2260
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\um5tZ6OCE3.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:568
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2428
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L70BpVXrOQ.bat"
        10⤵
        
        PID:2252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2732
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s9WOV9c8R9.bat"
        12⤵
        
        PID:2656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1060
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qZ8E8OSIiX.bat"
        14⤵
        
        PID:2740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3048
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2812
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\URBaIgEX4g.bat"
        16⤵
        
        PID:2140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:3044
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3024
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iKsi4Yz6o8.bat"
        18⤵
        
        PID:1064
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:960
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1804
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aqn4VxW4jp.bat"
        20⤵
        
        PID:3068
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:2928
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:804
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XDDaR1k0wv.bat"
        22⤵
        
        PID:1988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:288
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WpUDqpymLx.bat"
        24⤵
        
        PID:800
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:1884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:612
        
        C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\services.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Games\Chess\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Chess\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Games\Chess\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\fr-FR\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\fr-FR\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\fr-FR\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommon" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Media Player\ja-JP\services.exe

Filesize
1.9MB

MD5
6b9554367a439d39a00a0dff9a08b123

SHA1
e1d22cde90c297c10f4fcba5b3980e5d551eb0b3

SHA256
3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

SHA512
72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720

Download Submit
C:\Users\Admin\AppData\Local\Temp\21MOevrO8R.bat

Filesize
201B

MD5
6b088b7eadaebf803f11abd69b591ea4

SHA1
64fdd5d731ec9dd9e6a6e10403a2486d096b3630

SHA256
fdfaa4e50a61013259fec337f6a228afa67cf0343ee1581a94bd4e41e5e5df9a

SHA512
b7834c8ff034f287d933b1b7338726b35ef25949cfefdaa8d689f9a038a26224db35796a9ad66a93987af79fc1191ab6511ad14ae6bfd4b0534b3b6da068a109

Download Submit
C:\Users\Admin\AppData\Local\Temp\L70BpVXrOQ.bat

Filesize
249B

MD5
36bf3baf366aba9535d7332072a21481

SHA1
5f01a180e67b8080d0cfc2ad5deb823da133531e

SHA256
726b244b65175a6054b55baab8c4294055173e90ca1a5b8071ff25200316430f

SHA512
dd1d6cb10813b15101e71942fc1397540dfd62c7837b7fdf7fa70a109bd867ed3f4f43087984e82edc8046b00b5184cd833cc752497828105a22caf20c7f4017

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6BDD.tmp

Filesize
1KB

MD5
bae4626289a06084bf21243ae0605b31

SHA1
17ee6a5018076c04f97da3d537dd2ab5ec607ca7

SHA256
6f7e8253f3fb91e8f33dd968ba3ea65f7d7ced0b7c07c7cff2410381a0309931

SHA512
6214dbd408a33d2bbfb377c58dadd7cabb954c48bd1214ea7913e5e5d797367007838723b81cc4cedac34fd643ae115b00f4fa47a1bec98e3b2036a38632b079

Download Submit
C:\Users\Admin\AppData\Local\Temp\URBaIgEX4g.bat

Filesize
201B

MD5
1f2db85766349f5319b5c233616b42d1

SHA1
023032f7035c29b26266b95a1b3dc85979d69d5c

SHA256
0be4598187eaef871b96bf661c9b888d1d831e29625330926a62bd10b296d68f

SHA512
1d3f0fa1a04b8dc370aaeff053af786b67303036f20bf81f936bdb4db7f34f71a635de83f6d00ba61c7cd419b31cf42a933823fe48a4cc07723337604c2bcb4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WpUDqpymLx.bat

Filesize
249B

MD5
db0c958c9a0a90b763f619efd60f89be

SHA1
2dd705adb1e47f1095f29897d453e26ca38a1389

SHA256
4186fd93a1bed3525baa7777cca1a19f80f572d23416e3e91e6d0fae28da678c

SHA512
07f4debdea57669869196e5a2d4a2365db288e25ff0c567ed62c419173d17cb08a6216d4d94fce14887a7de5a39cdf3abfd823f603e3d57775cd2784f8fbed76

Download Submit
C:\Users\Admin\AppData\Local\Temp\XDDaR1k0wv.bat

Filesize
201B

MD5
cee7ff34a2c9f3a94e1d3fdc16b97655

SHA1
8e160f2df114164d501ade901bb931461cea6261

SHA256
c9dd49c402d0969cc583bca47ae1495b1dc637a699add4f3a69bb9d7f7f288fa

SHA512
3867cebda6dbbd33a515f2d094681539665a8b5eee8d336950f79b6e705c64335b259792245b54e1ed8a222499f62c0dd56158c8e2b0c454aa475438da3d994f

Download Submit
C:\Users\Admin\AppData\Local\Temp\aqn4VxW4jp.bat

Filesize
201B

MD5
e97e5ec3ba377bb4c94e1062b91995d1

SHA1
a3546250ea810f0d6f06cee46bd59179b4c486fc

SHA256
48a94b60bbdb7461ae3c6dd42d96f85c52defd50d60972f11cc6cdd84e748ba7

SHA512
2a40d26ecf9d87324c4341fa05e60feb70454050f80c378d36ebdec805c2098d170e02382e814a31d26e1ae5150adc2227e6314594a922cbcc65c50b4283404e

Download Submit
C:\Users\Admin\AppData\Local\Temp\iKsi4Yz6o8.bat

Filesize
201B

MD5
2de10c9cbbcb25a30cd9f9e8124e4613

SHA1
d7852feddc7e20bdec68348d97a3009e31d4bd21

SHA256
b65f53dabf18a22fad27f61daf70c152fab1b26c6ff6d13fa6af89b0aae9babf

SHA512
15fb05b753e4526fd795735673440f8bda862647fcb9fdf4a5e9e6bd181fc3f760e6ba607063630e78edce4160b52a49ec608c5a590e20b3f6b79ee3201d1c6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\n8fHs36pOy.bat

Filesize
201B

MD5
661cab7b3370bd2dd125b0b6c9198314

SHA1
25f845cec603a37c34e76ec69107504a74ba9372

SHA256
d1fd5551a6101b06187211f00292e3142307bfc082494aeda476202ccc339a15

SHA512
f19ae636bc343ca31588440969437775a427d1b81967a94ea6ff239ec7b868c115cda8fb003cc627f0758c088964709e0cd4ea5c596121113d15cc0180177326

Download Submit
C:\Users\Admin\AppData\Local\Temp\qZ8E8OSIiX.bat

Filesize
249B

MD5
b165fe0a20ed3c34b35465a873fcb5c0

SHA1
c3324e006d92a802d46b2458b2513e510db3860e

SHA256
c6ee5828b686b217e099b14606daa1c3a509e319c5d5f2cc3172302cedb253b0

SHA512
08f8cd009cc7884cda74223454639867ffde5c74b66abc8cc6718e8ca133b525ddc73a00decfaae4b49f5818eaca72941abb949ba3d9f8584b24b17de25df13a

Download Submit
C:\Users\Admin\AppData\Local\Temp\s9WOV9c8R9.bat

Filesize
249B

MD5
7d1d74661f6fbd0d5056af9bceb7dee4

SHA1
5ac9d126f533d3cde5343d969e8fc5b02c189331

SHA256
7db98d7b7499c6742f4ff9ea543b75159b68ff388604350295157429bdb27f57

SHA512
d8b6618a65f1387fba3e76b2d4eb9a53303cb20fda90fe90105c68274a23aff339c8ae0f588cd595b65b2740ca55b63208039e1f3ab470b0d22c846a1205f564

Download Submit
C:\Users\Admin\AppData\Local\Temp\tuVwPRNB65.bat

Filesize
249B

MD5
1831c3fddd9038f43b85aa7e76acc158

SHA1
664ffac68b0b7a4fbc60d061a0872b6cb95a08eb

SHA256
c1fca9264530a04623780b6add3b8b7fe32718f21e88a4127440db087e72204a

SHA512
fe7c830c23bdd9b8c01847134caaff08267087ee821a85caff715d1155d0258e1b7f1b55ce08e171f8555ebeba61487beff7f3a534723244f2650f692d9d0084

Download Submit
C:\Users\Admin\AppData\Local\Temp\um5tZ6OCE3.bat

Filesize
201B

MD5
9441e8576905b65514c1aa17185b6192

SHA1
99491d1c94338c28337cd6339fed0b38ad03edbc

SHA256
1b18aed40a9eeefcf05ad6cbf7197685eed7cf54a45a822460b7cec91a0cee32

SHA512
4bdc3456e52e33b00a7e9693a502315466b6e2748dfe4c871b6c6f586a694a3d6c14e77e04520302efcdae17c0e5ea5b286aef05c9a4110b688da7dc335a6412

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
113bc0c9bb22e1fb941ed158b673cbee

SHA1
a07d1521aa9a708544c541ee4e3e33a8e60d1b38

SHA256
0bd30c0a5eb365c07376706a02243dddc6a6128f33178cd94c8dbba55dab9c8b

SHA512
350ff39da59bbf777221aad4b712c2395eb32a9a40c7cfa354dfffcac89fcfb5f5ae0184a47e6f7314aa92ba7a91175a0f28bbeeb7dfec8e13340926d6a8736e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fz1matwa\fz1matwa.0.cs

Filesize
394B

MD5
67535a0ef487b6fd96e3839cfa128ff5

SHA1
63efa0e8c8ada09f1300119eaade56f22b87dc61

SHA256
d7a66eec538f8118fe1002a555e9a4e76276f308c511024cd55909add1cd7467

SHA512
0cf2444a6d2c7ca3f280c94cc8b90351ed4a81afbf7dba7fb6ae5dcc21747199d4a59b78d7dc236ef9dc8e7a300bb7ecbe2cb2ddf63b91ada92c00c79b10dc37

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fz1matwa\fz1matwa.cmdline

Filesize
235B

MD5
eb54b58ff427b1512526ca1d3856d6fe

SHA1
c6cfc1c377916a024c63802df2527666529c36ae

SHA256
4130f99b700222394a745bfa5300653d533976bfee53e918d22701c53d4e3eb8

SHA512
31794166ad75f8e936c61a4c4d3fa4470a319d23ab89c85415f5245bdc9c91d1a2790c2419f7e20ae570bc5a9662f5700f6644aca11c12f7e55ea563ca3ccc25

Download Submit
\??\c:\Windows\System32\CSC53EFD4193610491C9A3B2BA576AE4BDC.TMP

Filesize
1KB

MD5
b74f131aab310dc6e37b43e729c24199

SHA1
bade4cf35d7e80e79880396c1fdd518d9ab78bdf

SHA256
5fdff2a34cc18e36619ff327b292a8255286dc102d85074b7fc625ccbdbe1858

SHA512
733cb12c94d0a8bedc9a38c073dff2fc46553854d7e835767aaa749b4754beef77fa3bc8232eab21c92bc808c08b150cafe5c035bb33d82292fbf76fec55d885

Download Submit
memory/924-130-0x0000000000280000-0x0000000000474000-memory.dmp

Filesize
2.0MB

Download
memory/1080-67-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/1080-69-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/1424-213-0x0000000000130000-0x0000000000324000-memory.dmp

Filesize
2.0MB

Download
memory/1636-88-0x0000000000EE0000-0x00000000010D4000-memory.dmp

Filesize
2.0MB

Download
memory/1728-102-0x0000000000010000-0x0000000000204000-memory.dmp

Filesize
2.0MB

Download
memory/1908-144-0x00000000012D0000-0x00000000014C4000-memory.dmp

Filesize
2.0MB

Download
memory/2040-158-0x0000000000240000-0x0000000000434000-memory.dmp

Filesize
2.0MB

Download
memory/2184-227-0x00000000011B0000-0x00000000013A4000-memory.dmp

Filesize
2.0MB

Download
memory/2204-116-0x0000000000C80000-0x0000000000E74000-memory.dmp

Filesize
2.0MB

Download
memory/2536-186-0x00000000011A0000-0x0000000001394000-memory.dmp

Filesize
2.0MB

Download
memory/2588-172-0x0000000000B20000-0x0000000000D14000-memory.dmp

Filesize
2.0MB

Download
memory/2888-8-0x0000000000550000-0x000000000056C000-memory.dmp

Filesize
112KB

Download
memory/2888-17-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/2888-14-0x0000000000530000-0x000000000053C000-memory.dmp

Filesize
48KB

Download
memory/2888-22-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-15-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-0-0x000007FEF5793000-0x000007FEF5794000-memory.dmp

Filesize
4KB

Download
memory/2888-12-0x0000000000570000-0x0000000000588000-memory.dmp

Filesize
96KB

Download
memory/2888-19-0x0000000000590000-0x000000000059E000-memory.dmp

Filesize
56KB

Download
memory/2888-10-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-21-0x00000000007B0000-0x00000000007BC000-memory.dmp

Filesize
48KB

Download
memory/2888-9-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-23-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-6-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/2888-70-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-4-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-3-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-25-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-2-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-24-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2888-1-0x0000000000830000-0x0000000000A24000-memory.dmp

Filesize
2.0MB

Download