dcrat | 6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927.exe
Size

1.3MB
MD5

42d93f60c0d6355dba66fa60fb0d74a3
SHA1

e9a8f4b9f39efdcbe1d64966e43da1ee69ad5b12
SHA256

6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927
SHA512

986548e4094b86f2bc9536c8bed300039672c812cef97cd33ff7522cc108cabf3fbdc6780dfc0c6b4db5c9cd1478296b5c373afe4b2682d9b7b604410e08c002
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	3016	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	3016	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b66-10.dat	dcrat
behavioral2/memory/2080-13-0x00000000009F0000-0x0000000000B00000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2300	powershell.exe
408	powershell.exe
2192	powershell.exe
3172	powershell.exe
4476	powershell.exe
3516	powershell.exe

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Executes dropped EXE 16 IoCs

pid	Process
2080	DllCommonsvc.exe
2256	taskhostw.exe
4956	taskhostw.exe
448	taskhostw.exe
2988	taskhostw.exe
2460	taskhostw.exe
1476	taskhostw.exe
1524	taskhostw.exe
1992	taskhostw.exe
4852	taskhostw.exe
4264	taskhostw.exe
1768	taskhostw.exe
2692	taskhostw.exe
4000	taskhostw.exe
4376	taskhostw.exe
3584	taskhostw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
54	raw.githubusercontent.com
38	raw.githubusercontent.com
52	raw.githubusercontent.com
55	raw.githubusercontent.com
20	raw.githubusercontent.com
51	raw.githubusercontent.com
53	raw.githubusercontent.com
44	raw.githubusercontent.com
50	raw.githubusercontent.com
22	raw.githubusercontent.com
36	raw.githubusercontent.com
37	raw.githubusercontent.com
43	raw.githubusercontent.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Prefetch\ReadyBoot\TextInputHost.exe	DllCommonsvc.exe
File created	C:\Windows\Prefetch\ReadyBoot\22eafd247d37c3	DllCommonsvc.exe
File created	C:\Windows\PrintDialog\Assets\taskhostw.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\PrintDialog\Assets\taskhostw.exe	DllCommonsvc.exe
File created	C:\Windows\PrintDialog\Assets\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Windows\ja-JP\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\ja-JP\6cb0b6c459d5d3	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	JaffaCakes118_6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	taskhostw.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1944	schtasks.exe
1764	schtasks.exe
740	schtasks.exe
4536	schtasks.exe
4436	schtasks.exe
1656	schtasks.exe
2708	schtasks.exe
3796	schtasks.exe
2460	schtasks.exe
5076	schtasks.exe
3988	schtasks.exe
1892	schtasks.exe
4784	schtasks.exe
4588	schtasks.exe
1884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2080	DllCommonsvc.exe
2080	DllCommonsvc.exe
2080	DllCommonsvc.exe
3172	powershell.exe
3172	powershell.exe
3516	powershell.exe
4476	powershell.exe
408	powershell.exe
2300	powershell.exe
2192	powershell.exe
4476	powershell.exe
3516	powershell.exe
2300	powershell.exe
408	powershell.exe
2192	powershell.exe
2256	taskhostw.exe
4956	taskhostw.exe
448	taskhostw.exe
2988	taskhostw.exe
2460	taskhostw.exe
1476	taskhostw.exe
1524	taskhostw.exe
1992	taskhostw.exe
4852	taskhostw.exe
4264	taskhostw.exe
1768	taskhostw.exe
2692	taskhostw.exe
4000	taskhostw.exe
4376	taskhostw.exe
3584	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	DllCommonsvc.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2256	taskhostw.exe
Token: SeDebugPrivilege	4956	taskhostw.exe
Token: SeDebugPrivilege	448	taskhostw.exe
Token: SeDebugPrivilege	2988	taskhostw.exe
Token: SeDebugPrivilege	2460	taskhostw.exe
Token: SeDebugPrivilege	1476	taskhostw.exe
Token: SeDebugPrivilege	1524	taskhostw.exe
Token: SeDebugPrivilege	1992	taskhostw.exe
Token: SeDebugPrivilege	4852	taskhostw.exe
Token: SeDebugPrivilege	4264	taskhostw.exe
Token: SeDebugPrivilege	1768	taskhostw.exe
Token: SeDebugPrivilege	2692	taskhostw.exe
Token: SeDebugPrivilege	4000	taskhostw.exe
Token: SeDebugPrivilege	4376	taskhostw.exe
Token: SeDebugPrivilege	3584	taskhostw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 3088	2584	JaffaCakes118_6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927.exe	83
PID 2584 wrote to memory of 3088	2584	JaffaCakes118_6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927.exe	83
PID 2584 wrote to memory of 3088	2584	JaffaCakes118_6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927.exe	83
PID 3088 wrote to memory of 1888	3088	WScript.exe	85
PID 3088 wrote to memory of 1888	3088	WScript.exe	85
PID 3088 wrote to memory of 1888	3088	WScript.exe	85
PID 1888 wrote to memory of 2080	1888	cmd.exe	87
PID 1888 wrote to memory of 2080	1888	cmd.exe	87
PID 2080 wrote to memory of 2300	2080	DllCommonsvc.exe	105
PID 2080 wrote to memory of 2300	2080	DllCommonsvc.exe	105
PID 2080 wrote to memory of 2192	2080	DllCommonsvc.exe	106
PID 2080 wrote to memory of 2192	2080	DllCommonsvc.exe	106
PID 2080 wrote to memory of 408	2080	DllCommonsvc.exe	107
PID 2080 wrote to memory of 408	2080	DllCommonsvc.exe	107
PID 2080 wrote to memory of 3172	2080	DllCommonsvc.exe	108
PID 2080 wrote to memory of 3172	2080	DllCommonsvc.exe	108
PID 2080 wrote to memory of 4476	2080	DllCommonsvc.exe	109
PID 2080 wrote to memory of 4476	2080	DllCommonsvc.exe	109
PID 2080 wrote to memory of 3516	2080	DllCommonsvc.exe	110
PID 2080 wrote to memory of 3516	2080	DllCommonsvc.exe	110
PID 2080 wrote to memory of 1484	2080	DllCommonsvc.exe	117
PID 2080 wrote to memory of 1484	2080	DllCommonsvc.exe	117
PID 1484 wrote to memory of 2584	1484	cmd.exe	119
PID 1484 wrote to memory of 2584	1484	cmd.exe	119
PID 1484 wrote to memory of 2256	1484	cmd.exe	124
PID 1484 wrote to memory of 2256	1484	cmd.exe	124
PID 2256 wrote to memory of 3052	2256	taskhostw.exe	132
PID 2256 wrote to memory of 3052	2256	taskhostw.exe	132
PID 3052 wrote to memory of 1648	3052	cmd.exe	134
PID 3052 wrote to memory of 1648	3052	cmd.exe	134
PID 3052 wrote to memory of 4956	3052	cmd.exe	136
PID 3052 wrote to memory of 4956	3052	cmd.exe	136
PID 4956 wrote to memory of 1912	4956	taskhostw.exe	138
PID 4956 wrote to memory of 1912	4956	taskhostw.exe	138
PID 1912 wrote to memory of 3208	1912	cmd.exe	140
PID 1912 wrote to memory of 3208	1912	cmd.exe	140
PID 1912 wrote to memory of 448	1912	cmd.exe	145
PID 1912 wrote to memory of 448	1912	cmd.exe	145
PID 448 wrote to memory of 4848	448	taskhostw.exe	147
PID 448 wrote to memory of 4848	448	taskhostw.exe	147
PID 4848 wrote to memory of 4628	4848	cmd.exe	149
PID 4848 wrote to memory of 4628	4848	cmd.exe	149
PID 4848 wrote to memory of 2988	4848	cmd.exe	151
PID 4848 wrote to memory of 2988	4848	cmd.exe	151
PID 2988 wrote to memory of 4788	2988	taskhostw.exe	153
PID 2988 wrote to memory of 4788	2988	taskhostw.exe	153
PID 4788 wrote to memory of 1444	4788	cmd.exe	155
PID 4788 wrote to memory of 1444	4788	cmd.exe	155
PID 4788 wrote to memory of 2460	4788	cmd.exe	157
PID 4788 wrote to memory of 2460	4788	cmd.exe	157
PID 2460 wrote to memory of 2416	2460	taskhostw.exe	159
PID 2460 wrote to memory of 2416	2460	taskhostw.exe	159
PID 2416 wrote to memory of 5040	2416	cmd.exe	161
PID 2416 wrote to memory of 5040	2416	cmd.exe	161
PID 2416 wrote to memory of 1476	2416	cmd.exe	163
PID 2416 wrote to memory of 1476	2416	cmd.exe	163
PID 1476 wrote to memory of 4888	1476	taskhostw.exe	165
PID 1476 wrote to memory of 4888	1476	taskhostw.exe	165
PID 4888 wrote to memory of 3476	4888	cmd.exe	167
PID 4888 wrote to memory of 3476	4888	cmd.exe	167
PID 4888 wrote to memory of 1524	4888	cmd.exe	169
PID 4888 wrote to memory of 1524	4888	cmd.exe	169
PID 1524 wrote to memory of 2916	1524	taskhostw.exe	171
PID 1524 wrote to memory of 2916	1524	taskhostw.exe	171

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a90a987391de5bc3ef06e657aa9f333537bac6207eea70515fa5409077aa927.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PrintDialog\Assets\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3516
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EbVxSN2hCq.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2584
      - C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rjTee716Rl.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1648
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vbXk1H8t4K.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3208
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JDh6J9oWuS.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4628
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TGRMrapfWg.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1444
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iu0amT0ExO.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:5040
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OPOGTQits7.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3476
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6VAw4LgrmW.bat"
        19⤵
        
        PID:2916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4692
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\etpQuxQFPn.bat"
        21⤵
        
        PID:3212
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4128
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9dhy3B39XM.bat"
        23⤵
        
        PID:4780
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3480
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TGRMrapfWg.bat"
        25⤵
        
        PID:1088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:5100
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gyyX5OxKdc.bat"
        27⤵
        
        PID:4028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:5060
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PGGCz4Ehy5.bat"
        29⤵
        
        PID:4304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:2172
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8RCzlRjk6I.bat"
        31⤵
        
        PID:4692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:2448
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BYj1kG62r9.bat"
        33⤵
        
        PID:3020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:2312
        
        C:\Windows\PrintDialog\Assets\taskhostw.exe
        
        "C:\Windows\PrintDialog\Assets\taskhostw.exe"
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e2wUPJtRJp.bat"
        35⤵
        
        PID:3224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        36⤵
        
        PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Windows\PrintDialog\Assets\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\PrintDialog\Assets\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Windows\PrintDialog\Assets\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\ja-JP\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\ja-JP\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\ja-JP\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Windows\Prefetch\ReadyBoot\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\6VAw4LgrmW.bat

Filesize
208B

MD5
adf4c8f91a42b44680356ef3473a69c8

SHA1
8ec72fc04a72a8343071be93849b6519f8326a3e

SHA256
e5156a91589365976a776a36e3f99099654468dda21f6963c39d8076fbfd114e

SHA512
c4ab9cc9462fe0e785d6213860f86a773b758cbde69ba2eff5e9aa845dc9e28b40e9f80aeeea10047f1c3e4be2d70408ba6cfde95e7f54c6d43a81fbe1d0fc1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8RCzlRjk6I.bat

Filesize
208B

MD5
031ad7379e0bcbfef52b75c48c025d93

SHA1
3ac3908214520c5d30142c79d6a441bd1b3d7884

SHA256
2d6177d29eb18ddcebf57db34b87136b47b2e618f4ae36f2bb57139699155356

SHA512
6529c98b0f7495382f9e4d197e513f59f817c286fe5631e6c33e8d57557d70f9707bed97e0866bbc514829e90822b419ea8d1d981cddee6640e5bfea1d682f67

Download Submit
C:\Users\Admin\AppData\Local\Temp\9dhy3B39XM.bat

Filesize
208B

MD5
b0a0daad34af265ca8e56cd0c25f346e

SHA1
89c68a3b15e4cca97d7532d02df41e07efedb134

SHA256
11a9b5c563c3a4160bb29c2583430a1438a248aa33c5f68ffc4627fb3520cb67

SHA512
d64150b002a76f25fb805d09ad79047accd60cc014be452e1aabb3f79820cd2e9537cca47a2ec86aaa4e701acacfcdf3a8f53b27b114ed355b2408f53e761d1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\BYj1kG62r9.bat

Filesize
208B

MD5
14e49c4071ce8ccda79c4a2c4f30e4e6

SHA1
4e6bca4af265dca62347d967466155837ef9877c

SHA256
12c4c348c4d31e3e4861f134b8cd0b555f7f385d7aac28675de0880dc1273741

SHA512
6c5a65f4f22374290249070a5fb744aad39d8b1d853f59df93fe9f7fbb6fbee1413b7012d33d4c64a4fc51485b0a4b2951648f3f2634f301346b451bd2c477e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\EbVxSN2hCq.bat

Filesize
208B

MD5
9113234a9122286fda48f02604d18b75

SHA1
c43aa47dc7897928748079184b29984601b9e99e

SHA256
e2f21ac061ca8ed91a8f87120ceb7cc6360c6a7fa8c22494c37acbc2dda4ebda

SHA512
1f1a6802fa654923f4d9309d0b0bb9f3bc8bde7ca52571e99836c305e1b59db2029e9974465305aa9cdf717b8a1456edad3b78ec49cb3df576f02095395922f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\JDh6J9oWuS.bat

Filesize
208B

MD5
45ea5b015190081b3626c05a46d7c089

SHA1
94dba8b6b56e64c3ef5a6a3001a33d4d5b3794e6

SHA256
918f53c2d790e42eadedf15373d0b2f77c7ec77014da29bca8b65393e3f77564

SHA512
37f36c806b4c9b9e8d3a204ef68c0fb30d8097a2a6449c0513cc3f2bf6a9b27d88157d9d507a3e35bc9a9c2868c414d8411ec7fd25b2ee8350f601a7386eb80c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OPOGTQits7.bat

Filesize
208B

MD5
92e168114a157209bd4e8f4eae2ef3c7

SHA1
ea51f4c5bcd14672e00d9ead2776dadbf1cb73cd

SHA256
f8755520a3471c6faa26ea67f709af69ecf5d18122c7a1b9d81e5e873c911399

SHA512
fb07b8260348d660e1e4087192113cd06b4912601bd7afbcde4c308ed871e82a5ee662593b1b064d8ec45732e27c071e3262ae8c47e92b15b7772f998af8eb5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\PGGCz4Ehy5.bat

Filesize
208B

MD5
a169c01ff01f2b8126de6ba81d2103aa

SHA1
f7ba97858c985e750c44521f3132fbdfe00a50dc

SHA256
6389528c0fa5bd614dc1f1b38bbe43131cedbde83c2feb06b3c0815320fa84e8

SHA512
ed138ca53d605bfed1eb7b20141d0351728fcecbcd32f2f78a948156d6e54159c1d87ba547ec4c8dc3c20ca8e73770402b34a2a4cf565379a7b0b9618462ddd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TGRMrapfWg.bat

Filesize
208B

MD5
e48132b8a168998a27c8771dcd8eb284

SHA1
cb1ab8900a24073b2bc0c275a00fb3137c1c187c

SHA256
c67c197e625e87049bd9e043aebe00e6572a6da436a88b7ee047f0f3e9471b36

SHA512
13172964bc0efa4278e9fdf93a9f44b59b511bafe05aca680fb94106b4eb97ffa3459a7cc7702c6dd1dfb63e417a801581a89c42487c61478e74a6a18fd045db

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ttoumgl.hmj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e2wUPJtRJp.bat

Filesize
208B

MD5
c2ca3e7d9677a772c8a4bcad7a4dc4ef

SHA1
8397e2cc352bb3274d8ff67f9a29c0893248bed3

SHA256
e4077d5802d97da9d22cc914b593facf0a249832bda802c901eaf0f64b659d93

SHA512
2913a4f6186cd4daa1ce8d5faf24af9347a81653b0b1d0f183a6731dacf335b6606cb8718b459fdddc9ed8ed52fbc616fe57c7b8731ba43122752d65009b0765

Download Submit
C:\Users\Admin\AppData\Local\Temp\etpQuxQFPn.bat

Filesize
208B

MD5
9560519ccf60c752eb39706cdc068460

SHA1
250bb3a542257db3fc64b6f8732ab8c8fa4e54b1

SHA256
660d84a26fe7ddb858ff730ed3ec516cae2d8c3764f10993f190a5d9fa32bc6d

SHA512
4a4ee9df36f1d99977059a9c8fcc6413873795556b1bcb1b3bfe73f072038f2cc1aa1c0f7783295a495bf4a2e43674faa1454a75e368d81a2fed1332fac7e159

Download Submit
C:\Users\Admin\AppData\Local\Temp\gyyX5OxKdc.bat

Filesize
208B

MD5
21b3948d5859659919e1ee9d45006b34

SHA1
31f5ed5f7bb1119bb5f8f64a633b3efb48717b2d

SHA256
e43a112b5469a5c9bd9f2029fee1e4ad2ce1df4c8fa91b941e5209759cf33344

SHA512
5bf3899fc6a4767ead1601d0ecbb65abef9f645fd61fc1b66d2a8289ab636b29eb064b89a6c73dd987b8f9447fa13dfde7511991c527edf9f71ec5c305cb5640

Download Submit
C:\Users\Admin\AppData\Local\Temp\iu0amT0ExO.bat

Filesize
208B

MD5
4bbe80b4d3fec31309496736f034558c

SHA1
cc77a34679afb27ba7952ebe3bbafbce3940ac25

SHA256
9ec341db4e6b18270a63fb35bacfd002cffe2cc2506efa41b34ff84ee45e3713

SHA512
fad4960fe54dd7da9796626fa2f5cef1e67c4d16c1bedc5819e6b082eeeb65324bf7878998341e3c47287183f00a2f0429444970b46ce7f06dcacbc1bac5337e

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjTee716Rl.bat

Filesize
208B

MD5
d1379495e0001cf6b0c07f896901f8ae

SHA1
aefed7fc4f27333dd8625a9edf8260fb8f761ea6

SHA256
1f419cc98ac1f297fcf31f5b2380e91823f97eb240bcf335177b9897587e3979

SHA512
b7d99f0aa8b951487cbae5325276cce97ba326d67d4b985aae9a2bfb00b9a7abe8667a53a057d94f250dadb5c6c7c9d23d2f94243135db9350156d2fe958a2bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbXk1H8t4K.bat

Filesize
208B

MD5
44b67c431df465d714770e9ca63b32c1

SHA1
2bcdaeaf24e3aa6e5b374613d7c8b990993a46ed

SHA256
2a4486241554927c31c7932ca740d5af0bf76f6361002c9141eac2fd290d42ce

SHA512
20bd068873acf44e47138a05ef20be22e13ccc69060ce3a0f6630b042dad9e5017daf3867bb42964068202fb1508b63b197a6645718de380fddbea4f25ce4219

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/448-127-0x000000001C070000-0x000000001C219000-memory.dmp

Filesize
1.7MB

Download
memory/1476-148-0x000000001C4C0000-0x000000001C669000-memory.dmp

Filesize
1.7MB

Download
memory/1524-155-0x000000001C380000-0x000000001C529000-memory.dmp

Filesize
1.7MB

Download
memory/1992-162-0x000000001CAF0000-0x000000001CC99000-memory.dmp

Filesize
1.7MB

Download
memory/2080-12-0x00007FFB1A463000-0x00007FFB1A465000-memory.dmp

Filesize
8KB

Download
memory/2080-13-0x00000000009F0000-0x0000000000B00000-memory.dmp

Filesize
1.1MB

Download
memory/2080-15-0x0000000002D40000-0x0000000002D4C000-memory.dmp

Filesize
48KB

Download
memory/2080-17-0x0000000002D50000-0x0000000002D5C000-memory.dmp

Filesize
48KB

Download
memory/2080-16-0x0000000002D30000-0x0000000002D3C000-memory.dmp

Filesize
48KB

Download
memory/2080-14-0x00000000012C0000-0x00000000012D2000-memory.dmp

Filesize
72KB

Download
memory/2256-105-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/2256-112-0x000000001C310000-0x000000001C47A000-memory.dmp

Filesize
1.4MB

Download
memory/2460-141-0x000000001BFA0000-0x000000001C149000-memory.dmp

Filesize
1.7MB

Download
memory/2692-185-0x000000001B200000-0x000000001B212000-memory.dmp

Filesize
72KB

Download
memory/2988-134-0x000000001C360000-0x000000001C509000-memory.dmp

Filesize
1.7MB

Download
memory/3172-40-0x0000023C6C910000-0x0000023C6C932000-memory.dmp

Filesize
136KB

Download
memory/4264-172-0x0000000000960000-0x0000000000972000-memory.dmp

Filesize
72KB

Download
memory/4376-198-0x0000000000C50000-0x0000000000C62000-memory.dmp

Filesize
72KB

Download
memory/4852-165-0x0000000002C00000-0x0000000002C12000-memory.dmp

Filesize
72KB

Download
memory/4956-120-0x000000001BCF0000-0x000000001BE5A000-memory.dmp

Filesize
1.4MB

Download
memory/4956-115-0x00000000022C0000-0x00000000022D2000-memory.dmp

Filesize
72KB

Download