dcrat | 34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73.exe
Size

1.3MB
MD5

d02686d4b2a1c61c07b98db0504b5504
SHA1

2d58d7061214cf8ff1cffe28bf78ce16756c334a
SHA256

34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73
SHA512

145c4079006b073a9591383fac1ea30ed89e8c33f6e71b792a543a8cc325a8e9c7ba504786b1c10dfbcdbe6d4fce323df6eb2029f7f4a5e49976dd3e33c30209
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	236	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	236	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b7c-10.dat	dcrat
behavioral2/memory/2684-13-0x0000000000F30000-0x0000000001040000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3052	powershell.exe
1752	powershell.exe
4928	powershell.exe
2032	powershell.exe
3556	powershell.exe
3816	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 15 IoCs

pid	Process
2684	DllCommonsvc.exe
2920	RuntimeBroker.exe
4604	RuntimeBroker.exe
4776	RuntimeBroker.exe
4672	RuntimeBroker.exe
4564	RuntimeBroker.exe
3456	RuntimeBroker.exe
5100	RuntimeBroker.exe
1980	RuntimeBroker.exe
228	RuntimeBroker.exe
4840	RuntimeBroker.exe
2372	RuntimeBroker.exe
2976	RuntimeBroker.exe
4632	RuntimeBroker.exe
5016	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
48	raw.githubusercontent.com
50	raw.githubusercontent.com
47	raw.githubusercontent.com
49	raw.githubusercontent.com
56	raw.githubusercontent.com
58	raw.githubusercontent.com
59	raw.githubusercontent.com
60	raw.githubusercontent.com
15	raw.githubusercontent.com
23	raw.githubusercontent.com
43	raw.githubusercontent.com
57	raw.githubusercontent.com
16	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\5b884080fd4f94	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2360	schtasks.exe
2308	schtasks.exe
1624	schtasks.exe
3528	schtasks.exe
3592	schtasks.exe
1284	schtasks.exe
628	schtasks.exe
5040	schtasks.exe
788	schtasks.exe
848	schtasks.exe
2220	schtasks.exe
2688	schtasks.exe
3792	schtasks.exe
3300	schtasks.exe
824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2684	DllCommonsvc.exe
4928	powershell.exe
4928	powershell.exe
3816	powershell.exe
3816	powershell.exe
3556	powershell.exe
3556	powershell.exe
3052	powershell.exe
3052	powershell.exe
2032	powershell.exe
2032	powershell.exe
4928	powershell.exe
1752	powershell.exe
1752	powershell.exe
3556	powershell.exe
3816	powershell.exe
2920	RuntimeBroker.exe
2920	RuntimeBroker.exe
3052	powershell.exe
2032	powershell.exe
1752	powershell.exe
4604	RuntimeBroker.exe
4776	RuntimeBroker.exe
4672	RuntimeBroker.exe
4564	RuntimeBroker.exe
3456	RuntimeBroker.exe
5100	RuntimeBroker.exe
1980	RuntimeBroker.exe
228	RuntimeBroker.exe
4840	RuntimeBroker.exe
2372	RuntimeBroker.exe
2976	RuntimeBroker.exe
4632	RuntimeBroker.exe
5016	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	DllCommonsvc.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	3556	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	2920	RuntimeBroker.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	4604	RuntimeBroker.exe
Token: SeDebugPrivilege	4776	RuntimeBroker.exe
Token: SeDebugPrivilege	4672	RuntimeBroker.exe
Token: SeDebugPrivilege	4564	RuntimeBroker.exe
Token: SeDebugPrivilege	3456	RuntimeBroker.exe
Token: SeDebugPrivilege	5100	RuntimeBroker.exe
Token: SeDebugPrivilege	1980	RuntimeBroker.exe
Token: SeDebugPrivilege	228	RuntimeBroker.exe
Token: SeDebugPrivilege	4840	RuntimeBroker.exe
Token: SeDebugPrivilege	2372	RuntimeBroker.exe
Token: SeDebugPrivilege	2976	RuntimeBroker.exe
Token: SeDebugPrivilege	4632	RuntimeBroker.exe
Token: SeDebugPrivilege	5016	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 5108	1216	34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73.exe	85
PID 1216 wrote to memory of 5108	1216	34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73.exe	85
PID 1216 wrote to memory of 5108	1216	34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73.exe	85
PID 5108 wrote to memory of 384	5108	WScript.exe	87
PID 5108 wrote to memory of 384	5108	WScript.exe	87
PID 5108 wrote to memory of 384	5108	WScript.exe	87
PID 384 wrote to memory of 2684	384	cmd.exe	89
PID 384 wrote to memory of 2684	384	cmd.exe	89
PID 2684 wrote to memory of 3052	2684	DllCommonsvc.exe	107
PID 2684 wrote to memory of 3052	2684	DllCommonsvc.exe	107
PID 2684 wrote to memory of 1752	2684	DllCommonsvc.exe	108
PID 2684 wrote to memory of 1752	2684	DllCommonsvc.exe	108
PID 2684 wrote to memory of 4928	2684	DllCommonsvc.exe	109
PID 2684 wrote to memory of 4928	2684	DllCommonsvc.exe	109
PID 2684 wrote to memory of 2032	2684	DllCommonsvc.exe	110
PID 2684 wrote to memory of 2032	2684	DllCommonsvc.exe	110
PID 2684 wrote to memory of 3816	2684	DllCommonsvc.exe	111
PID 2684 wrote to memory of 3816	2684	DllCommonsvc.exe	111
PID 2684 wrote to memory of 3556	2684	DllCommonsvc.exe	112
PID 2684 wrote to memory of 3556	2684	DllCommonsvc.exe	112
PID 2684 wrote to memory of 2920	2684	DllCommonsvc.exe	118
PID 2684 wrote to memory of 2920	2684	DllCommonsvc.exe	118
PID 2920 wrote to memory of 3852	2920	RuntimeBroker.exe	121
PID 2920 wrote to memory of 3852	2920	RuntimeBroker.exe	121
PID 3852 wrote to memory of 4996	3852	cmd.exe	123
PID 3852 wrote to memory of 4996	3852	cmd.exe	123
PID 3852 wrote to memory of 4604	3852	cmd.exe	130
PID 3852 wrote to memory of 4604	3852	cmd.exe	130
PID 4604 wrote to memory of 5112	4604	RuntimeBroker.exe	138
PID 4604 wrote to memory of 5112	4604	RuntimeBroker.exe	138
PID 5112 wrote to memory of 1656	5112	cmd.exe	140
PID 5112 wrote to memory of 1656	5112	cmd.exe	140
PID 5112 wrote to memory of 4776	5112	cmd.exe	142
PID 5112 wrote to memory of 4776	5112	cmd.exe	142
PID 4776 wrote to memory of 2472	4776	RuntimeBroker.exe	147
PID 4776 wrote to memory of 2472	4776	RuntimeBroker.exe	147
PID 2472 wrote to memory of 520	2472	cmd.exe	149
PID 2472 wrote to memory of 520	2472	cmd.exe	149
PID 2472 wrote to memory of 4672	2472	cmd.exe	151
PID 2472 wrote to memory of 4672	2472	cmd.exe	151
PID 4672 wrote to memory of 3384	4672	RuntimeBroker.exe	153
PID 4672 wrote to memory of 3384	4672	RuntimeBroker.exe	153
PID 3384 wrote to memory of 2360	3384	cmd.exe	155
PID 3384 wrote to memory of 2360	3384	cmd.exe	155
PID 3384 wrote to memory of 4564	3384	cmd.exe	157
PID 3384 wrote to memory of 4564	3384	cmd.exe	157
PID 4564 wrote to memory of 4884	4564	RuntimeBroker.exe	159
PID 4564 wrote to memory of 4884	4564	RuntimeBroker.exe	159
PID 4884 wrote to memory of 1680	4884	cmd.exe	161
PID 4884 wrote to memory of 1680	4884	cmd.exe	161
PID 4884 wrote to memory of 3456	4884	cmd.exe	164
PID 4884 wrote to memory of 3456	4884	cmd.exe	164
PID 3456 wrote to memory of 3080	3456	RuntimeBroker.exe	166
PID 3456 wrote to memory of 3080	3456	RuntimeBroker.exe	166
PID 3080 wrote to memory of 692	3080	cmd.exe	168
PID 3080 wrote to memory of 692	3080	cmd.exe	168
PID 3080 wrote to memory of 5100	3080	cmd.exe	170
PID 3080 wrote to memory of 5100	3080	cmd.exe	170
PID 5100 wrote to memory of 4688	5100	RuntimeBroker.exe	172
PID 5100 wrote to memory of 4688	5100	RuntimeBroker.exe	172
PID 4688 wrote to memory of 2964	4688	cmd.exe	174
PID 4688 wrote to memory of 2964	4688	cmd.exe	174
PID 4688 wrote to memory of 1980	4688	cmd.exe	176
PID 4688 wrote to memory of 1980	4688	cmd.exe	176

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73.exe
"C:\Users\Admin\AppData\Local\Temp\34b0b26326a10b9a3a18323ab9ec85d77110cea4135ca1e9c902aba4f2226e73.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:384
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\ssh\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3556
    - - C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2920
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z7DRyUOV59.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4996
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PCaGvPqXNx.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1656
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mxrgiezM67.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:520
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pkmftNZ3Wr.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2360
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1680
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FBcCl1WGSV.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:692
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OMiKQlKjHz.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2964
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat"
        20⤵
        
        PID:3468
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4420
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TDlQnvRVvY.bat"
        22⤵
        
        PID:848
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:3792
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat"
        24⤵
        
        PID:3108
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1680
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0PvuKmrV6l.bat"
        26⤵
        
        PID:2280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:212
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M53DwaTFc6.bat"
        28⤵
        
        PID:2272
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:5012
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1bQudXBuXp.bat"
        30⤵
        
        PID:3672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:992
        
        C:\Users\Public\Videos\RuntimeBroker.exe
        
        "C:\Users\Public\Videos\RuntimeBroker.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zfOrxS71E3.bat"
        32⤵
        
        PID:3460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Temp\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Temp\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\ssh\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Temp\0PvuKmrV6l.bat

Filesize
205B

MD5
882fa4c8045f693dfaa0a65fc4fd8178

SHA1
1ef52b7c3483164c5cde9a7cfee2e87ef4fd9d46

SHA256
f620e7acc1d992d4a51cd9dacd4beb2cea4e33b09632b864c217ccf00c677c92

SHA512
cc49ffbb56b1f3aa9ea0bf989af066449ccea4906cd983b285e911f9abd51f797e3a28415dc4cdabf19c1978c9e92d46fa888565dcf2444e3b6b0e90cfc9e4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1bQudXBuXp.bat

Filesize
205B

MD5
543450c0999736a5d878cc4af2d13afb

SHA1
291ee044767494f89b7bd9baca9825c263956029

SHA256
c25ff17d4c17b0a456c3f02ba52844158e7d6f67ad68330b8e6777ec0163ea79

SHA512
d1e0ad97ede06f8a1f039518afc10f2244a287f4c0dca4f68a600d4a7fc49ea9d9a2cc828148a0362f2b2990a72b664ad1d9955469258a7e592831402c9cc3c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat

Filesize
205B

MD5
80653bb32c863dbaaf7e38d9cfa79b42

SHA1
2bfdc0986c497920f9037657328b1a93a59a13c4

SHA256
0f97a5d6b3296a36b65ae105c974402ace12641b7feb4d5f6badf124270a159c

SHA512
b43a0e633462c98cf15e621ab8880f952ded1a9b07557a94bb2e2000853770273a8f5d21695940eb220651fd4420c1c9647d5dac678035d7e981f1ced2720c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBcCl1WGSV.bat

Filesize
205B

MD5
c7182a2a9967824cc92f08bce311d6f4

SHA1
5a732a4e25fbbd06be07c6b516a688f8e81508f8

SHA256
8a3f99ee618c0412336a388c37f20a8d5d15772bd6ca5e23525681b22e9be013

SHA512
8ffe73ba0600fcde1d69612a2bcfcb3449a1ea2ffe6edc938ab86b86d8e370a65cf51a577a7a12b7ac37023541df987b3dcdd4c3bd6993ed564648bc6be1a674

Download Submit
C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat

Filesize
205B

MD5
ea11aafbda39aa755ce53fdc00bb4ebc

SHA1
8f626af0da55513789accb3598f2b94e646c5bf1

SHA256
fddfc4351a7e5d22a59b872eb1ed08ae73b161d14b5d1068fb3665e0df1eaee5

SHA512
63b8378dd9b3dbaae50c3dac7b729ccf4b50fbec3fd90f9f23b652b87ce87978212a8cdbade6d488d23d2b8a6f31436f7bb246a4f7706ceba068b58ae0492620

Download Submit
C:\Users\Admin\AppData\Local\Temp\M53DwaTFc6.bat

Filesize
205B

MD5
a54d03572cea27aedc8b38a5371457b6

SHA1
fc5f0f36d222af927acc045f33da1896805beed7

SHA256
edb258c751346c128450d20b5dc0110a5ff0bf0c98fbe6584a631993b005c9e1

SHA512
236f790ef775229607adc5cb84c94830eacc0b0cabbba39ace537f99c7c0c45ea60340610e416f5e045076ffbc20ca530a9bb5cd29ebe2bb9b1ba680bb85d604

Download Submit
C:\Users\Admin\AppData\Local\Temp\OMiKQlKjHz.bat

Filesize
205B

MD5
220f69e3be35c9b1c837f040b0890139

SHA1
ac138850044ce84533031bb6ce45a98958ec6ea4

SHA256
fb2302a61a97525aeebafca6161b5c6f085cdc25b0982ead8f1d9a611cd62f53

SHA512
c4be3bfed1599bb39c3e734096714c51add14d60aeda0e2ebcdcded63cc4a00551018605fce56d0541c52ea2fdb0c091941c1334a82052e4630c0c4474fdf0f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCaGvPqXNx.bat

Filesize
205B

MD5
47c55e7615b8ec0e9a2132e7dd57d5da

SHA1
728fc99b32302ef0590e1449e3eb76b740b949aa

SHA256
af49650ce9ab3ac40ad62601bcb85e819bc6f34cf7db0a4d97885b9120d2ccc1

SHA512
ce81e898e540e29f4691abaebd274af001ac4e4c107604995eb8dbbcac8b5e5c26a22220db9f768d9e962b2de3d43b7511e2550048c57f854c9e8c4467a4a6ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\TDlQnvRVvY.bat

Filesize
205B

MD5
598bbe7449dd39c7943e767342acee65

SHA1
68588375f95a382419a750b2ddc3df18a79953a9

SHA256
786c6916179007ccdddbd8a2b6ae66ea440c3e906f37a27d9b91b0bc57633ee7

SHA512
fb28a778e9604f301920bbd1c7fb9d159155e30fbfe1875857f13b110b9b074e983705a468a78ca4644921d2176d3bf1e6199e44385acd4dac0df8fd3797f232

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z7DRyUOV59.bat

Filesize
205B

MD5
65dddc33247eac358ed5e7ea72061509

SHA1
0d29c735b4d497ab60b8eabf63148508115f1b3e

SHA256
97394303bdb6f5d0f98b3b242c8227f1d009978e21b942f6f6c272d748b782c1

SHA512
897b090df2149804110525a4615695f5c01c3bb544d1599472ff5f835af240e5051909736f943e8ad5ce55c19ab3ed703d4de5d7aa7d98cd4bc4cc70931fbc3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r2mq0c1t.gom.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat

Filesize
205B

MD5
1e865b563827809af0c82186f3616a10

SHA1
81e5d43447bd7ea86ac34f6d76b77e8d22cc18e9

SHA256
79c19aa75e9ff9a54f7d4a014421d121dbdc8ea8983f40ec8734f7a54c16780f

SHA512
d911d1af88d5bba38b8c127ec23db97bd6753fe9a6950688f5f2e0dc9ba8a0a803608a43923bdea43a11e99e0505f40e753946fc8a6484a34ba11a5ce6147558

Download Submit
C:\Users\Admin\AppData\Local\Temp\mxrgiezM67.bat

Filesize
205B

MD5
ec165ba0da2e4cf4db618b95b572860d

SHA1
f820f6555bb95e31f1917fb55edcfd459bd49841

SHA256
34d61c853897f7308b452b0fe545acdd31656996e211cd3933cb9712b74bfa2d

SHA512
6f399d95854c484bb296732595ffd16255729c27b5c26f276d4eb6718835ffc67517efd6a1cd8c5f50a1cf1ad6e81e28a7cbe0dae4cb8301770b1745289f4ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkmftNZ3Wr.bat

Filesize
205B

MD5
06b1c4b87e575dc8787dbc304b0fd3fa

SHA1
0623a7231df26eaa4a32bc85d2167fea78832df1

SHA256
e86035747ef8b7b96615f9039065bd5e53a4a8bba620b30d1b10fb99a1aa7116

SHA512
e370cc3e20c307a819a7bb4c04c8cc22984f1f3451bd0009047d1bb7ef4110ecda17c726cfee355ddccd81f2119873b83211670d7784d94439c5fc6248b38a3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zfOrxS71E3.bat

Filesize
205B

MD5
0fad9f0a4226937707f986a53a3c74ca

SHA1
c57d80b97f5fe040227e91f8098c671333719f71

SHA256
8115c6e7e01fcf963a9c675037388ea2a45591bf89bd1927876784ed38d076e2

SHA512
3258f33d757dda142c1338b5976b3c32bfc6b4bf8dbf1625d3bfabd03f0bb22864fb4cba5ed1ee78b2a92e4946266b90086d14827b89bc4d0911e215be3f72e1

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/228-157-0x000000001B5F0000-0x000000001B602000-memory.dmp

Filesize
72KB

Download
memory/2684-17-0x000000001BB60000-0x000000001BB6C000-memory.dmp

Filesize
48KB

Download
memory/2684-15-0x0000000003060000-0x000000000306C000-memory.dmp

Filesize
48KB

Download
memory/2684-16-0x0000000003070000-0x000000000307C000-memory.dmp

Filesize
48KB

Download
memory/2684-14-0x0000000003050000-0x0000000003062000-memory.dmp

Filesize
72KB

Download
memory/2684-13-0x0000000000F30000-0x0000000001040000-memory.dmp

Filesize
1.1MB

Download
memory/2684-12-0x00007FFB67563000-0x00007FFB67565000-memory.dmp

Filesize
8KB

Download
memory/2920-94-0x000000001AFF0000-0x000000001B002000-memory.dmp

Filesize
72KB

Download
memory/3456-138-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download
memory/3816-39-0x0000022033F00000-0x0000022033F22000-memory.dmp

Filesize
136KB

Download
memory/4840-164-0x000000001BBF0000-0x000000001BC02000-memory.dmp

Filesize
72KB

Download