dcrat | a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe
Size

1.3MB
MD5

66fe2500cfcdbbc54c1cab06d5bf90be
SHA1

e6fec893d4c341e2a8ecaa8e970ba22d3ba8afbe
SHA256

a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551
SHA512

4d0308539d8df123d5fa9af2945ef0109b0b06fe4172f63f34ef316343708a1ba6271e2a71a4098d6510aaaa1b7dcbb245505fde13b8a6c81736da90ab89110a
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	3772	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	3772	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b89-9.dat	dcrat
behavioral2/memory/384-13-0x0000000000440000-0x0000000000550000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4168	powershell.exe
4792	powershell.exe
4856	powershell.exe
3292	powershell.exe
4632	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	spoolsv.exe

Executes dropped EXE 16 IoCs

pid	Process
384	DllCommonsvc.exe
3928	spoolsv.exe
1400	spoolsv.exe
588	spoolsv.exe
5080	spoolsv.exe
3676	spoolsv.exe
4860	spoolsv.exe
4040	spoolsv.exe
3452	spoolsv.exe
2224	spoolsv.exe
4852	spoolsv.exe
1820	spoolsv.exe
1584	spoolsv.exe
3612	spoolsv.exe
3732	spoolsv.exe
3984	spoolsv.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
43	raw.githubusercontent.com
17	raw.githubusercontent.com
38	raw.githubusercontent.com
40	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
24	raw.githubusercontent.com
45	raw.githubusercontent.com
53	raw.githubusercontent.com
39	raw.githubusercontent.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com
18	raw.githubusercontent.com
44	raw.githubusercontent.com
46	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\6cb0b6c459d5d3	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\twain_32\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\twain_32\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Windows\ServiceState\EventLog\Data\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\twain_32\spoolsv.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	spoolsv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3476	schtasks.exe
2524	schtasks.exe
100	schtasks.exe
3992	schtasks.exe
220	schtasks.exe
2944	schtasks.exe
1568	schtasks.exe
4340	schtasks.exe
1840	schtasks.exe
1400	schtasks.exe
4052	schtasks.exe
4468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
384	DllCommonsvc.exe
3292	powershell.exe
4856	powershell.exe
4792	powershell.exe
4632	powershell.exe
4168	powershell.exe
4168	powershell.exe
3928	spoolsv.exe
4856	powershell.exe
4632	powershell.exe
3292	powershell.exe
4792	powershell.exe
1400	spoolsv.exe
588	spoolsv.exe
5080	spoolsv.exe
3676	spoolsv.exe
4860	spoolsv.exe
4040	spoolsv.exe
3452	spoolsv.exe
2224	spoolsv.exe
4852	spoolsv.exe
1820	spoolsv.exe
1584	spoolsv.exe
3612	spoolsv.exe
3732	spoolsv.exe
3984	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	DllCommonsvc.exe
Token: SeDebugPrivilege	3292	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	3928	spoolsv.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	1400	spoolsv.exe
Token: SeDebugPrivilege	588	spoolsv.exe
Token: SeDebugPrivilege	5080	spoolsv.exe
Token: SeDebugPrivilege	3676	spoolsv.exe
Token: SeDebugPrivilege	4860	spoolsv.exe
Token: SeDebugPrivilege	4040	spoolsv.exe
Token: SeDebugPrivilege	3452	spoolsv.exe
Token: SeDebugPrivilege	2224	spoolsv.exe
Token: SeDebugPrivilege	4852	spoolsv.exe
Token: SeDebugPrivilege	1820	spoolsv.exe
Token: SeDebugPrivilege	1584	spoolsv.exe
Token: SeDebugPrivilege	3612	spoolsv.exe
Token: SeDebugPrivilege	3732	spoolsv.exe
Token: SeDebugPrivilege	3984	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4428	3528	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe	83
PID 3528 wrote to memory of 4428	3528	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe	83
PID 3528 wrote to memory of 4428	3528	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe	83
PID 4428 wrote to memory of 396	4428	WScript.exe	84
PID 4428 wrote to memory of 396	4428	WScript.exe	84
PID 4428 wrote to memory of 396	4428	WScript.exe	84
PID 396 wrote to memory of 384	396	cmd.exe	86
PID 396 wrote to memory of 384	396	cmd.exe	86
PID 384 wrote to memory of 4168	384	DllCommonsvc.exe	101
PID 384 wrote to memory of 4168	384	DllCommonsvc.exe	101
PID 384 wrote to memory of 4792	384	DllCommonsvc.exe	102
PID 384 wrote to memory of 4792	384	DllCommonsvc.exe	102
PID 384 wrote to memory of 4632	384	DllCommonsvc.exe	103
PID 384 wrote to memory of 4632	384	DllCommonsvc.exe	103
PID 384 wrote to memory of 3292	384	DllCommonsvc.exe	104
PID 384 wrote to memory of 3292	384	DllCommonsvc.exe	104
PID 384 wrote to memory of 4856	384	DllCommonsvc.exe	105
PID 384 wrote to memory of 4856	384	DllCommonsvc.exe	105
PID 384 wrote to memory of 3928	384	DllCommonsvc.exe	110
PID 384 wrote to memory of 3928	384	DllCommonsvc.exe	110
PID 3928 wrote to memory of 1088	3928	spoolsv.exe	118
PID 3928 wrote to memory of 1088	3928	spoolsv.exe	118
PID 1088 wrote to memory of 3720	1088	cmd.exe	120
PID 1088 wrote to memory of 3720	1088	cmd.exe	120
PID 1088 wrote to memory of 1400	1088	cmd.exe	127
PID 1088 wrote to memory of 1400	1088	cmd.exe	127
PID 1400 wrote to memory of 4928	1400	spoolsv.exe	129
PID 1400 wrote to memory of 4928	1400	spoolsv.exe	129
PID 4928 wrote to memory of 3452	4928	cmd.exe	131
PID 4928 wrote to memory of 3452	4928	cmd.exe	131
PID 4928 wrote to memory of 588	4928	cmd.exe	136
PID 4928 wrote to memory of 588	4928	cmd.exe	136
PID 588 wrote to memory of 4568	588	spoolsv.exe	138
PID 588 wrote to memory of 4568	588	spoolsv.exe	138
PID 4568 wrote to memory of 1860	4568	cmd.exe	140
PID 4568 wrote to memory of 1860	4568	cmd.exe	140
PID 4568 wrote to memory of 5080	4568	cmd.exe	142
PID 4568 wrote to memory of 5080	4568	cmd.exe	142
PID 5080 wrote to memory of 1508	5080	spoolsv.exe	144
PID 5080 wrote to memory of 1508	5080	spoolsv.exe	144
PID 1508 wrote to memory of 3644	1508	cmd.exe	146
PID 1508 wrote to memory of 3644	1508	cmd.exe	146
PID 1508 wrote to memory of 3676	1508	cmd.exe	148
PID 1508 wrote to memory of 3676	1508	cmd.exe	148
PID 3676 wrote to memory of 2960	3676	spoolsv.exe	150
PID 3676 wrote to memory of 2960	3676	spoolsv.exe	150
PID 2960 wrote to memory of 4148	2960	cmd.exe	152
PID 2960 wrote to memory of 4148	2960	cmd.exe	152
PID 2960 wrote to memory of 4860	2960	cmd.exe	154
PID 2960 wrote to memory of 4860	2960	cmd.exe	154
PID 4860 wrote to memory of 4324	4860	spoolsv.exe	156
PID 4860 wrote to memory of 4324	4860	spoolsv.exe	156
PID 4324 wrote to memory of 3228	4324	cmd.exe	158
PID 4324 wrote to memory of 3228	4324	cmd.exe	158
PID 4324 wrote to memory of 4040	4324	cmd.exe	160
PID 4324 wrote to memory of 4040	4324	cmd.exe	160
PID 4040 wrote to memory of 880	4040	spoolsv.exe	162
PID 4040 wrote to memory of 880	4040	spoolsv.exe	162
PID 880 wrote to memory of 4872	880	cmd.exe	164
PID 880 wrote to memory of 4872	880	cmd.exe	164
PID 880 wrote to memory of 3452	880	cmd.exe	166
PID 880 wrote to memory of 3452	880	cmd.exe	166
PID 3452 wrote to memory of 3732	3452	spoolsv.exe	168
PID 3452 wrote to memory of 3732	3452	spoolsv.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe
"C:\Users\Admin\AppData\Local\Temp\a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
    - - C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3928
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\owZfSNRP11.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3720
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3452
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CPbxFudqw6.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1860
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zi4n06VBpB.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3644
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4148
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0tZmJrpaGF.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3228
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UJpHfzfs2i.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4872
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L9j9zErPDE.bat"
        20⤵
        
        PID:3732
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2528
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i0MStmnXAe.bat"
        22⤵
        
        PID:2812
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:3200
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0ZxjVk2zv8.bat"
        24⤵
        
        PID:3536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:220
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RBIFf9IaIr.bat"
        26⤵
        
        PID:4428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:232
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VAhDAdBh8f.bat"
        28⤵
        
        PID:4128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2120
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BYj1kG62r9.bat"
        30⤵
        
        PID:4480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:1416
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b6uRiEqY03.bat"
        32⤵
        
        PID:2208
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:2252
        
        C:\Windows\twain_32\spoolsv.exe
        
        "C:\Windows\twain_32\spoolsv.exe"
        33⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\twain_32\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\twain_32\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
2d45daa9e9acea96d8a2cadfd38aeb47

SHA1
a1d49dfe3b7ff32a914f4e5c6fca696878d7227c

SHA256
96341c1835589a0a0075c7cae08feb06a96c1a125fdbc650effc39b8ae36fbf5

SHA512
b6228fa8931b8a5bb5fba99ff706bb77aa21cfc03248c5d208c24e2a141c8cb79b4988eadf985441fa9d02e9525589ab69335315d604994a33ec92fe640731f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\0ZxjVk2zv8.bat

Filesize
196B

MD5
89b54215358309ffe98c89ba3af88552

SHA1
c9a2add579c75742d1363e96dc4314991a120019

SHA256
6b2169b02a4001b94a32ea0eef72650e5073ee2f2b630552863c2e066d897055

SHA512
1c1353dc0d50c968d5962b378399daab5eebbe9a188611d30d019d0680d88ae5cb7c0ae4e0cdca1d8064da90506ab3e4fc2c2beefddcdedaee7e1a79bd3b0300

Download Submit
C:\Users\Admin\AppData\Local\Temp\0tZmJrpaGF.bat

Filesize
196B

MD5
072ca157b1e3f0dd31d97410cfbcb7e6

SHA1
de9f2285a47acab5f5fed9666d5e2baec23585f2

SHA256
dc4cb1271af216895294a61d366e2cc805c9a57c0605dec03dc1eb7d4f24b40e

SHA512
770c6dc6eec45b6be9b473911d5e5f7903e1f00d70e030abb4efedcfe513cc95d1552015e0523621da96fefdaa55a31e2e6080f8e892284951310c14c70b040a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e6qhBZ49x.bat

Filesize
196B

MD5
0d45d6d63761a073fd7f0fe98f8b63d8

SHA1
b8c1af46dd0a57a02b36ced923518495fd8f1556

SHA256
24fd95f201f384796a2a97ebb83bc462e15293c19e857b52972fe2c4f999722b

SHA512
a7545d6c61aa580a364a46ea14c531e55542ee779924f5c7c363383b9b86a86889a7b42a29180c8b2afb3fb1e3d13a32d99b7b4d5ccb5254f18845658e94932b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BYj1kG62r9.bat

Filesize
196B

MD5
fa486165ad45b4d071de16bc8be21bdf

SHA1
65e25155f20976b07ee58ddb4ad668937143451d

SHA256
c6244c70f7da132fb3d89f6b2065d1fd59fc454df1252357bd8c2064a7ae1ebe

SHA512
93990daf5531244656c37569d360fdcf74b55426ed2d5afcc0ed8978520139464d032be19dd405beed074ba5c94a0a2efbc1f61587220d493ecb70845db27990

Download Submit
C:\Users\Admin\AppData\Local\Temp\CPbxFudqw6.bat

Filesize
196B

MD5
6c32cf88acfb00cadeb4ff4ad7122ffc

SHA1
09310064ad6bbbc1ac6bfb6cbf9c3ac2f20d82b2

SHA256
25c96c296d8a8115e15fc698525fba97528a0df019593d305ea6a78e8e4858fc

SHA512
1248169ece299d4755f41b02c1e9f93b09f31caffaa0cbe8ea44f617da447a15584e2d80784afc027fc0df7e8c4546d2a5953f250b6586f336b5891744376558

Download Submit
C:\Users\Admin\AppData\Local\Temp\L9j9zErPDE.bat

Filesize
196B

MD5
444226b860d922b9c3df557ece12a96b

SHA1
7f8e78c6141a48434f2bc35a3b037df347a516fa

SHA256
e1d85db16caaca80385a21c4ea8e5486558c34f88e97933549f25cf9790654f7

SHA512
ccce3e6416a95ee814f87b5f3532825f970d650b2e4b1eb8e97f3b350ceba414f62c6a0e73a9fe17101d4acd0b71dbc3f34941820e44846e6d3234f3f1e1ccf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RBIFf9IaIr.bat

Filesize
196B

MD5
2e0b00675b978b1b80acfdc9718b6f97

SHA1
d0e218bf68947d78fe07adcaafb45d3871cb0f2a

SHA256
d293f54f6d07534b6f28e332698345269067d4493a8d117aceef8f1270a5fa1d

SHA512
b93a3274e530e63c198cbb00fb18c73ee8179ec87ee2b104c36eea02ebcfc5a4bd6a095bc1452429df56cedd30616ef345ae9885457515d383f5082e1587c2d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\UJpHfzfs2i.bat

Filesize
196B

MD5
bbcff9d3fcfcb612301063d85d4732d1

SHA1
e0b60fd41b58fa4070033e23dea24068d947316e

SHA256
8eac6b4f9c8d9f224a93f36af48177403d44444407d8269ce82229f29ca62e77

SHA512
78ed7896e516548139febcba64ae575896dd289ffa6f34d3f7349b693e062e714cfdad1f199721be3c71ce556a0119035547c31347fbe5ab1f133755ff93d383

Download Submit
C:\Users\Admin\AppData\Local\Temp\VAhDAdBh8f.bat

Filesize
196B

MD5
dd9f44b16cb65c643fbcbc4dddfbfe6b

SHA1
47b46d82efadae0c54ec0d6ca64093babb69fcc4

SHA256
1a7339e126adbede88b09d141c2136c7fb590de8d48445cbab71c979361b79ea

SHA512
3c390da6ac79b76fc302c90d17d4d535ee8de7b7591cdccfdd627a4f65787235316d476fcf9b98569bece3383afe0c3ba0672e62a027242d9e940c6b2446d788

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x5cbraa4.q3y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6uRiEqY03.bat

Filesize
196B

MD5
047e7074b495498f6c9880633d7c5eaa

SHA1
f7aee77b4f35e438fc13432dd61d3dd67cec4910

SHA256
c12894b2655ffe71e61c96f720cf19526e6e54c6e3c02ae968092c5f72dd2fde

SHA512
a1f3caa8f5587e3a51a1f175c47606f1bd92dabe5914a7d88a706a03fea415320e285802551666fa7b28b47cead5a60f5ca62b0cdbbdc1fb4fdd37b89b1c21ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\i0MStmnXAe.bat

Filesize
196B

MD5
adb13136c73b26788a226a8334c6491d

SHA1
bcbedce2f742b26f7037cd7816c7762d990d4a1c

SHA256
a4f163c4ffb4c879b5cfa102251653f82b1df419d524bc1b447af4ec811bfb1c

SHA512
5bc7976c7cbceb1b9ffd446b68277fade6ddffd025b31c867dc31df46e3c7a59093329ff9442e82f34e6e02feabd527d99ef93291fe75e2047efb53f85c656c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\owZfSNRP11.bat

Filesize
196B

MD5
a154d1c95057a927a24b05f6c4df03fb

SHA1
33204d9abb1112c8f612efcb6f21cc3608e7967e

SHA256
37f9f305ba37cbdfb2d9e0f0cb84f0e0ad2542aa8b488fb4af57aa4f6e35ebea

SHA512
9a03e6af8ec70fb62159823c10ebc86ae49df2717846428ec622b62e6b526ef56e507ae60707804acfa30a58e2756acc485f726c032deae4f81df0271240a93a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat

Filesize
196B

MD5
7c5fdb3d49411ec3842dba28830e0bd6

SHA1
196a5cd632754efa2ef53a675f36414505f8b3e0

SHA256
2319d986ddabf6a75ff961bb754707a1ddc474b7c8dc477b326cb3d98c0b4515

SHA512
b37743c06cb0da23118311214a049a56557c7c00b1fbbbb74895d95c09fc9a91581966bba5202f51105c40c82e9b60b679c2587417be63a8f8fedfdcc5721165

Download Submit
C:\Users\Admin\AppData\Local\Temp\zi4n06VBpB.bat

Filesize
196B

MD5
74e58bd1f1ede87330794e5ad8f8d282

SHA1
90ce5a28794ec9fd849c3fd29507aec54b318ed1

SHA256
db83d935b9cd36a99374258f46d640d1e1bdd1820cec7f864ac1b5aad839ecc0

SHA512
30124c8dfdc859f235a38e438a48b0c6ab4e65df8b51ad192ca040d1db60747f9b64fc544775a96f3f6936459800b71b846fa2d00461b897a9286cb925ae983e

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/384-13-0x0000000000440000-0x0000000000550000-memory.dmp

Filesize
1.1MB

Download
memory/384-12-0x00007FFE10183000-0x00007FFE10185000-memory.dmp

Filesize
8KB

Download
memory/384-14-0x0000000002760000-0x0000000002772000-memory.dmp

Filesize
72KB

Download
memory/384-15-0x0000000002780000-0x000000000278C000-memory.dmp

Filesize
48KB

Download
memory/384-16-0x0000000002770000-0x000000000277C000-memory.dmp

Filesize
48KB

Download
memory/384-17-0x0000000002790000-0x000000000279C000-memory.dmp

Filesize
48KB

Download
memory/588-109-0x0000000000B00000-0x0000000000B12000-memory.dmp

Filesize
72KB

Download
memory/1400-106-0x000000001BF30000-0x000000001C09A000-memory.dmp

Filesize
1.4MB

Download
memory/1584-173-0x000000001C2A0000-0x000000001C40A000-memory.dmp

Filesize
1.4MB

Download
memory/1820-166-0x000000001BE40000-0x000000001BFAA000-memory.dmp

Filesize
1.4MB

Download
memory/3292-42-0x000001E1F0050000-0x000001E1F0072000-memory.dmp

Filesize
136KB

Download
memory/3612-180-0x000000001BD00000-0x000000001BE6A000-memory.dmp

Filesize
1.4MB

Download
memory/3676-123-0x0000000001650000-0x0000000001662000-memory.dmp

Filesize
72KB

Download
memory/3732-183-0x0000000000AA0000-0x0000000000AB2000-memory.dmp

Filesize
72KB

Download
memory/3732-188-0x000000001BDE0000-0x000000001BF89000-memory.dmp

Filesize
1.7MB

Download
memory/4040-136-0x00000000011A0000-0x00000000011B2000-memory.dmp

Filesize
72KB

Download
memory/4852-159-0x000000001CA00000-0x000000001CBA9000-memory.dmp

Filesize
1.7MB

Download
memory/5080-116-0x0000000000B90000-0x0000000000BA2000-memory.dmp

Filesize
72KB

Download