dcrat | 0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc.exe
Size

1.3MB
MD5

7c2dc10b63a2ae06c8752d0ae3cbc3fa
SHA1

97cbad5e3a8a94ac6122322fbba0542b0f2a0303
SHA256

0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc
SHA512

0be6fa590f0ce0b38a7ac8c5f9f70b831aea8558ede26174b93e085f077f0f8f6f562c58851f6d2cfdcaa220f5cb8c4f7facd06213c9462b737d70edff095869
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2584	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2584	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c9f-10.dat	dcrat
behavioral2/memory/904-13-0x00000000000D0000-0x00000000001E0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1636	powershell.exe
5052	powershell.exe
4928	powershell.exe
1440	powershell.exe
1728	powershell.exe
2392	powershell.exe
1748	powershell.exe
3868	powershell.exe
2480	powershell.exe
3852	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	JaffaCakes118_0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe

Executes dropped EXE 13 IoCs

pid	Process
904	DllCommonsvc.exe
3060	winlogon.exe
2700	winlogon.exe
3824	winlogon.exe
4636	winlogon.exe
5084	winlogon.exe
836	winlogon.exe
2248	winlogon.exe
2376	winlogon.exe
1072	winlogon.exe
4372	winlogon.exe
4952	winlogon.exe
4860	winlogon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
51	raw.githubusercontent.com
52	raw.githubusercontent.com
24	raw.githubusercontent.com
25	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com
55	raw.githubusercontent.com
36	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\cc11b995f2a76d	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\TAPI\sppsvc.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\TAPI\sppsvc.exe	DllCommonsvc.exe
File created	C:\Windows\TAPI\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Windows\diagnostics\system\WindowsMediaPlayerPlayDVD\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\LanguageOverlayCache\Registry.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	JaffaCakes118_0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	winlogon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1532	schtasks.exe
924	schtasks.exe
2760	schtasks.exe
4160	schtasks.exe
3356	schtasks.exe
3588	schtasks.exe
4948	schtasks.exe
5004	schtasks.exe
4668	schtasks.exe
2476	schtasks.exe
2056	schtasks.exe
1524	schtasks.exe
1032	schtasks.exe
3556	schtasks.exe
2636	schtasks.exe
1752	schtasks.exe
4888	schtasks.exe
1312	schtasks.exe
1156	schtasks.exe
228	schtasks.exe
3940	schtasks.exe
5024	schtasks.exe
4852	schtasks.exe
2968	schtasks.exe
4380	schtasks.exe
1896	schtasks.exe
2064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
904	DllCommonsvc.exe
904	DllCommonsvc.exe
904	DllCommonsvc.exe
904	DllCommonsvc.exe
904	DllCommonsvc.exe
904	DllCommonsvc.exe
904	DllCommonsvc.exe
904	DllCommonsvc.exe
1440	powershell.exe
1440	powershell.exe
3852	powershell.exe
3852	powershell.exe
1748	powershell.exe
1748	powershell.exe
2392	powershell.exe
2392	powershell.exe
3868	powershell.exe
3868	powershell.exe
1636	powershell.exe
1636	powershell.exe
2480	powershell.exe
2480	powershell.exe
1728	powershell.exe
1728	powershell.exe
5052	powershell.exe
5052	powershell.exe
4928	powershell.exe
4928	powershell.exe
1728	powershell.exe
1440	powershell.exe
3852	powershell.exe
1748	powershell.exe
2392	powershell.exe
2480	powershell.exe
5052	powershell.exe
1636	powershell.exe
3868	powershell.exe
4928	powershell.exe
3060	winlogon.exe
2700	winlogon.exe
3824	winlogon.exe
4636	winlogon.exe
5084	winlogon.exe
836	winlogon.exe
2248	winlogon.exe
2376	winlogon.exe
1072	winlogon.exe
4372	winlogon.exe
4952	winlogon.exe
4860	winlogon.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	904	DllCommonsvc.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	3060	winlogon.exe
Token: SeDebugPrivilege	2700	winlogon.exe
Token: SeDebugPrivilege	3824	winlogon.exe
Token: SeDebugPrivilege	4636	winlogon.exe
Token: SeDebugPrivilege	5084	winlogon.exe
Token: SeDebugPrivilege	836	winlogon.exe
Token: SeDebugPrivilege	2248	winlogon.exe
Token: SeDebugPrivilege	2376	winlogon.exe
Token: SeDebugPrivilege	1072	winlogon.exe
Token: SeDebugPrivilege	4372	winlogon.exe
Token: SeDebugPrivilege	4952	winlogon.exe
Token: SeDebugPrivilege	4860	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 4476	3460	JaffaCakes118_0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc.exe	82
PID 3460 wrote to memory of 4476	3460	JaffaCakes118_0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc.exe	82
PID 3460 wrote to memory of 4476	3460	JaffaCakes118_0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc.exe	82
PID 4476 wrote to memory of 2180	4476	WScript.exe	83
PID 4476 wrote to memory of 2180	4476	WScript.exe	83
PID 4476 wrote to memory of 2180	4476	WScript.exe	83
PID 2180 wrote to memory of 904	2180	cmd.exe	85
PID 2180 wrote to memory of 904	2180	cmd.exe	85
PID 904 wrote to memory of 3852	904	DllCommonsvc.exe	114
PID 904 wrote to memory of 3852	904	DllCommonsvc.exe	114
PID 904 wrote to memory of 4928	904	DllCommonsvc.exe	115
PID 904 wrote to memory of 4928	904	DllCommonsvc.exe	115
PID 904 wrote to memory of 1440	904	DllCommonsvc.exe	116
PID 904 wrote to memory of 1440	904	DllCommonsvc.exe	116
PID 904 wrote to memory of 1728	904	DllCommonsvc.exe	117
PID 904 wrote to memory of 1728	904	DllCommonsvc.exe	117
PID 904 wrote to memory of 1636	904	DllCommonsvc.exe	118
PID 904 wrote to memory of 1636	904	DllCommonsvc.exe	118
PID 904 wrote to memory of 2392	904	DllCommonsvc.exe	119
PID 904 wrote to memory of 2392	904	DllCommonsvc.exe	119
PID 904 wrote to memory of 2480	904	DllCommonsvc.exe	120
PID 904 wrote to memory of 2480	904	DllCommonsvc.exe	120
PID 904 wrote to memory of 3868	904	DllCommonsvc.exe	121
PID 904 wrote to memory of 3868	904	DllCommonsvc.exe	121
PID 904 wrote to memory of 5052	904	DllCommonsvc.exe	122
PID 904 wrote to memory of 5052	904	DllCommonsvc.exe	122
PID 904 wrote to memory of 1748	904	DllCommonsvc.exe	123
PID 904 wrote to memory of 1748	904	DllCommonsvc.exe	123
PID 904 wrote to memory of 4868	904	DllCommonsvc.exe	134
PID 904 wrote to memory of 4868	904	DllCommonsvc.exe	134
PID 4868 wrote to memory of 1924	4868	cmd.exe	136
PID 4868 wrote to memory of 1924	4868	cmd.exe	136
PID 4868 wrote to memory of 3060	4868	cmd.exe	140
PID 4868 wrote to memory of 3060	4868	cmd.exe	140
PID 3060 wrote to memory of 3612	3060	winlogon.exe	144
PID 3060 wrote to memory of 3612	3060	winlogon.exe	144
PID 3612 wrote to memory of 3528	3612	cmd.exe	146
PID 3612 wrote to memory of 3528	3612	cmd.exe	146
PID 3612 wrote to memory of 2700	3612	cmd.exe	147
PID 3612 wrote to memory of 2700	3612	cmd.exe	147
PID 2700 wrote to memory of 3756	2700	winlogon.exe	149
PID 2700 wrote to memory of 3756	2700	winlogon.exe	149
PID 3756 wrote to memory of 784	3756	cmd.exe	151
PID 3756 wrote to memory of 784	3756	cmd.exe	151
PID 3756 wrote to memory of 3824	3756	cmd.exe	153
PID 3756 wrote to memory of 3824	3756	cmd.exe	153
PID 3824 wrote to memory of 3752	3824	winlogon.exe	154
PID 3824 wrote to memory of 3752	3824	winlogon.exe	154
PID 3752 wrote to memory of 2328	3752	cmd.exe	156
PID 3752 wrote to memory of 2328	3752	cmd.exe	156
PID 3752 wrote to memory of 4636	3752	cmd.exe	157
PID 3752 wrote to memory of 4636	3752	cmd.exe	157
PID 4636 wrote to memory of 2004	4636	winlogon.exe	158
PID 4636 wrote to memory of 2004	4636	winlogon.exe	158
PID 2004 wrote to memory of 3868	2004	cmd.exe	160
PID 2004 wrote to memory of 3868	2004	cmd.exe	160
PID 2004 wrote to memory of 5084	2004	cmd.exe	161
PID 2004 wrote to memory of 5084	2004	cmd.exe	161
PID 5084 wrote to memory of 216	5084	winlogon.exe	162
PID 5084 wrote to memory of 216	5084	winlogon.exe	162
PID 216 wrote to memory of 1332	216	cmd.exe	164
PID 216 wrote to memory of 1332	216	cmd.exe	164
PID 216 wrote to memory of 836	216	cmd.exe	165
PID 216 wrote to memory of 836	216	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0d3b5bc468d9cb483bcacea7c7da457b0647e193c1c517c83fcea6aaa00453bc.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Saved Games\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\11pfdvw2EI.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4868
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1924
      - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ANE2RWndQ4.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3528
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:784
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M2NHsv551y.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2328
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z4XVup0LT1.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3868
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7aJ3FmDw0K.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1332
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kp2dTY47HA.bat"
        17⤵
        
        PID:4800
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1136
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AWL6wsGpK7.bat"
        19⤵
        
        PID:4060
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4648
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hiVaTihpWK.bat"
        21⤵
        
        PID:4364
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4844
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat"
        23⤵
        
        PID:5012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:540
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2Odt5WJZ2f.bat"
        25⤵
        
        PID:4636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:752
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CSN9cxKiet.bat"
        27⤵
        
        PID:1916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:872
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\TAPI\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Saved Games\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Saved Games\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\AccountPictures\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\11pfdvw2EI.bat

Filesize
233B

MD5
268d41bfd84d453cd62090669fc8fd4c

SHA1
33e22f668d80183ab66ac21bc5fa8e6a8039fb76

SHA256
c4762eaf02bdf96ea4bf8f563f45fc1dfa6ce05e7a379e15665dac7293d166b4

SHA512
a68862a5f8cc667243a769a385e1339d4de4cf737f54c2f1c7211d17b9488097b6aebb454cac966d8003ffa87bff6f9c32687f484cf237d662c2d31f0c6c6ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2Odt5WJZ2f.bat

Filesize
233B

MD5
5780f6cf494d5fe45d455f1430d6d822

SHA1
bce7fbb00d4d04e0969e8c7bf4dbfda05a7585e1

SHA256
23333d96ab438dc13f80cbe0fc04e2e326d76ff6f90668cdd28fade5dcdb7bca

SHA512
6d16bc3daca729515eb6978fcb3cc443918a1c8c033bf861fbf6ea91d9ac9f083afe11eba4335295fc3f25e219f1ff2e7ab29b5077f293cd8348562b901f58cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7aJ3FmDw0K.bat

Filesize
233B

MD5
08efbb140dffda7d74bc2ac06bbb5991

SHA1
a0e5da0dcf20e2440d41654df39c9a0d80890456

SHA256
546dab81597302c7e088276e5f793bafacc8c3be4475d03491fa4a0e40cb49f6

SHA512
6ddcf92cbcefa5afce92977d6d8159b69c0de7605a43145d8e94170e8813d7c69f62ca50a70c5e21df05bf39e0123cdf2b5acd17080866cf7963dd69dfc0ca88

Download Submit
C:\Users\Admin\AppData\Local\Temp\ANE2RWndQ4.bat

Filesize
233B

MD5
a003dbd8b83c4579eda0a3da3e6f3de3

SHA1
24751c0938ba9091568229337113e64d14e30662

SHA256
03b54196b8472c07031faa5270bd5f1885ce73e29559feb16ac3be0e43dc19d9

SHA512
0d33f0ca4af83728068beb243753a8751af037e90f3bcc205a0245e97748471744c5fbb7bbfb7d66b671a2cca444416b6c7ebcd2cd3c13e3350b5bdc9a7cfbaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\AWL6wsGpK7.bat

Filesize
233B

MD5
65be99547b1e8f04e69c02202ee105d3

SHA1
1a1dde6c4c9fa220c40ef73bd36f6ddeb5cd8e60

SHA256
f5e37f7f72ebeab948e172e2963834fe69de57f60359d952d9f859f39efc94f5

SHA512
7d8d289591b3ec2fb7d07529b18aff97a9c746609b85940e1d5ced8f869a5ac29a8f894cb01a96bd4d92412a812b0fa6ee44b47c55d4712b298950ca2272da2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CSN9cxKiet.bat

Filesize
233B

MD5
37e6d1b6061c6817fbb1eb4a9d9553c8

SHA1
a68a058f96f665368c65d9d14e65f328b4abdecb

SHA256
bb9bfef9009251caff4d79fbb098ab94c9649e9afc17424aa03fb693259a2680

SHA512
f457c18017e2edfb1309c59f98b6489f46f2f1603a5d65c2c22defabb7bcdeff8ac8467a68c367654a6419cec62a95336ae5fe6795fc9fc5cdf75990af3e0086

Download Submit
C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat

Filesize
233B

MD5
a7d981e34a1a655ce38984cbd1f4ab2f

SHA1
ef697fec6a48b665ec5fc7033e4959efef01f3a7

SHA256
b50c1a8e0f749a734b6db1d150af86849fb14b275bbc4fa54e415973a517d4d5

SHA512
7cf03f3ef37dd28981fd09a3c6d40ebce1ea996af696280d9475dc2739e0b239567d4399490ab9ab12dda6dd90f97616b651c52a4260977d8582954e941abbd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\M2NHsv551y.bat

Filesize
233B

MD5
3b5fcb75d1e3f0e362d3e4640019fc9d

SHA1
19f144904336a8578ef12a507cfcb540b1107e8c

SHA256
139f589b6105f5b035b5694d295bc89086b2de3be5afa1091a707cd971c1587a

SHA512
bf7879efb16e46be48e81fb8b747a30964574c3255007cc4fc7cb341364f7b18d185662b2f8ed5be31de27651652e544ab90c1aa70a945a2fce8782dc94c43f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat

Filesize
233B

MD5
e513b366f06c92911f5fa885444425ec

SHA1
7ee0294c0d01ce71ea15bb0dd97914683e862da9

SHA256
bdc1870e2d68a19cc36fe2f1761b2ec8c26c0310b942fa856d2c953c4a885ca5

SHA512
c2473b63edd449c54afe7e6c84f9b85a969351ef0c48770bef75ef64d63c656c1dea939bd85ccda5245c7911be33b2c86ef9f7c058a86a50673d9a9bf02b1f5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z4XVup0LT1.bat

Filesize
233B

MD5
679adaca5e2b733ecdc0335674ba10f7

SHA1
f11dba9ec07fa0f8225639938f22c79ee51951b5

SHA256
3c938a379220a3739a1edda8a6566f1a1d68216d464704ba9d614d5a66b29aa3

SHA512
987c37acd1c3bffdf303c2782c93a3d665cc260d7cf2e9be46f7c5c6d3b0c50803ea4c2ed498061d3860e24efb3009def65e58d8c4833e4a36a587eac111c619

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_niwfilrl.jal.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\hiVaTihpWK.bat

Filesize
233B

MD5
3a5d4afffcebd17b86f2fa7e0beb8278

SHA1
6870779db60b1a8a84fc9f49f799271acde75fa1

SHA256
d88fd47c5b03579464fc2773071c53fb6a7cd534d22c58c57f9155445929d83c

SHA512
cdad4ac4cf7d864f0a5156f652a1ba8fc12fc1f9c3d86adac1e56a59a3828d4e5e5084e4a958119eafae81ac5b551ac44fd33b4c40aa4177f6fb7f0118ce8305

Download Submit
C:\Users\Admin\AppData\Local\Temp\kp2dTY47HA.bat

Filesize
233B

MD5
4172a19e1d6414ab7e75a21e691f1079

SHA1
df51001053fbb5ae832d420e28220042129a924d

SHA256
aaf8b854795062ae651d3565774b778903662324d535ea3a139b277483cfc5f8

SHA512
388d5d7df4822a7f09364f70ba79bf4bedea82974dfd853c86355490b5576c94fa87121d15d0f7a0e856d13167c2b5aa5c7d53c4c0ef4a5d7f729d7966a66258

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/836-196-0x00000000027E0000-0x00000000027F2000-memory.dmp

Filesize
72KB

Download
memory/904-12-0x00007FFEAEAB3000-0x00007FFEAEAB5000-memory.dmp

Filesize
8KB

Download
memory/904-13-0x00000000000D0000-0x00000000001E0000-memory.dmp

Filesize
1.1MB

Download
memory/904-14-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/904-15-0x0000000002360000-0x000000000236C000-memory.dmp

Filesize
48KB

Download
memory/904-16-0x0000000002370000-0x000000000237C000-memory.dmp

Filesize
48KB

Download
memory/904-17-0x0000000002390000-0x000000000239C000-memory.dmp

Filesize
48KB

Download
memory/1440-50-0x0000022AFA1D0000-0x0000022AFA1F2000-memory.dmp

Filesize
136KB

Download
memory/2248-207-0x000000001C900000-0x000000001CA6A000-memory.dmp

Filesize
1.4MB

Download
memory/2248-208-0x000000001CA70000-0x000000001CC19000-memory.dmp

Filesize
1.7MB

Download
memory/2376-211-0x0000000000D20000-0x0000000000D32000-memory.dmp

Filesize
72KB

Download
memory/2700-166-0x00000000010E0000-0x00000000010F2000-memory.dmp

Filesize
72KB

Download
memory/2700-171-0x000000001C320000-0x000000001C48A000-memory.dmp

Filesize
1.4MB

Download
memory/3060-162-0x000000001BEA0000-0x000000001C00A000-memory.dmp

Filesize
1.4MB

Download
memory/3824-174-0x000000001B7F0000-0x000000001B802000-memory.dmp

Filesize
72KB

Download
memory/3824-179-0x000000001C5C0000-0x000000001C72A000-memory.dmp

Filesize
1.4MB

Download
memory/4636-186-0x000000001C130000-0x000000001C29A000-memory.dmp

Filesize
1.4MB

Download
memory/4952-230-0x0000000003020000-0x0000000003032000-memory.dmp

Filesize
72KB

Download
memory/5084-193-0x000000001C270000-0x000000001C3DA000-memory.dmp

Filesize
1.4MB

Download