dcrat | d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5.exe
Size

1.3MB
MD5

3b901ad8a508e56be9e9453085f6cdd3
SHA1

4fd624efe04557c69fba0bbad5ce156ba7e1d4ed
SHA256

d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5
SHA512

b693d6e6db976fbde730191ee73ac3d9fa48c6fc9e9cf663af951fcdf6895ed15d5c6b51e14e9d6a136b71499a5564d94b16b5edd58bfd4150c09c51ab4dcbba
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2140	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2140	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023ca0-10.dat	dcrat
behavioral2/memory/1412-13-0x0000000000520000-0x0000000000630000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3012	powershell.exe
3720	powershell.exe
2896	powershell.exe
1272	powershell.exe
2692	powershell.exe
3512	powershell.exe
4224	powershell.exe
784	powershell.exe
4952	powershell.exe
1352	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	JaffaCakes118_d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Registry.exe

Executes dropped EXE 13 IoCs

pid	Process
1412	DllCommonsvc.exe
2708	Registry.exe
2872	Registry.exe
1940	Registry.exe
4660	Registry.exe
1696	Registry.exe
3704	Registry.exe
4856	Registry.exe
4944	Registry.exe
4408	Registry.exe
4040	Registry.exe
4756	Registry.exe
1200	Registry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
49	raw.githubusercontent.com
50	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
37	raw.githubusercontent.com
38	raw.githubusercontent.com
47	raw.githubusercontent.com
51	raw.githubusercontent.com
15	raw.githubusercontent.com
39	raw.githubusercontent.com
42	raw.githubusercontent.com
43	raw.githubusercontent.com
48	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\ebf1f9fa8afd6d	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Offline Web Pages\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	JaffaCakes118_d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Registry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4844	schtasks.exe
2788	schtasks.exe
1688	schtasks.exe
4900	schtasks.exe
1252	schtasks.exe
1564	schtasks.exe
2940	schtasks.exe
2964	schtasks.exe
4184	schtasks.exe
4696	schtasks.exe
2012	schtasks.exe
664	schtasks.exe
1668	schtasks.exe
3068	schtasks.exe
4148	schtasks.exe
2516	schtasks.exe
1800	schtasks.exe
2660	schtasks.exe
1616	schtasks.exe
2068	schtasks.exe
3640	schtasks.exe
4376	schtasks.exe
1444	schtasks.exe
1552	schtasks.exe
3540	schtasks.exe
4920	schtasks.exe
2108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1412	DllCommonsvc.exe
1412	DllCommonsvc.exe
1412	DllCommonsvc.exe
1412	DllCommonsvc.exe
1412	DllCommonsvc.exe
1412	DllCommonsvc.exe
1412	DllCommonsvc.exe
1412	DllCommonsvc.exe
1412	DllCommonsvc.exe
784	powershell.exe
784	powershell.exe
4952	powershell.exe
4952	powershell.exe
2896	powershell.exe
2896	powershell.exe
1352	powershell.exe
1352	powershell.exe
1272	powershell.exe
1272	powershell.exe
3720	powershell.exe
3720	powershell.exe
2692	powershell.exe
2692	powershell.exe
3012	powershell.exe
3012	powershell.exe
3512	powershell.exe
3512	powershell.exe
4224	powershell.exe
4224	powershell.exe
3720	powershell.exe
2708	Registry.exe
2708	Registry.exe
4224	powershell.exe
1272	powershell.exe
784	powershell.exe
4952	powershell.exe
2896	powershell.exe
1352	powershell.exe
3012	powershell.exe
3512	powershell.exe
2692	powershell.exe
2872	Registry.exe
1940	Registry.exe
4660	Registry.exe
1696	Registry.exe
3704	Registry.exe
4856	Registry.exe
4944	Registry.exe
4408	Registry.exe
4040	Registry.exe
4756	Registry.exe
1200	Registry.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	DllCommonsvc.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	2708	Registry.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	2872	Registry.exe
Token: SeDebugPrivilege	1940	Registry.exe
Token: SeDebugPrivilege	4660	Registry.exe
Token: SeDebugPrivilege	1696	Registry.exe
Token: SeDebugPrivilege	3704	Registry.exe
Token: SeDebugPrivilege	4856	Registry.exe
Token: SeDebugPrivilege	4944	Registry.exe
Token: SeDebugPrivilege	4408	Registry.exe
Token: SeDebugPrivilege	4040	Registry.exe
Token: SeDebugPrivilege	4756	Registry.exe
Token: SeDebugPrivilege	1200	Registry.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2232	4196	JaffaCakes118_d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5.exe	83
PID 4196 wrote to memory of 2232	4196	JaffaCakes118_d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5.exe	83
PID 4196 wrote to memory of 2232	4196	JaffaCakes118_d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5.exe	83
PID 2232 wrote to memory of 2740	2232	WScript.exe	85
PID 2232 wrote to memory of 2740	2232	WScript.exe	85
PID 2232 wrote to memory of 2740	2232	WScript.exe	85
PID 2740 wrote to memory of 1412	2740	cmd.exe	87
PID 2740 wrote to memory of 1412	2740	cmd.exe	87
PID 1412 wrote to memory of 3012	1412	DllCommonsvc.exe	117
PID 1412 wrote to memory of 3012	1412	DllCommonsvc.exe	117
PID 1412 wrote to memory of 3720	1412	DllCommonsvc.exe	118
PID 1412 wrote to memory of 3720	1412	DllCommonsvc.exe	118
PID 1412 wrote to memory of 4224	1412	DllCommonsvc.exe	119
PID 1412 wrote to memory of 4224	1412	DllCommonsvc.exe	119
PID 1412 wrote to memory of 784	1412	DllCommonsvc.exe	120
PID 1412 wrote to memory of 784	1412	DllCommonsvc.exe	120
PID 1412 wrote to memory of 4952	1412	DllCommonsvc.exe	121
PID 1412 wrote to memory of 4952	1412	DllCommonsvc.exe	121
PID 1412 wrote to memory of 1352	1412	DllCommonsvc.exe	122
PID 1412 wrote to memory of 1352	1412	DllCommonsvc.exe	122
PID 1412 wrote to memory of 2896	1412	DllCommonsvc.exe	123
PID 1412 wrote to memory of 2896	1412	DllCommonsvc.exe	123
PID 1412 wrote to memory of 1272	1412	DllCommonsvc.exe	124
PID 1412 wrote to memory of 1272	1412	DllCommonsvc.exe	124
PID 1412 wrote to memory of 2692	1412	DllCommonsvc.exe	125
PID 1412 wrote to memory of 2692	1412	DllCommonsvc.exe	125
PID 1412 wrote to memory of 3512	1412	DllCommonsvc.exe	126
PID 1412 wrote to memory of 3512	1412	DllCommonsvc.exe	126
PID 1412 wrote to memory of 2708	1412	DllCommonsvc.exe	136
PID 1412 wrote to memory of 2708	1412	DllCommonsvc.exe	136
PID 2708 wrote to memory of 4380	2708	Registry.exe	141
PID 2708 wrote to memory of 4380	2708	Registry.exe	141
PID 4380 wrote to memory of 4196	4380	cmd.exe	143
PID 4380 wrote to memory of 4196	4380	cmd.exe	143
PID 4380 wrote to memory of 2872	4380	cmd.exe	150
PID 4380 wrote to memory of 2872	4380	cmd.exe	150
PID 2872 wrote to memory of 4732	2872	Registry.exe	156
PID 2872 wrote to memory of 4732	2872	Registry.exe	156
PID 4732 wrote to memory of 488	4732	cmd.exe	158
PID 4732 wrote to memory of 488	4732	cmd.exe	158
PID 4732 wrote to memory of 1940	4732	cmd.exe	163
PID 4732 wrote to memory of 1940	4732	cmd.exe	163
PID 1940 wrote to memory of 2460	1940	Registry.exe	165
PID 1940 wrote to memory of 2460	1940	Registry.exe	165
PID 2460 wrote to memory of 220	2460	cmd.exe	167
PID 2460 wrote to memory of 220	2460	cmd.exe	167
PID 2460 wrote to memory of 4660	2460	cmd.exe	169
PID 2460 wrote to memory of 4660	2460	cmd.exe	169
PID 4660 wrote to memory of 5100	4660	Registry.exe	171
PID 4660 wrote to memory of 5100	4660	Registry.exe	171
PID 5100 wrote to memory of 2900	5100	cmd.exe	173
PID 5100 wrote to memory of 2900	5100	cmd.exe	173
PID 5100 wrote to memory of 1696	5100	cmd.exe	175
PID 5100 wrote to memory of 1696	5100	cmd.exe	175
PID 1696 wrote to memory of 3120	1696	Registry.exe	177
PID 1696 wrote to memory of 3120	1696	Registry.exe	177
PID 3120 wrote to memory of 1732	3120	cmd.exe	179
PID 3120 wrote to memory of 1732	3120	cmd.exe	179
PID 3120 wrote to memory of 3704	3120	cmd.exe	181
PID 3120 wrote to memory of 3704	3120	cmd.exe	181
PID 3704 wrote to memory of 2976	3704	Registry.exe	183
PID 3704 wrote to memory of 2976	3704	Registry.exe	183
PID 2976 wrote to memory of 1800	2976	cmd.exe	185
PID 2976 wrote to memory of 1800	2976	cmd.exe	185

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d146246e5dc3689634e6691e9afbf198682ff8d022ae0662557db66accc3e9b5.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512
    - - C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2708
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bDGJqXcsCJ.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4196
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qzxbGmHcY3.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:488
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tlraSVrJxn.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:220
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qzxbGmHcY3.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2900
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i0MStmnXAe.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1732
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\etpQuxQFPn.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1800
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat"
        18⤵
        
        PID:4428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4528
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZHEG9SYztW.bat"
        20⤵
        
        PID:3508
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2484
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yoQf8QHV2Q.bat"
        22⤵
        
        PID:3320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4464
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8YXrskW4JY.bat"
        24⤵
        
        PID:2708
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3564
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LZh5ueQJla.bat"
        26⤵
        
        PID:1188
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1184
        
        C:\providercommon\Registry.exe
        
        "C:\providercommon\Registry.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat"
        28⤵
        
        PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\providercommon\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\providercommon\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat

Filesize
195B

MD5
caa3d410dc2c472685b83d8568240608

SHA1
e3ab89da3407cc215d6cc449c8c10e8a87c4389d

SHA256
0075ed3f0f56b63073e989b15720cc2579a8ac3a29351272fa6f005a91c94f2f

SHA512
e2910c3e3d89ff25a5e1cc39ae5d47c9f0fcdd3d607bafe05c6c8a4f4de0ca74e22bfcd38fe4e126b76f5f01d83d7cfa11bd8f3cfef855c1181cb73da2ab8df8

Download Submit
C:\Users\Admin\AppData\Local\Temp\8YXrskW4JY.bat

Filesize
195B

MD5
03600edc0ef6e15d71f9506deba7daed

SHA1
0913c7dd896df2cd4fe58552da5d452541f57985

SHA256
2d51b6d1cf3ae7f2ed4231e6f50cb8e91b0d190fd571dd68f9ff5936cab6bc76

SHA512
6ea065b2e0660350041edf16b507572e42280669a1695cde3e2fd475af4deff95d3e489f0df569a249c521eb1f41997e9a3769c50566b6d8cfdb9aa106f1a9e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\LZh5ueQJla.bat

Filesize
195B

MD5
a9c8e8de5f63f312041277b8e26dd509

SHA1
0e999003b53161baf71d543df0e1ca45e421da0e

SHA256
084538d4de73fb65aaac9bf64cdfdb6e16e3cb7779b7f4fadfa595a9dee18187

SHA512
eea503c64bd9ccffa09b65f4acba2bf2e523669b0a299ca098f1b5d069eb68f066b75b4e992f0cbe1ea3b07f92f4fba320582ed2021251411b7f35d262154418

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZHEG9SYztW.bat

Filesize
195B

MD5
6b5c9bca60ee281496618bada2dcfab1

SHA1
07c7d2f8239df941f9cdee75ea69b7e906bb3ad0

SHA256
9e3687616bb4755586783e891b6842f808b4a8a794deb70e42d9577e4c2b8001

SHA512
3bf3c5df9fe6ede5f3278be16444cd8e47956c0d703aa0bd066310bddf01a97d4ad728f163e0ae6d122f0cdaad577ce0de0783e4e2bcacad0b1bb60d22f8215f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xec1nsu0.3cc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bDGJqXcsCJ.bat

Filesize
195B

MD5
93785671781996b1039200fd8ef51328

SHA1
1ceac3794597e6cd97217254536e993563f19cd8

SHA256
c16e43cfe492c4c94fe6319978df548be1dc5cdb9b3579d1cafe55d60b7d3677

SHA512
885804e92d8fbe6ee5906b04b2d2583f335d8d8b9f6a1cd1dd900e37b1cb767d00930c89b0698bdb613f20db95dc8994f7e51ce63b0ccf13f8bd7aac59c255e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\etpQuxQFPn.bat

Filesize
195B

MD5
9bba912eb9b3851d08968b5f894ef792

SHA1
7f891234ed175878131119d155d8a35705e69cfc

SHA256
49148c29525cb941b5357943bd1ef6e40ed452b441b3d98c2804f894a03df92c

SHA512
aebff36528c7379740febff116d73cdd99ba97f270d54e206d4836d35dae2e9fa98829c5d1dc3053cc62b4e7a5e29647e6d1f59ef1d1a1728a4cfe7be436a105

Download Submit
C:\Users\Admin\AppData\Local\Temp\i0MStmnXAe.bat

Filesize
195B

MD5
86f9640d813eed26d79edaa36cfb1e81

SHA1
eae530646e8886f131e3233ce81431d88f9f7423

SHA256
f7ada18fc0f14ca7cacffe7a7ca372870a8f11d55367dab94e20c84926d17b78

SHA512
70ffe4585f0d9a7ff62454462d0d7b0a826a343dd740a72fd9e0eb3436a980f96bc75ebdbd2f527a555d72dec2a8051823dce7792866141be010cdcee5b96fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\qzxbGmHcY3.bat

Filesize
195B

MD5
2f89d640947485f982351dcc6bd43885

SHA1
ed207ae0269caca88bf0efa8f8eae25fff4136e6

SHA256
105099ba1bcb8dbc617249c9894279013f06cea79870a4b6a0a930bff39696e4

SHA512
b2d69cbdbd7690a98bdb3ed1ae35b20657cb5bd21488c6794082df920037534c5edf3bdf0a68785efbc705a2dc738214c9594b7c2c5ec22c6c93199d0861cf80

Download Submit
C:\Users\Admin\AppData\Local\Temp\tlraSVrJxn.bat

Filesize
195B

MD5
52683914d5cd7ef29cbd85a382f7834b

SHA1
dafa5cd517f3f69559f4ff7902f8820285f0d6db

SHA256
289d89f332164f205ff3e4d2bb03fc01c460c5d422acc78709a0236bf4f5517c

SHA512
e1e54d83b3991621fe6756b6f76f54d558369167905c59a374228d7d6ddbb8bb4a5187f0e25cb2beb9593a861f77e0c26dc8df1a9abdd5ae084fa1a33d9d1b0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\yoQf8QHV2Q.bat

Filesize
195B

MD5
5bffca954a9005acb36c028a6c45e887

SHA1
e5a4004ed9dbf9f77a0f9fa3fc96a9da4fb24051

SHA256
60930277e6bec68446a4b903b67163793f4db8ba75f5af46656f92373f8c9a0a

SHA512
f64f7e77e068a77d7720b2404a271aafdd33e20f5390b9068483fe0f672f1c3b1d8a9f85f9b495ef3974b51974498edf4d93a961578707411c1b2c09cd443ee9

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1412-14-0x0000000000E20000-0x0000000000E32000-memory.dmp

Filesize
72KB

Download
memory/1412-15-0x0000000000E30000-0x0000000000E3C000-memory.dmp

Filesize
48KB

Download
memory/1412-16-0x00000000027F0000-0x00000000027FC000-memory.dmp

Filesize
48KB

Download
memory/1412-17-0x000000001B970000-0x000000001B97C000-memory.dmp

Filesize
48KB

Download
memory/1412-12-0x00007FFE548C3000-0x00007FFE548C5000-memory.dmp

Filesize
8KB

Download
memory/1412-13-0x0000000000520000-0x0000000000630000-memory.dmp

Filesize
1.1MB

Download
memory/1696-188-0x00000000010C0000-0x00000000010D2000-memory.dmp

Filesize
72KB

Download
memory/1940-174-0x0000000000A30000-0x0000000000A42000-memory.dmp

Filesize
72KB

Download
memory/2708-138-0x0000000001890000-0x00000000018A2000-memory.dmp

Filesize
72KB

Download
memory/3704-195-0x0000000001060000-0x0000000001072000-memory.dmp

Filesize
72KB

Download
memory/4040-223-0x0000000000EA0000-0x0000000000EB2000-memory.dmp

Filesize
72KB

Download
memory/4408-216-0x00000000016B0000-0x00000000016C2000-memory.dmp

Filesize
72KB

Download
memory/4660-181-0x0000000000D40000-0x0000000000D52000-memory.dmp

Filesize
72KB

Download
memory/4756-230-0x0000000002550000-0x0000000002562000-memory.dmp

Filesize
72KB

Download
memory/4856-202-0x0000000003150000-0x0000000003162000-memory.dmp

Filesize
72KB

Download
memory/4944-209-0x0000000001670000-0x0000000001682000-memory.dmp

Filesize
72KB

Download
memory/4952-61-0x000002C7F1E80000-0x000002C7F1EA2000-memory.dmp

Filesize
136KB

Download