dcrat | c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb.exe
Size

1.3MB
MD5

2dcf50553b85232a9b945cd6cba51948
SHA1

d95edd641d22ba757a62e2e95944bb7ed9d5fd7f
SHA256

c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb
SHA512

ac47089aa076c56f770eea97071bd33fb07def65eced5e6f9aa98bd345aa947650dc1e00bf6b733d8337c0548b7d5dd7b0f63660cb01f4b8c55073a2828075cf
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2368	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	2368	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000b000000023b8f-10.dat	dcrat
behavioral2/memory/904-13-0x0000000000F00000-0x0000000001010000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2384	powershell.exe
2532	powershell.exe
2468	powershell.exe
700	powershell.exe
3196	powershell.exe

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	JaffaCakes118_c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 16 IoCs

pid	Process
904	DllCommonsvc.exe
2428	Idle.exe
2716	Idle.exe
3504	Idle.exe
416	Idle.exe
4200	Idle.exe
3176	Idle.exe
5096	Idle.exe
2964	Idle.exe
3196	Idle.exe
2428	Idle.exe
4348	Idle.exe
2272	Idle.exe
1592	Idle.exe
3712	Idle.exe
4356	Idle.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
26	raw.githubusercontent.com
32	raw.githubusercontent.com
39	raw.githubusercontent.com
40	raw.githubusercontent.com
47	raw.githubusercontent.com
53	raw.githubusercontent.com
14	raw.githubusercontent.com
55	raw.githubusercontent.com
59	raw.githubusercontent.com
56	raw.githubusercontent.com
19	raw.githubusercontent.com
43	raw.githubusercontent.com
44	raw.githubusercontent.com
52	raw.githubusercontent.com
54	raw.githubusercontent.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\fontdrvhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	JaffaCakes118_c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Idle.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2276	schtasks.exe
2828	schtasks.exe
3712	schtasks.exe
4548	schtasks.exe
4216	schtasks.exe
5108	schtasks.exe
5012	schtasks.exe
4080	schtasks.exe
3220	schtasks.exe
4276	schtasks.exe
5052	schtasks.exe
5064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
904	DllCommonsvc.exe
904	DllCommonsvc.exe
904	DllCommonsvc.exe
2384	powershell.exe
700	powershell.exe
3196	powershell.exe
2468	powershell.exe
2532	powershell.exe
2384	powershell.exe
3196	powershell.exe
700	powershell.exe
2468	powershell.exe
2532	powershell.exe
2428	Idle.exe
2716	Idle.exe
3504	Idle.exe
416	Idle.exe
4200	Idle.exe
3176	Idle.exe
5096	Idle.exe
2964	Idle.exe
3196	Idle.exe
2428	Idle.exe
4348	Idle.exe
2272	Idle.exe
1592	Idle.exe
3712	Idle.exe
4356	Idle.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	904	DllCommonsvc.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	2428	Idle.exe
Token: SeDebugPrivilege	2716	Idle.exe
Token: SeDebugPrivilege	3504	Idle.exe
Token: SeDebugPrivilege	416	Idle.exe
Token: SeDebugPrivilege	4200	Idle.exe
Token: SeDebugPrivilege	3176	Idle.exe
Token: SeDebugPrivilege	5096	Idle.exe
Token: SeDebugPrivilege	2964	Idle.exe
Token: SeDebugPrivilege	3196	Idle.exe
Token: SeDebugPrivilege	2428	Idle.exe
Token: SeDebugPrivilege	4348	Idle.exe
Token: SeDebugPrivilege	2272	Idle.exe
Token: SeDebugPrivilege	1592	Idle.exe
Token: SeDebugPrivilege	3712	Idle.exe
Token: SeDebugPrivilege	4356	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2220	1512	JaffaCakes118_c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb.exe	83
PID 1512 wrote to memory of 2220	1512	JaffaCakes118_c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb.exe	83
PID 1512 wrote to memory of 2220	1512	JaffaCakes118_c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb.exe	83
PID 2220 wrote to memory of 1456	2220	WScript.exe	85
PID 2220 wrote to memory of 1456	2220	WScript.exe	85
PID 2220 wrote to memory of 1456	2220	WScript.exe	85
PID 1456 wrote to memory of 904	1456	cmd.exe	87
PID 1456 wrote to memory of 904	1456	cmd.exe	87
PID 904 wrote to memory of 2532	904	DllCommonsvc.exe	102
PID 904 wrote to memory of 2532	904	DllCommonsvc.exe	102
PID 904 wrote to memory of 2468	904	DllCommonsvc.exe	103
PID 904 wrote to memory of 2468	904	DllCommonsvc.exe	103
PID 904 wrote to memory of 700	904	DllCommonsvc.exe	104
PID 904 wrote to memory of 700	904	DllCommonsvc.exe	104
PID 904 wrote to memory of 3196	904	DllCommonsvc.exe	105
PID 904 wrote to memory of 3196	904	DllCommonsvc.exe	105
PID 904 wrote to memory of 2384	904	DllCommonsvc.exe	106
PID 904 wrote to memory of 2384	904	DllCommonsvc.exe	106
PID 904 wrote to memory of 2428	904	DllCommonsvc.exe	112
PID 904 wrote to memory of 2428	904	DllCommonsvc.exe	112
PID 2428 wrote to memory of 2280	2428	Idle.exe	114
PID 2428 wrote to memory of 2280	2428	Idle.exe	114
PID 2280 wrote to memory of 4428	2280	cmd.exe	116
PID 2280 wrote to memory of 4428	2280	cmd.exe	116
PID 2280 wrote to memory of 2716	2280	cmd.exe	123
PID 2280 wrote to memory of 2716	2280	cmd.exe	123
PID 2716 wrote to memory of 1592	2716	Idle.exe	127
PID 2716 wrote to memory of 1592	2716	Idle.exe	127
PID 1592 wrote to memory of 3736	1592	cmd.exe	129
PID 1592 wrote to memory of 3736	1592	cmd.exe	129
PID 1592 wrote to memory of 3504	1592	cmd.exe	135
PID 1592 wrote to memory of 3504	1592	cmd.exe	135
PID 3504 wrote to memory of 2812	3504	Idle.exe	139
PID 3504 wrote to memory of 2812	3504	Idle.exe	139
PID 2812 wrote to memory of 2124	2812	cmd.exe	141
PID 2812 wrote to memory of 2124	2812	cmd.exe	141
PID 2812 wrote to memory of 416	2812	cmd.exe	143
PID 2812 wrote to memory of 416	2812	cmd.exe	143
PID 416 wrote to memory of 2532	416	Idle.exe	145
PID 416 wrote to memory of 2532	416	Idle.exe	145
PID 2532 wrote to memory of 2768	2532	cmd.exe	147
PID 2532 wrote to memory of 2768	2532	cmd.exe	147
PID 2532 wrote to memory of 4200	2532	cmd.exe	150
PID 2532 wrote to memory of 4200	2532	cmd.exe	150
PID 4200 wrote to memory of 676	4200	Idle.exe	152
PID 4200 wrote to memory of 676	4200	Idle.exe	152
PID 676 wrote to memory of 2308	676	cmd.exe	154
PID 676 wrote to memory of 2308	676	cmd.exe	154
PID 676 wrote to memory of 3176	676	cmd.exe	156
PID 676 wrote to memory of 3176	676	cmd.exe	156
PID 3176 wrote to memory of 4276	3176	Idle.exe	158
PID 3176 wrote to memory of 4276	3176	Idle.exe	158
PID 4276 wrote to memory of 4172	4276	cmd.exe	160
PID 4276 wrote to memory of 4172	4276	cmd.exe	160
PID 4276 wrote to memory of 5096	4276	cmd.exe	162
PID 4276 wrote to memory of 5096	4276	cmd.exe	162
PID 5096 wrote to memory of 32	5096	Idle.exe	164
PID 5096 wrote to memory of 32	5096	Idle.exe	164
PID 32 wrote to memory of 1904	32	cmd.exe	166
PID 32 wrote to memory of 1904	32	cmd.exe	166
PID 32 wrote to memory of 2964	32	cmd.exe	168
PID 32 wrote to memory of 2964	32	cmd.exe	168
PID 2964 wrote to memory of 468	2964	Idle.exe	170
PID 2964 wrote to memory of 468	2964	Idle.exe	170

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c7dd53cd25b84341bab18041779ebbeba904e6b57882a0363dfa753f379ddfdb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
    - - C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2428
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q2cXKRfm9B.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4428
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7bDnwPuEug.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3736
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1n8esAjYxK.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2124
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2768
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:676
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2308
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a4RGbRhdNM.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4172
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:32
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1904
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OPH1A2PBmS.bat"
        20⤵
        
        PID:468
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2264
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat"
        22⤵
        
        PID:3436
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2184
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat"
        24⤵
        
        PID:2448
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4516
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat"
        26⤵
        
        PID:2664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:3012
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9gNv7qRJ8U.bat"
        28⤵
        
        PID:1368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2792
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UMVEid32eq.bat"
        30⤵
        
        PID:3092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:2812
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X9PDuMdk3a.bat"
        32⤵
        
        PID:1020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:3692
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe"
        33⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MNu5MeZyGQ.bat"
        34⤵
        
        PID:628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        35⤵
        
        PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\All Users\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1n8esAjYxK.bat

Filesize
221B

MD5
bebea5b0fd3dc56acff62c65beed910a

SHA1
939700e24785acfe000476dd0c326e0d4184cf0f

SHA256
2092c32768e3417e99bfda951fd4dc8cccc92e6ebbd209f9cac5c60ef0aa81ab

SHA512
97079209d22f90d401270c802ebe0b8e252cac0b1fc150f43e1adf4cb8a7712d19c99b630bf25d8744129fec06ea8abb9e60b48b7a846416bc77e859fa3cebf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat

Filesize
221B

MD5
aee8f59e6786a6853ef53595233b4920

SHA1
6e72d35d35662710ba44e1571855d75686ee51b9

SHA256
779ce1ce301ef4c30960f797f0f5fe3cc22d97e84c0dcd353e6283c6f37e83b8

SHA512
5af748344df639e166b57af5f0701cf0752c02ea10bc994e7b52cd2be8cc48ca4ae4a75f46aefb76650bb540c505748ba1ecccd5764802d4bb0a989bc6025e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\7bDnwPuEug.bat

Filesize
221B

MD5
fa6fd178f963ee7f2669ad2c049de9ec

SHA1
285a6cebf4f217eaedccd0372e3b9089303ab50d

SHA256
6cbddb9d46a42d9c2db009a72841b1550d39095c55e5b6eb7101cba7de3f9a19

SHA512
2c3a938822990393822fd2c58f4308b6684950071f0d299f9c7edcd03794727c26656a3e9464f3ab875b08c98d08a953651e789595796aa2428bc0334ca51a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\9gNv7qRJ8U.bat

Filesize
221B

MD5
64c01c4624d589d91d83f8348327a6dd

SHA1
c66c518bfa335146f219e7ca7c223b13855e2c31

SHA256
8d537a3e8143745672d81bd5c84f53c9384d205c30c160aa40689ae39fe8fe5c

SHA512
add194715cb94180ade1de4c018bef858b34c6938c7723a190897eeb93d17ea45535fa03bdcfc8ef162b0057617ea9e77222d35656b725cdf0cd310799c476cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MNu5MeZyGQ.bat

Filesize
221B

MD5
a727365651be82cc37edf1a73e2288fd

SHA1
38318e876426d21ee01d1c46af5e0583ad0f6990

SHA256
5baa23f402271995bbd8d671226e313668d86997bebbd91538da28b98dc84b82

SHA512
9ea4716fabc4588f50ee3550d07d4de646eb1891c0dabcf8fc6ae8d99717777f4df2e67f873ceeaedd31d9c48c2d8e347557c374b2a88159795b8783a7585954

Download Submit
C:\Users\Admin\AppData\Local\Temp\OPH1A2PBmS.bat

Filesize
221B

MD5
628a1b37e87b1aa94ea589314c8d5d67

SHA1
c78549ccd82d2f7b024d50c2e493f7ecb3f51797

SHA256
d8ed39f2c50750fe609c8ef4e3dbc12151c58233089e6dc6e93e7c14886928d0

SHA512
4b7188a632bd877c8b81ee0efad95ab07000d8c8df12040392c90941aeb6ae33a4cc401127d431ea7fa40898e7754967637842072039e412f3083c845109689f

Download Submit
C:\Users\Admin\AppData\Local\Temp\UMVEid32eq.bat

Filesize
221B

MD5
a6a39dbb7b272a5e3691bbd17be3fca8

SHA1
3212fd7a2633ba13bd2b598c7538c41a37e50ca2

SHA256
d8e60de96531825081ad5c726239cdc4f6150ef9625ef7865bdf4c760e708143

SHA512
6f8aa2a9982c1bba02fead0193e2cde522daa474bfd0ffc8a8c6483d7ae0001f4a262974ab0ce9b78533cea1b174a067796fdaf6d66e7a3b5a8a63e27cde5b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\X9PDuMdk3a.bat

Filesize
221B

MD5
f6fa35abcaac75639cb9f21d3ac77560

SHA1
bc9e51614c9d8782c1192bb1466438ea0fce1c2c

SHA256
f83f4d4b3d8d9a9cf49c26b93ab848eaf639620642c7b608eed7997f6b4a9503

SHA512
7c643a976939cce64f02510499b02fb539a6e8a6ce102beb7d6cbddba3090e67f463dcae311fd862d9bfebadd42d6ab1e1142644033089ae75837d8c982b3055

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1mtz4htq.g1s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a4RGbRhdNM.bat

Filesize
221B

MD5
be16184000f956a31765e9ef874fd313

SHA1
a6fb105094dd04b99fe425c179e94817721835fe

SHA256
17d1244907816ebfea96e6041d11cc7a8746472540ee8f95cf99c622f5ba92e5

SHA512
8c8e63c22831d2f5741575cec7f0225237298cbd2c697d08ca83addc09b1a6130bf6946a34c13b3631010f98388a65c51e341f50a212acc06508ca846efba997

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat

Filesize
221B

MD5
f6f079649d934bc478a8161a7d1b1c2e

SHA1
f265bf29e180e4279dd3a389d862ae99c2a40470

SHA256
17d53e5f027dbdc74e8f4505ca8d78777d344fc98f1aeaf241ecbb6c8c55e3d4

SHA512
62af0368f6de0d8380d55951e4c7787a63de4ef344454ff9686d9846b212ed0bd3e5f654d9b22fbd08d09616ecef30b77ea76c7d8d825347efdb7654c1f1c335

Download Submit
C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat

Filesize
221B

MD5
d1d9d6f76b182412ebbca11e27516b45

SHA1
19bfe8375bacf869e76916da1e7a8b2a94f44cb8

SHA256
4aa72bbb1352f688cf19a4c6333567734530cde19d9e3ebf61f9f07300a553ec

SHA512
133be2a23ed7dd02405a7567f6062e6ce29d74ce8773de5991a76260e833da902632edd170877c04d55902b17c265f59a73d0e136d4ef4b745068dfaefc84f2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\q2cXKRfm9B.bat

Filesize
221B

MD5
a886bc6464734dae500ef30141c92c71

SHA1
47b7374427913e0e44e4d3cba185ee163ed60aad

SHA256
797819a517802c00d45a214dae560781a8f6ea4bd62c15c7ac7e63711811756f

SHA512
5bfca9452d2499666786c507ede3e27447b71e0729174fd92155bf717d2c14e32993cf37e5345f7591a33c8d1a80b891e2719a468a92bb32dd0f061362da7633

Download Submit
C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat

Filesize
221B

MD5
4b1ba93fd3139bb702b12fa326d7c185

SHA1
bdf0a852c600838058f80d8cd707a5fe5928d77b

SHA256
a7ec8abd51ff22be719792f62e62f8cbc936a5f874c3a96a79205187f02328d0

SHA512
01ee14d71df8707a363b1ba32dc9109d4f4a179e7200e42cdc1ad33332a35e1a4dc530667d07dcb47e4af204f63e36b99f4ccb45089cf90dd13e9e6db11e1c3f

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/904-17-0x0000000003200000-0x000000000320C000-memory.dmp

Filesize
48KB

Download
memory/904-16-0x00000000031F0000-0x00000000031FC000-memory.dmp

Filesize
48KB

Download
memory/904-15-0x00000000031E0000-0x00000000031EC000-memory.dmp

Filesize
48KB

Download
memory/904-14-0x00000000017D0000-0x00000000017E2000-memory.dmp

Filesize
72KB

Download
memory/904-13-0x0000000000F00000-0x0000000001010000-memory.dmp

Filesize
1.1MB

Download
memory/904-12-0x00007FFA20753000-0x00007FFA20755000-memory.dmp

Filesize
8KB

Download
memory/2384-47-0x000002255E540000-0x000002255E562000-memory.dmp

Filesize
136KB

Download
memory/2428-83-0x000000001B6B0000-0x000000001B6C2000-memory.dmp

Filesize
72KB

Download
memory/3176-127-0x00000000025D0000-0x00000000025E2000-memory.dmp

Filesize
72KB

Download
memory/3196-146-0x0000000002EE0000-0x0000000002EF2000-memory.dmp

Filesize
72KB

Download
memory/4356-183-0x0000000002A80000-0x0000000002A92000-memory.dmp

Filesize
72KB

Download