dcrat | 4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7.exe
Size

1.3MB
MD5

f3991c2f98d5cf243bf2471d4621820b
SHA1

e0ee43306388c5507bae17c7ab8be9f0beca5e0f
SHA256

4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7
SHA512

b88071a850420f574219f051618ec5ec700010e21fa354faca176aa69593549ff4835ae530d0840e1e210b7d33706474dc17902f6602bb623aeff52dd103bac5
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	3464	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	3464	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c77-10.dat	dcrat
behavioral2/memory/3184-13-0x00000000009B0000-0x0000000000AC0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2616	powershell.exe
1520	powershell.exe
64	powershell.exe
3852	powershell.exe
1208	powershell.exe
3028	powershell.exe
4252	powershell.exe
2108	powershell.exe
2824	powershell.exe
2524	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 13 IoCs

pid	Process
3184	DllCommonsvc.exe
4148	RuntimeBroker.exe
4704	RuntimeBroker.exe
2812	RuntimeBroker.exe
2748	RuntimeBroker.exe
404	RuntimeBroker.exe
844	RuntimeBroker.exe
4456	RuntimeBroker.exe
4468	RuntimeBroker.exe
4296	RuntimeBroker.exe
4132	RuntimeBroker.exe
4348	RuntimeBroker.exe
2132	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
51	raw.githubusercontent.com
52	raw.githubusercontent.com
20	raw.githubusercontent.com
37	raw.githubusercontent.com
41	raw.githubusercontent.com
43	raw.githubusercontent.com
48	raw.githubusercontent.com
49	raw.githubusercontent.com
21	raw.githubusercontent.com
38	raw.githubusercontent.com
42	raw.githubusercontent.com
50	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\es-ES\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\56085415360792	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1608	schtasks.exe
2544	schtasks.exe
4476	schtasks.exe
3796	schtasks.exe
872	schtasks.exe
2860	schtasks.exe
2324	schtasks.exe
4904	schtasks.exe
1256	schtasks.exe
1516	schtasks.exe
1616	schtasks.exe
3580	schtasks.exe
4628	schtasks.exe
4028	schtasks.exe
2132	schtasks.exe
2356	schtasks.exe
3616	schtasks.exe
5000	schtasks.exe
4212	schtasks.exe
4704	schtasks.exe
1416	schtasks.exe
4140	schtasks.exe
3300	schtasks.exe
4972	schtasks.exe
5104	schtasks.exe
4916	schtasks.exe
5068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
3184	DllCommonsvc.exe
3184	DllCommonsvc.exe
3184	DllCommonsvc.exe
2108	powershell.exe
2108	powershell.exe
1520	powershell.exe
1520	powershell.exe
3028	powershell.exe
3028	powershell.exe
3852	powershell.exe
3852	powershell.exe
4252	powershell.exe
4252	powershell.exe
64	powershell.exe
64	powershell.exe
2824	powershell.exe
2824	powershell.exe
1208	powershell.exe
1208	powershell.exe
2616	powershell.exe
2616	powershell.exe
2524	powershell.exe
2524	powershell.exe
3852	powershell.exe
2524	powershell.exe
64	powershell.exe
2108	powershell.exe
3028	powershell.exe
4252	powershell.exe
1520	powershell.exe
2824	powershell.exe
1208	powershell.exe
2616	powershell.exe
4148	RuntimeBroker.exe
4704	RuntimeBroker.exe
2812	RuntimeBroker.exe
2748	RuntimeBroker.exe
404	RuntimeBroker.exe
844	RuntimeBroker.exe
4456	RuntimeBroker.exe
4468	RuntimeBroker.exe
4296	RuntimeBroker.exe
4132	RuntimeBroker.exe
4348	RuntimeBroker.exe
2132	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	DllCommonsvc.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	64	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	4148	RuntimeBroker.exe
Token: SeDebugPrivilege	4704	RuntimeBroker.exe
Token: SeDebugPrivilege	2812	RuntimeBroker.exe
Token: SeDebugPrivilege	2748	RuntimeBroker.exe
Token: SeDebugPrivilege	404	RuntimeBroker.exe
Token: SeDebugPrivilege	844	RuntimeBroker.exe
Token: SeDebugPrivilege	4456	RuntimeBroker.exe
Token: SeDebugPrivilege	4468	RuntimeBroker.exe
Token: SeDebugPrivilege	4296	RuntimeBroker.exe
Token: SeDebugPrivilege	4132	RuntimeBroker.exe
Token: SeDebugPrivilege	4348	RuntimeBroker.exe
Token: SeDebugPrivilege	2132	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2752	2124	JaffaCakes118_4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7.exe	83
PID 2124 wrote to memory of 2752	2124	JaffaCakes118_4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7.exe	83
PID 2124 wrote to memory of 2752	2124	JaffaCakes118_4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7.exe	83
PID 2752 wrote to memory of 688	2752	WScript.exe	85
PID 2752 wrote to memory of 688	2752	WScript.exe	85
PID 2752 wrote to memory of 688	2752	WScript.exe	85
PID 688 wrote to memory of 3184	688	cmd.exe	87
PID 688 wrote to memory of 3184	688	cmd.exe	87
PID 3184 wrote to memory of 2616	3184	DllCommonsvc.exe	117
PID 3184 wrote to memory of 2616	3184	DllCommonsvc.exe	117
PID 3184 wrote to memory of 1520	3184	DllCommonsvc.exe	118
PID 3184 wrote to memory of 1520	3184	DllCommonsvc.exe	118
PID 3184 wrote to memory of 1208	3184	DllCommonsvc.exe	119
PID 3184 wrote to memory of 1208	3184	DllCommonsvc.exe	119
PID 3184 wrote to memory of 2524	3184	DllCommonsvc.exe	120
PID 3184 wrote to memory of 2524	3184	DllCommonsvc.exe	120
PID 3184 wrote to memory of 2824	3184	DllCommonsvc.exe	122
PID 3184 wrote to memory of 2824	3184	DllCommonsvc.exe	122
PID 3184 wrote to memory of 64	3184	DllCommonsvc.exe	123
PID 3184 wrote to memory of 64	3184	DllCommonsvc.exe	123
PID 3184 wrote to memory of 2108	3184	DllCommonsvc.exe	124
PID 3184 wrote to memory of 2108	3184	DllCommonsvc.exe	124
PID 3184 wrote to memory of 4252	3184	DllCommonsvc.exe	125
PID 3184 wrote to memory of 4252	3184	DllCommonsvc.exe	125
PID 3184 wrote to memory of 3028	3184	DllCommonsvc.exe	126
PID 3184 wrote to memory of 3028	3184	DllCommonsvc.exe	126
PID 3184 wrote to memory of 3852	3184	DllCommonsvc.exe	127
PID 3184 wrote to memory of 3852	3184	DllCommonsvc.exe	127
PID 3184 wrote to memory of 4512	3184	DllCommonsvc.exe	136
PID 3184 wrote to memory of 4512	3184	DllCommonsvc.exe	136
PID 4512 wrote to memory of 1608	4512	cmd.exe	139
PID 4512 wrote to memory of 1608	4512	cmd.exe	139
PID 4512 wrote to memory of 4148	4512	cmd.exe	140
PID 4512 wrote to memory of 4148	4512	cmd.exe	140
PID 4148 wrote to memory of 3876	4148	RuntimeBroker.exe	153
PID 4148 wrote to memory of 3876	4148	RuntimeBroker.exe	153
PID 3876 wrote to memory of 2196	3876	cmd.exe	155
PID 3876 wrote to memory of 2196	3876	cmd.exe	155
PID 3876 wrote to memory of 4704	3876	cmd.exe	157
PID 3876 wrote to memory of 4704	3876	cmd.exe	157
PID 4704 wrote to memory of 3732	4704	RuntimeBroker.exe	162
PID 4704 wrote to memory of 3732	4704	RuntimeBroker.exe	162
PID 3732 wrote to memory of 4460	3732	cmd.exe	164
PID 3732 wrote to memory of 4460	3732	cmd.exe	164
PID 3732 wrote to memory of 2812	3732	cmd.exe	166
PID 3732 wrote to memory of 2812	3732	cmd.exe	166
PID 2812 wrote to memory of 3304	2812	RuntimeBroker.exe	168
PID 2812 wrote to memory of 3304	2812	RuntimeBroker.exe	168
PID 3304 wrote to memory of 1768	3304	cmd.exe	170
PID 3304 wrote to memory of 1768	3304	cmd.exe	170
PID 3304 wrote to memory of 2748	3304	cmd.exe	172
PID 3304 wrote to memory of 2748	3304	cmd.exe	172
PID 2748 wrote to memory of 2352	2748	RuntimeBroker.exe	174
PID 2748 wrote to memory of 2352	2748	RuntimeBroker.exe	174
PID 2352 wrote to memory of 1516	2352	cmd.exe	176
PID 2352 wrote to memory of 1516	2352	cmd.exe	176
PID 2352 wrote to memory of 404	2352	cmd.exe	178
PID 2352 wrote to memory of 404	2352	cmd.exe	178
PID 404 wrote to memory of 3636	404	RuntimeBroker.exe	180
PID 404 wrote to memory of 3636	404	RuntimeBroker.exe	180
PID 3636 wrote to memory of 3944	3636	cmd.exe	182
PID 3636 wrote to memory of 3944	3636	cmd.exe	182
PID 3636 wrote to memory of 844	3636	cmd.exe	184
PID 3636 wrote to memory of 844	3636	cmd.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4318b372cbb0d931ba8b5957591e3fb594cc01f01f7db3b7cb777b170c3d57b7.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:688
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:64
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\es-ES\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3852
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ksPcBd7Itw.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4512
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1608
      - C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2196
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4460
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1768
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1516
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0tZmJrpaGF.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3944
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WLCDTNV5Zk.bat"
        17⤵
        
        PID:4332
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1952
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VAhDAdBh8f.bat"
        19⤵
        
        PID:4732
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1520
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6n1oUPmZQq.bat"
        21⤵
        
        PID:4180
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3184
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat"
        23⤵
        
        PID:2716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3888
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qzxbGmHcY3.bat"
        25⤵
        
        PID:2252
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4276
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZHEG9SYztW.bat"
        27⤵
        
        PID:1816
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4748
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Public\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Public\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Downloads\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Downloads\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Downloads\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
32eb17ed643bdd2ac703869af8eb5877

SHA1
ab47894bcee6cfd76b7600cf4c585edb3ee519c4

SHA256
caaab6753d5658d44295a57f7616ae0c9d76b845fe68a3020d4fb9f3bade2687

SHA512
6d4231040a74bc5f8db28dcac8dd87153358346b2717f7bde7b3db240f014434b73a1d0b176dea50062230840971abd61fa48508d4310858fc3ac4b98c977304

Download Submit
C:\Users\Admin\AppData\Local\Temp\0tZmJrpaGF.bat

Filesize
204B

MD5
005141b21ede496673d2b0468974d93e

SHA1
399b46a930b927f26bfb8412569c57e868d8b896

SHA256
3bdf1f2fc7d3081fa19f4669e23208cf0ee4ba02480ec97d6e9317bb657dfa0b

SHA512
13b4840e974597a468d10eaa951f667feff79e1cc8a8c746a2415f3cebfc883d55e7afcc6579f1ffa2501d7d6d7244538b6636f9a71c8d707a7c8ab91e63f650

Download Submit
C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat

Filesize
204B

MD5
0d26d956bd457546038e138018d95dfa

SHA1
ca8d6581d1ed737b5eac15bf893be86b4dafa618

SHA256
6db5515381e52d48fe8706589dfc6e7c0f1c0f0c9ed7862842a822f4580d5a77

SHA512
898a6b8f068b48f248f138130a3c62ab4eaa840477bcb5b763b811f069fb422c72eb3cc56788504b530b5de8f63d823527517a62f1aade34fad755cbb0cacdee

Download Submit
C:\Users\Admin\AppData\Local\Temp\6n1oUPmZQq.bat

Filesize
204B

MD5
59919dc9ecd80c0255b63c5d51179f1b

SHA1
b4d24bc28d28349efb2efe18a449939d3592d3a7

SHA256
fc1d12c51b538dfc5f668c4c2eaec639ecf2cc93bcc3d3d02ba9ecfd58598ed2

SHA512
ef3784639b276bb9de4dbc2711a43a109dea6531f35e4e4e65faf7036a6fe4681ac877e04279839d9e855207fbce8d07aa754b7fd517cd8e01b46decbcd3c445

Download Submit
C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat

Filesize
204B

MD5
038754563ba315f2572dbdaba77d988d

SHA1
b664e77ee3b623bb98fe0c8ffc0279988d28d17f

SHA256
524bc3284b6fbd53a63b8de2d7bc0c099377c913df93109e9e1bfd874c50e222

SHA512
f5761ac609c2df2e650b6fa76666b3e300f105ff4622a923a4b6e7f4c40ca16e93893d36ad42f1ad6d0df26a5287880174b84668d6879ea4c4e99d62a5e4b6fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat

Filesize
204B

MD5
dc3404c38d1d8909150467feae891d9b

SHA1
1fe34a3e0505421276797cf49223ef03fa1ff5c5

SHA256
c67d421d030625de3b107556560a88fb8996b7899c08bd7f957a4c4569c617d4

SHA512
f80c62f7b5e75a2096fe05a794b0e350a6125b737a1ad932a439a0548de1cbd46020254a211b591a4f17a9b388d8a898ac3296cf8e0ae9c5242c9ccb4992d0c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat

Filesize
204B

MD5
ebc733f170f0e3627a5061a98d8caea9

SHA1
86a81a7a8ecf397dbe83ba220ccbb3bb5dc13f0d

SHA256
20b2193f4de44cca9569ac243467d35f5f73fdf728bf2e757cd847d541e8e64e

SHA512
fc241670567774993e7664daeb84f0c760e6f0ab215f2cf7aecb2057c8255cedd95ad7483c7e6d3c4d0077345cc810af9b5ef5e104419a9bf518f0316144a540

Download Submit
C:\Users\Admin\AppData\Local\Temp\VAhDAdBh8f.bat

Filesize
204B

MD5
e231b584e5a4e1c9a76445f15716dc4d

SHA1
f0284ef897febe888022b99adf794693e25a3e70

SHA256
62628fe1c89a918100d9b40c9b1ad8b62933d48a19c64dd5c6190bd3f5690146

SHA512
0eae10c4204a7569df028f0785121e80aa0826e6c026c9ec8977caec55d377b63202f9f57f05b68de70b75fa5d64900db8a820cfb378fd5132c0cd65c35bb99e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WLCDTNV5Zk.bat

Filesize
204B

MD5
eb66f0acae291af856674e638ed646a9

SHA1
78f4c57b1c1eea8dd7f38b6549a28bb6a61f8ac7

SHA256
c2c5a67cf4f9cb27e24213a2fa120919267cccbea927e653707fead4f55f5ca1

SHA512
380a6f7e6835380dff57eaca0445fd1cab57940e50718a6089be05e1386dbd52ead77a6007f90251663edbb42cd863eb5eca648de47162ac952eac3f37cf6c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZHEG9SYztW.bat

Filesize
204B

MD5
254ec27ee3a7ae8e4e0503b531c181e6

SHA1
d8e6b5dafcb3247e0cf6c4ac77ae5d14adc13a11

SHA256
4f96d8dcda2280b94bbb2890f0661420b6d905f9f1eb93e8bee2a23c7a65f235

SHA512
619697ff16bea84edb3027e1580cf2a2d146e6ef16a1113720cbf41fbcc242d921cd47a703da7e155c6d9afa66096a096808f8df6b5ea861d8adfb2d6ba862e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pl0kx425.ado.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ksPcBd7Itw.bat

Filesize
204B

MD5
d06b11167f6a631e356a9f5e89b8932a

SHA1
01d2a976a97d0224438fe088af387df42dd61d0d

SHA256
d6304a9aa9d37fc659efffb1e1015e4297a27002696749147068a6c004b0e39a

SHA512
a26b06b43dc7ced413e48521c3ec2b2688d826f6a5c23c81c427ee5bce8938c4517cfa1ba662a76c40be40324774164e34f46115f54024d1fa8ccff0089d1305

Download Submit
C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat

Filesize
204B

MD5
da041e72fd8b87f3286be576a40e9443

SHA1
24a08a6e7c14eae2dcdba83d6575e9ac389176d0

SHA256
f5c472897bb634fb078e76f6acff2fb6482cb7327083df35ed69c688664326bb

SHA512
651e2bae9590b5ea859decf9fac49212b34587d15859adc20fd1b947fdd99afee01b6cf5949bc77cb4bb101a3c70f020684af14f91e8d2e730c87dc60ac75cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\qzxbGmHcY3.bat

Filesize
204B

MD5
0a8b070d28ffc7a221ecf42261474bf1

SHA1
83131cc0c8ce42ce514ae1b6ad344dffee01e1db

SHA256
fe8fd2f880d66166c1fb0e965ec8bf83e445da31fd8d02576fa951ec4f03321d

SHA512
4df280a2616a9fe0aa0540e44d53fa35478e743d7c2c2e7b3939eb129b65e4f95239e6ccd162a765cdd06e774c42ecc270cb9dff4e1ed2cb8a9aca35d6199780

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/844-191-0x000000001B9F0000-0x000000001BA02000-memory.dmp

Filesize
72KB

Download
memory/2108-46-0x0000023927E80000-0x0000023927EA2000-memory.dmp

Filesize
136KB

Download
memory/3184-16-0x0000000002BA0000-0x0000000002BAC000-memory.dmp

Filesize
48KB

Download
memory/3184-12-0x00007FFCCB2D3000-0x00007FFCCB2D5000-memory.dmp

Filesize
8KB

Download
memory/3184-13-0x00000000009B0000-0x0000000000AC0000-memory.dmp

Filesize
1.1MB

Download
memory/3184-14-0x0000000001280000-0x0000000001292000-memory.dmp

Filesize
72KB

Download
memory/3184-15-0x0000000002B90000-0x0000000002B9C000-memory.dmp

Filesize
48KB

Download
memory/3184-17-0x0000000002BC0000-0x0000000002BCC000-memory.dmp

Filesize
48KB

Download
memory/4148-157-0x000000001C940000-0x000000001C952000-memory.dmp

Filesize
72KB

Download
memory/4296-210-0x000000001B5F0000-0x000000001B602000-memory.dmp

Filesize
72KB

Download
memory/4704-166-0x000000001AFF0000-0x000000001B002000-memory.dmp

Filesize
72KB

Download