dcrat | 93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0.exe
Size

1.3MB
MD5

6371030e6d85c20398c34082e97705d2
SHA1

7c85c909b8e3944a522f3e27af54544fae3cdecb
SHA256

93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0
SHA512

8f2dfe7eab6ab8ade0fe70b6c41c069fe704aa1319416ac44682843b8c6b858821f284be685996fc1eded810636c8c70c2342f96685ad4668488ccc5af7a7c86
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3316	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	3848	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	3848	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b7d-10.dat	dcrat
behavioral2/memory/1284-13-0x0000000000F00000-0x0000000001010000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5044	powershell.exe
4172	powershell.exe
4220	powershell.exe
4044	powershell.exe
4872	powershell.exe
2416	powershell.exe
4940	powershell.exe
1440	powershell.exe
2672	powershell.exe
1084	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe

Executes dropped EXE 15 IoCs

pid	Process
1284	DllCommonsvc.exe
1208	DllCommonsvc.exe
2152	DllCommonsvc.exe
4016	DllCommonsvc.exe
4460	DllCommonsvc.exe
3808	DllCommonsvc.exe
2436	DllCommonsvc.exe
4532	DllCommonsvc.exe
1156	DllCommonsvc.exe
2416	DllCommonsvc.exe
3656	DllCommonsvc.exe
1492	DllCommonsvc.exe
4576	DllCommonsvc.exe
2636	DllCommonsvc.exe
4980	DllCommonsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
47	raw.githubusercontent.com
44	raw.githubusercontent.com
48	raw.githubusercontent.com
55	raw.githubusercontent.com
15	raw.githubusercontent.com
16	raw.githubusercontent.com
25	raw.githubusercontent.com
43	raw.githubusercontent.com
57	raw.githubusercontent.com
58	raw.githubusercontent.com
59	raw.githubusercontent.com
20	raw.githubusercontent.com
33	raw.githubusercontent.com
56	raw.githubusercontent.com
60	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Crashpad\attachments\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\attachments\a76d7bf15d8370	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4948	schtasks.exe
3976	schtasks.exe
2788	schtasks.exe
4820	schtasks.exe
3244	schtasks.exe
4892	schtasks.exe
1952	schtasks.exe
3232	schtasks.exe
3632	schtasks.exe
1592	schtasks.exe
764	schtasks.exe
4756	schtasks.exe
4964	schtasks.exe
1760	schtasks.exe
3316	schtasks.exe
2688	schtasks.exe
2324	schtasks.exe
3812	schtasks.exe
4024	schtasks.exe
2904	schtasks.exe
4144	schtasks.exe
3660	schtasks.exe
5000	schtasks.exe
440	schtasks.exe
1568	schtasks.exe
5016	schtasks.exe
2356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1284	DllCommonsvc.exe
1284	DllCommonsvc.exe
1284	DllCommonsvc.exe
5044	powershell.exe
5044	powershell.exe
4872	powershell.exe
4872	powershell.exe
4044	powershell.exe
4044	powershell.exe
1084	powershell.exe
1084	powershell.exe
4220	powershell.exe
4220	powershell.exe
4172	powershell.exe
4172	powershell.exe
2416	powershell.exe
2416	powershell.exe
4940	powershell.exe
4940	powershell.exe
1440	powershell.exe
1440	powershell.exe
2672	powershell.exe
2672	powershell.exe
4940	powershell.exe
1208	DllCommonsvc.exe
1208	DllCommonsvc.exe
5044	powershell.exe
4872	powershell.exe
1084	powershell.exe
4220	powershell.exe
4044	powershell.exe
2416	powershell.exe
2672	powershell.exe
4172	powershell.exe
1440	powershell.exe
2152	DllCommonsvc.exe
4016	DllCommonsvc.exe
4460	DllCommonsvc.exe
3808	DllCommonsvc.exe
2436	DllCommonsvc.exe
4532	DllCommonsvc.exe
1156	DllCommonsvc.exe
2416	DllCommonsvc.exe
3656	DllCommonsvc.exe
1492	DllCommonsvc.exe
4576	DllCommonsvc.exe
2636	DllCommonsvc.exe
4980	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	DllCommonsvc.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	1208	DllCommonsvc.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	2152	DllCommonsvc.exe
Token: SeDebugPrivilege	4016	DllCommonsvc.exe
Token: SeDebugPrivilege	4460	DllCommonsvc.exe
Token: SeDebugPrivilege	3808	DllCommonsvc.exe
Token: SeDebugPrivilege	2436	DllCommonsvc.exe
Token: SeDebugPrivilege	4532	DllCommonsvc.exe
Token: SeDebugPrivilege	1156	DllCommonsvc.exe
Token: SeDebugPrivilege	2416	DllCommonsvc.exe
Token: SeDebugPrivilege	3656	DllCommonsvc.exe
Token: SeDebugPrivilege	1492	DllCommonsvc.exe
Token: SeDebugPrivilege	4576	DllCommonsvc.exe
Token: SeDebugPrivilege	2636	DllCommonsvc.exe
Token: SeDebugPrivilege	4980	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 744	4380	JaffaCakes118_93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0.exe	83
PID 4380 wrote to memory of 744	4380	JaffaCakes118_93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0.exe	83
PID 4380 wrote to memory of 744	4380	JaffaCakes118_93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0.exe	83
PID 744 wrote to memory of 264	744	WScript.exe	85
PID 744 wrote to memory of 264	744	WScript.exe	85
PID 744 wrote to memory of 264	744	WScript.exe	85
PID 264 wrote to memory of 1284	264	cmd.exe	87
PID 264 wrote to memory of 1284	264	cmd.exe	87
PID 1284 wrote to memory of 1440	1284	DllCommonsvc.exe	117
PID 1284 wrote to memory of 1440	1284	DllCommonsvc.exe	117
PID 1284 wrote to memory of 5044	1284	DllCommonsvc.exe	118
PID 1284 wrote to memory of 5044	1284	DllCommonsvc.exe	118
PID 1284 wrote to memory of 4940	1284	DllCommonsvc.exe	119
PID 1284 wrote to memory of 4940	1284	DllCommonsvc.exe	119
PID 1284 wrote to memory of 2416	1284	DllCommonsvc.exe	120
PID 1284 wrote to memory of 2416	1284	DllCommonsvc.exe	120
PID 1284 wrote to memory of 1084	1284	DllCommonsvc.exe	121
PID 1284 wrote to memory of 1084	1284	DllCommonsvc.exe	121
PID 1284 wrote to memory of 4872	1284	DllCommonsvc.exe	122
PID 1284 wrote to memory of 4872	1284	DllCommonsvc.exe	122
PID 1284 wrote to memory of 4044	1284	DllCommonsvc.exe	124
PID 1284 wrote to memory of 4044	1284	DllCommonsvc.exe	124
PID 1284 wrote to memory of 4220	1284	DllCommonsvc.exe	125
PID 1284 wrote to memory of 4220	1284	DllCommonsvc.exe	125
PID 1284 wrote to memory of 4172	1284	DllCommonsvc.exe	126
PID 1284 wrote to memory of 4172	1284	DllCommonsvc.exe	126
PID 1284 wrote to memory of 2672	1284	DllCommonsvc.exe	128
PID 1284 wrote to memory of 2672	1284	DllCommonsvc.exe	128
PID 1284 wrote to memory of 1208	1284	DllCommonsvc.exe	136
PID 1284 wrote to memory of 1208	1284	DllCommonsvc.exe	136
PID 1208 wrote to memory of 4464	1208	DllCommonsvc.exe	138
PID 1208 wrote to memory of 4464	1208	DllCommonsvc.exe	138
PID 4464 wrote to memory of 3656	4464	cmd.exe	140
PID 4464 wrote to memory of 3656	4464	cmd.exe	140
PID 4464 wrote to memory of 2152	4464	cmd.exe	142
PID 4464 wrote to memory of 2152	4464	cmd.exe	142
PID 2152 wrote to memory of 968	2152	DllCommonsvc.exe	149
PID 2152 wrote to memory of 968	2152	DllCommonsvc.exe	149
PID 968 wrote to memory of 4892	968	cmd.exe	151
PID 968 wrote to memory of 4892	968	cmd.exe	151
PID 968 wrote to memory of 4016	968	cmd.exe	159
PID 968 wrote to memory of 4016	968	cmd.exe	159
PID 4016 wrote to memory of 1016	4016	DllCommonsvc.exe	161
PID 4016 wrote to memory of 1016	4016	DllCommonsvc.exe	161
PID 1016 wrote to memory of 1992	1016	cmd.exe	163
PID 1016 wrote to memory of 1992	1016	cmd.exe	163
PID 1016 wrote to memory of 4460	1016	cmd.exe	165
PID 1016 wrote to memory of 4460	1016	cmd.exe	165
PID 4460 wrote to memory of 3036	4460	DllCommonsvc.exe	169
PID 4460 wrote to memory of 3036	4460	DllCommonsvc.exe	169
PID 3036 wrote to memory of 4728	3036	cmd.exe	171
PID 3036 wrote to memory of 4728	3036	cmd.exe	171
PID 3036 wrote to memory of 3808	3036	cmd.exe	174
PID 3036 wrote to memory of 3808	3036	cmd.exe	174
PID 3808 wrote to memory of 2160	3808	DllCommonsvc.exe	176
PID 3808 wrote to memory of 2160	3808	DllCommonsvc.exe	176
PID 2160 wrote to memory of 5008	2160	cmd.exe	178
PID 2160 wrote to memory of 5008	2160	cmd.exe	178
PID 2160 wrote to memory of 2436	2160	cmd.exe	180
PID 2160 wrote to memory of 2436	2160	cmd.exe	180
PID 2436 wrote to memory of 4616	2436	DllCommonsvc.exe	182
PID 2436 wrote to memory of 4616	2436	DllCommonsvc.exe	182
PID 4616 wrote to memory of 2804	4616	cmd.exe	184
PID 4616 wrote to memory of 2804	4616	cmd.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_93e70be7948903b137cbd13cf87d9418633bd3aeef7135f1af01c016f864cec0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
    - - C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1208
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fELEOgu8eF.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3656
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svsOdT1nlB.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4892
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1992
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\w2PRcJO5W1.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4728
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VJj2LbMAw3.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:5008
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gPrDhQDX5J.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2804
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pFKIY4EPZg.bat"
        18⤵
        
        PID:2936
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1732
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5mXdMdden9.bat"
        20⤵
        
        PID:2548
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:428
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VJj2LbMAw3.bat"
        22⤵
        
        PID:4444
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4448
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat"
        24⤵
        
        PID:976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4424
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hGj9C4kLBH.bat"
        26⤵
        
        PID:1576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2308
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat"
        28⤵
        
        PID:1732
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:560
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iLsGNVHQP6.bat"
        30⤵
        
        PID:928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:2164
        
        C:\Program Files\Crashpad\attachments\DllCommonsvc.exe
        
        "C:\Program Files\Crashpad\attachments\DllCommonsvc.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat"
        32⤵
        
        PID:1004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\providercommon\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Music\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\providercommon\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files\Crashpad\attachments\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Program Files\Crashpad\attachments\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Documents\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Temp\4stVUxPy0P.bat

Filesize
219B

MD5
8805076d8b60f3b3c661425a20df563b

SHA1
7688462b20cab124aaebb82762e6b5743b6aa060

SHA256
51aeeba500327a5f756d3a46d26d9cda7d2a9cf8305bf20b4ea7fe4c0c64f7f0

SHA512
5b9a937b83ae3fccab9cf51dee3cfcf21319f6f85ed8bb867c0730bda11d83d04f46f3f0c5ebe8fe1ab30a02920817bf315c1c11d9bcf49f5f2525b074099c10

Download Submit
C:\Users\Admin\AppData\Local\Temp\5mXdMdden9.bat

Filesize
219B

MD5
18ba7a87cfb09e912680d1cd725a06f0

SHA1
fe0893b965dc3b9b4bca65ecea9a396754318011

SHA256
c6d8f52e6179a2978562cc7b762751a67bcb0a3450503dec7083c775ea7d2574

SHA512
5c212389a40f97a8aef6906c21eba53f826bfb899f2a69732b1d22980cb2515f49682e6dcc6988f8fc0004786f441fefa91f4784c2e91d7f381d82309f9b4f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\VJj2LbMAw3.bat

Filesize
219B

MD5
438ec40c7adeb0cf3b314cab828d2ba0

SHA1
9f2e1965cca5f87c0ddeebf187eeb95238cb77e4

SHA256
717b2a878f74baea7e2c6c90fae964f13b8d988bfc0a2cf484b6e6fac67be659

SHA512
36e2eee9c8331bc91733461043fcb04e940b160bdc2f935130aa3959496c5d6c3a5170374e8c77e46baecdf841ec26adbdafa04b67a2d5e0ae4c3e544e9b4d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat

Filesize
219B

MD5
2741a5aca2a6d1d8f1c196ee3962d148

SHA1
3f867d320e3886bfd4473d4ae0f6e1d5b471d782

SHA256
7c63d1810226f0f3e06f5f64a585f3f89d78b722db565a2ed103e00c4fc8fef9

SHA512
3c3ec900746643006955d6374505d825aaa75c5dd2d7ad40ee21b453f103b47e247eaf8f3215a080fc7617af315764fbfdbe263767624ccc243f9f2c004271b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yvwau0v2.bv0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat

Filesize
219B

MD5
04d788a83987ce8a80f84b5f3092cfe6

SHA1
5ccfa8c806a94255203e3e1e2277e78c333e769f

SHA256
d30151c35e85f0c2f418535105d440dab6512117e8db1273eeb0887c39ed58cf

SHA512
5d057cd4dbd2b640dbb622bc73bada2efe7c4b7afc7713b8abad7141aa514862690de2110ca2c95270a0c66b4686cb15894d3cebfe422332e37e49274999eb3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\fELEOgu8eF.bat

Filesize
219B

MD5
3a7503222517d0ea80b812b014efc25b

SHA1
786c970fd0ff6d0523bc31a72c51d128ee55904c

SHA256
d44ed637ed3b6a87101bee4f559f4ecd60b139a2485bc0664b84e9cbb94301db

SHA512
a4b1cb515f302cbd5b257bf23de47d0b7e8ae086fe14573e72812b1f1132bb0adfe040a75b2fd2ae5790e6f172e5fe6b64d834e79698572f9f1b398cb6f0e014

Download Submit
C:\Users\Admin\AppData\Local\Temp\gPrDhQDX5J.bat

Filesize
219B

MD5
65a7ab79fa23392a0cd489a0307edbb0

SHA1
d24daa3b5561c0665347166c91d51c6c530e0636

SHA256
61e210ac2298f447bcf14dde4c498cddfc30165917f792c179cef75bcf0fbcfb

SHA512
b782d8dc7bd494ad49c60e8482363de2ff7e5b8197ae9412d5c7b85c48872a1d6fd6194e8cbe74737b350fa10072f46c2492dff3ce18417285c443cf917206c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hGj9C4kLBH.bat

Filesize
219B

MD5
6c51308b6c9f1f899a54109d935a04f4

SHA1
05dc7571e23a2fe804eb8e362f1695e0930a3ea2

SHA256
fb90ccf52e5b769b5f6cbcf0f55ce92be46044dbc56493b5e3152aecf7390e74

SHA512
497c296f0804490a30c40dc5d174b1bab3d8d3f90f95eacbc74332cfc4f9d7a01abfcbe322b42ad5bdc4ceec6773451570358eacc36f95c0398ec438b7bef177

Download Submit
C:\Users\Admin\AppData\Local\Temp\iLsGNVHQP6.bat

Filesize
219B

MD5
cd7b50c47849df84eb22c804b6ec4462

SHA1
bcbb7396f392c0f5b8ab97be16f440f3b0480883

SHA256
bbfbea109fea0167448d047aefb4fb93ea89ae860f70e57554011420c9c200f4

SHA512
68c8c326bb16317b628d9a9f50568361b07a867bd7dd94c06bcea38a87d6cb3d735ae5dec80a62b308a6d73cc64a5ecb6c7612770da086d2c49f162e841dea1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\pFKIY4EPZg.bat

Filesize
219B

MD5
2490673961273172a4b828adf1723d14

SHA1
995c4478f33aef9d3e4ad5dc53266242d46cf5c3

SHA256
099c8dc9f4079df429d5da981eb2ce8c254cde8607b9836dfedbedc329b83deb

SHA512
c8fa9b21a4c0ec4108b664e5832351467172c1d60cc44b670dc8b35c0d1d4af0d27eae2e9b910a4ab31b488a1984c92b85349eebf82b4feeeac805ad0ee478be

Download Submit
C:\Users\Admin\AppData\Local\Temp\svsOdT1nlB.bat

Filesize
219B

MD5
81e56d96411c931cb8c5406ad7af6c5d

SHA1
a31c65fb5c32d8497a37bcf62a2fb6e35dc1c4ff

SHA256
bca2269759bca90c6479d601325b321b5c1738f09cc2a54709e169e841ab14f7

SHA512
29867a2cc526582399189a8ff352981ea8fc36af74a9698401bd2b07a8d602b0f1cc7735e0ca2da1e11f4c88e5ed7dc9fde2db4d8c1610713edef159e86d529e

Download Submit
C:\Users\Admin\AppData\Local\Temp\w2PRcJO5W1.bat

Filesize
219B

MD5
6f858fb67dd69d0a1f7dd3ca17e4dd97

SHA1
ba5ec7eb5be29196916e5cfd4e5f62814021192d

SHA256
8f1074f8b621340abf079efa72b7ffcd6471e5513b68b403f7fc24c420cdfec4

SHA512
382268dc57ad2f7dfdde14bc8a5ec44c850be4e712b04dedcef25267331f182838d57d491742b940e8fc749d3457219c4c4efea6f015fccaf77537cec45d8b3c

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1208-129-0x000000001B290000-0x000000001B2A2000-memory.dmp

Filesize
72KB

Download
memory/1284-12-0x00007FFB49113000-0x00007FFB49115000-memory.dmp

Filesize
8KB

Download
memory/1284-15-0x00000000019A0000-0x00000000019AC000-memory.dmp

Filesize
48KB

Download
memory/1284-17-0x0000000001990000-0x000000000199C000-memory.dmp

Filesize
48KB

Download
memory/1284-16-0x0000000001980000-0x000000000198C000-memory.dmp

Filesize
48KB

Download
memory/1284-13-0x0000000000F00000-0x0000000001010000-memory.dmp

Filesize
1.1MB

Download
memory/1284-14-0x0000000001960000-0x0000000001972000-memory.dmp

Filesize
72KB

Download
memory/1492-228-0x000000001C8A0000-0x000000001CA49000-memory.dmp

Filesize
1.7MB

Download
memory/2416-214-0x000000001BFA0000-0x000000001C149000-memory.dmp

Filesize
1.7MB

Download
memory/2636-238-0x00000000014D0000-0x00000000014E2000-memory.dmp

Filesize
72KB

Download
memory/2636-243-0x000000001C830000-0x000000001C9D9000-memory.dmp

Filesize
1.7MB

Download
memory/3656-221-0x000000001C7E0000-0x000000001C989000-memory.dmp

Filesize
1.7MB

Download
memory/3808-185-0x0000000001040000-0x0000000001052000-memory.dmp

Filesize
72KB

Download
memory/4460-177-0x00000000017F0000-0x0000000001802000-memory.dmp

Filesize
72KB

Download
memory/4460-182-0x000000001CA80000-0x000000001CC29000-memory.dmp

Filesize
1.7MB

Download
memory/4576-235-0x000000001CB40000-0x000000001CCE9000-memory.dmp

Filesize
1.7MB

Download
memory/4980-246-0x00000000024E0000-0x00000000024F2000-memory.dmp

Filesize
72KB

Download
memory/4980-252-0x000000001BED0000-0x000000001C079000-memory.dmp

Filesize
1.7MB

Download
memory/5044-52-0x000001B187DB0000-0x000001B187DD2000-memory.dmp

Filesize
136KB

Download