dcrat | 21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186.exe
Size

1.3MB
MD5

5cb74f0bef786ab2de98f621ab57944c
SHA1

ff105758cbd8886db6e5da721946da07240ea233
SHA256

21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186
SHA512

1731985b82a8b4e53038b19e95c1ac9887be4855b10b5c8c8370018ccfe54a583086527c62adeb62e9e81952a7f28a64a786b3f4f90f85bb7f2420f52a69c6f7
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	876	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	876	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c9e-10.dat	dcrat
behavioral2/memory/3116-13-0x00000000007D0000-0x00000000008E0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1792	powershell.exe
2764	powershell.exe
5000	powershell.exe
2184	powershell.exe
3160	powershell.exe
1316	powershell.exe
3316	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	JaffaCakes118_21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	sppsvc.exe

Executes dropped EXE 14 IoCs

pid	Process
3116	DllCommonsvc.exe
3528	sppsvc.exe
4000	sppsvc.exe
4376	sppsvc.exe
4772	sppsvc.exe
2032	sppsvc.exe
3032	sppsvc.exe
348	sppsvc.exe
3776	sppsvc.exe
4892	sppsvc.exe
3404	sppsvc.exe
4812	sppsvc.exe
884	sppsvc.exe
4580	sppsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
39	raw.githubusercontent.com
52	raw.githubusercontent.com
53	raw.githubusercontent.com
55	raw.githubusercontent.com
18	raw.githubusercontent.com
25	raw.githubusercontent.com
40	raw.githubusercontent.com
43	raw.githubusercontent.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com
47	raw.githubusercontent.com
54	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\sysmon.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\sysmon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\121e5b5079f7c0	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\55b276f4edf653	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\RemotePackages\System.exe	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\27d1bcfc3c54e0	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	JaffaCakes118_21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	sppsvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3232	schtasks.exe
2592	schtasks.exe
116	schtasks.exe
2656	schtasks.exe
4508	schtasks.exe
5032	schtasks.exe
3308	schtasks.exe
1188	schtasks.exe
4276	schtasks.exe
3028	schtasks.exe
1320	schtasks.exe
3728	schtasks.exe
4388	schtasks.exe
3616	schtasks.exe
1968	schtasks.exe
1452	schtasks.exe
2992	schtasks.exe
1944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3116	DllCommonsvc.exe
3116	DllCommonsvc.exe
3116	DllCommonsvc.exe
3116	DllCommonsvc.exe
3116	DllCommonsvc.exe
3116	DllCommonsvc.exe
3116	DllCommonsvc.exe
3116	DllCommonsvc.exe
3116	DllCommonsvc.exe
2764	powershell.exe
1792	powershell.exe
5000	powershell.exe
3316	powershell.exe
2184	powershell.exe
1316	powershell.exe
3160	powershell.exe
5000	powershell.exe
3160	powershell.exe
2764	powershell.exe
1316	powershell.exe
1792	powershell.exe
2184	powershell.exe
3316	powershell.exe
3528	sppsvc.exe
4000	sppsvc.exe
4376	sppsvc.exe
4772	sppsvc.exe
2032	sppsvc.exe
3032	sppsvc.exe
348	sppsvc.exe
3776	sppsvc.exe
4892	sppsvc.exe
3404	sppsvc.exe
4812	sppsvc.exe
884	sppsvc.exe
4580	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	DllCommonsvc.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	3160	powershell.exe
Token: SeDebugPrivilege	3528	sppsvc.exe
Token: SeDebugPrivilege	4000	sppsvc.exe
Token: SeDebugPrivilege	4376	sppsvc.exe
Token: SeDebugPrivilege	4772	sppsvc.exe
Token: SeDebugPrivilege	2032	sppsvc.exe
Token: SeDebugPrivilege	3032	sppsvc.exe
Token: SeDebugPrivilege	348	sppsvc.exe
Token: SeDebugPrivilege	3776	sppsvc.exe
Token: SeDebugPrivilege	4892	sppsvc.exe
Token: SeDebugPrivilege	3404	sppsvc.exe
Token: SeDebugPrivilege	4812	sppsvc.exe
Token: SeDebugPrivilege	884	sppsvc.exe
Token: SeDebugPrivilege	4580	sppsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3004	2804	JaffaCakes118_21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186.exe	82
PID 2804 wrote to memory of 3004	2804	JaffaCakes118_21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186.exe	82
PID 2804 wrote to memory of 3004	2804	JaffaCakes118_21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186.exe	82
PID 3004 wrote to memory of 2668	3004	WScript.exe	83
PID 3004 wrote to memory of 2668	3004	WScript.exe	83
PID 3004 wrote to memory of 2668	3004	WScript.exe	83
PID 2668 wrote to memory of 3116	2668	cmd.exe	85
PID 2668 wrote to memory of 3116	2668	cmd.exe	85
PID 3116 wrote to memory of 3160	3116	DllCommonsvc.exe	105
PID 3116 wrote to memory of 3160	3116	DllCommonsvc.exe	105
PID 3116 wrote to memory of 1316	3116	DllCommonsvc.exe	106
PID 3116 wrote to memory of 1316	3116	DllCommonsvc.exe	106
PID 3116 wrote to memory of 3316	3116	DllCommonsvc.exe	107
PID 3116 wrote to memory of 3316	3116	DllCommonsvc.exe	107
PID 3116 wrote to memory of 2184	3116	DllCommonsvc.exe	108
PID 3116 wrote to memory of 2184	3116	DllCommonsvc.exe	108
PID 3116 wrote to memory of 5000	3116	DllCommonsvc.exe	109
PID 3116 wrote to memory of 5000	3116	DllCommonsvc.exe	109
PID 3116 wrote to memory of 2764	3116	DllCommonsvc.exe	111
PID 3116 wrote to memory of 2764	3116	DllCommonsvc.exe	111
PID 3116 wrote to memory of 1792	3116	DllCommonsvc.exe	112
PID 3116 wrote to memory of 1792	3116	DllCommonsvc.exe	112
PID 3116 wrote to memory of 2392	3116	DllCommonsvc.exe	119
PID 3116 wrote to memory of 2392	3116	DllCommonsvc.exe	119
PID 2392 wrote to memory of 928	2392	cmd.exe	121
PID 2392 wrote to memory of 928	2392	cmd.exe	121
PID 2392 wrote to memory of 3528	2392	cmd.exe	125
PID 2392 wrote to memory of 3528	2392	cmd.exe	125
PID 3528 wrote to memory of 5080	3528	sppsvc.exe	129
PID 3528 wrote to memory of 5080	3528	sppsvc.exe	129
PID 5080 wrote to memory of 644	5080	cmd.exe	131
PID 5080 wrote to memory of 644	5080	cmd.exe	131
PID 5080 wrote to memory of 4000	5080	cmd.exe	132
PID 5080 wrote to memory of 4000	5080	cmd.exe	132
PID 4000 wrote to memory of 2116	4000	sppsvc.exe	133
PID 4000 wrote to memory of 2116	4000	sppsvc.exe	133
PID 2116 wrote to memory of 4288	2116	cmd.exe	135
PID 2116 wrote to memory of 4288	2116	cmd.exe	135
PID 2116 wrote to memory of 4376	2116	cmd.exe	138
PID 2116 wrote to memory of 4376	2116	cmd.exe	138
PID 4376 wrote to memory of 4552	4376	sppsvc.exe	139
PID 4376 wrote to memory of 4552	4376	sppsvc.exe	139
PID 4552 wrote to memory of 5068	4552	cmd.exe	141
PID 4552 wrote to memory of 5068	4552	cmd.exe	141
PID 4552 wrote to memory of 4772	4552	cmd.exe	142
PID 4552 wrote to memory of 4772	4552	cmd.exe	142
PID 4772 wrote to memory of 4436	4772	sppsvc.exe	143
PID 4772 wrote to memory of 4436	4772	sppsvc.exe	143
PID 4436 wrote to memory of 4156	4436	cmd.exe	145
PID 4436 wrote to memory of 4156	4436	cmd.exe	145
PID 4436 wrote to memory of 2032	4436	cmd.exe	146
PID 4436 wrote to memory of 2032	4436	cmd.exe	146
PID 2032 wrote to memory of 2996	2032	sppsvc.exe	147
PID 2032 wrote to memory of 2996	2032	sppsvc.exe	147
PID 2996 wrote to memory of 448	2996	cmd.exe	149
PID 2996 wrote to memory of 448	2996	cmd.exe	149
PID 2996 wrote to memory of 3032	2996	cmd.exe	150
PID 2996 wrote to memory of 3032	2996	cmd.exe	150
PID 3032 wrote to memory of 3228	3032	sppsvc.exe	151
PID 3032 wrote to memory of 3228	3032	sppsvc.exe	151
PID 3228 wrote to memory of 1852	3228	cmd.exe	153
PID 3228 wrote to memory of 1852	3228	cmd.exe	153
PID 3228 wrote to memory of 348	3228	cmd.exe	154
PID 3228 wrote to memory of 348	3228	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_21bf8c1dac8fc08ee767355683cf189abc3448eca1b351070e843ce29e40b186.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hoaJIq3kmc.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2392
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:928
      - C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:644
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M1TWCJOn7d.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4288
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\auWhjrprfd.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:5068
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OxVZsORhRP.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4156
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CIMKRyAEqW.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:448
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qRj2XQE6t6.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1852
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CE969IshF.bat"
        19⤵
        
        PID:1944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2840
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FEON83D8AI.bat"
        21⤵
        
        PID:4512
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3916
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9BpIS9nw5f.bat"
        23⤵
        
        PID:4068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3592
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CE969IshF.bat"
        25⤵
        
        PID:4008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2236
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ww6iFNwlpp.bat"
        27⤵
        
        PID:4020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2516
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"
        29⤵
        
        PID:1880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:2396
        
        C:\providercommon\sppsvc.exe
        
        "C:\providercommon\sppsvc.exe"
        30⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\RemotePackages\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\RemotePackages\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Desktop\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Desktop\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Desktop\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sppsvc.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat

Filesize
193B

MD5
481e04d427371a7f2e4817779fe0e664

SHA1
da6ca038263ca8e6aab5f5b50b1e337275d4f91a

SHA256
272dac89055ee5b49d1972a70afb7224d9b81e52764a36f9c93c068c7d385a36

SHA512
a0dfc08a11d620dd7d5a3cf2695244f2c4f56cc0e88d3476ac1bba1180acfb534d2687662ff6352b772defbb6790041a208161227a5207eb30ca4e10c2e887c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1CE969IshF.bat

Filesize
193B

MD5
c76161732f8ef4831863ec243253638d

SHA1
6e704b76ce1e76be201250bf09a00c128fb05401

SHA256
f81b4b795af9b5b123d7f6a44f8ab3200af83917d9ad82db527cece038fbf5c7

SHA512
7cc7f9d0f90652113b3701834bb0bba4018085085ff1df85bd6a12216f2062fd1103f2cf901a51305964da6fea5e7fc00a464c0cb9d95e7b5ea6a91a7ef25f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9BpIS9nw5f.bat

Filesize
193B

MD5
3cc72724f181b256e8dab196c3d3c0b2

SHA1
aee1f47dfd650cc5e14b5a478d748ba6c3267c6a

SHA256
c9bf2cc5f8cfbed118b906157e6689fdcb5e6a441f87286f3791056ebb3ca140

SHA512
d72b46b682a68a2dff2f5587a54edb4865398645173c5ee7607b40a899f1788eb0b2f1faeb937a9ffc1eb51041dd9464d920f817013f21fd048b76e3b6c50b61

Download Submit
C:\Users\Admin\AppData\Local\Temp\CIMKRyAEqW.bat

Filesize
193B

MD5
b4e5c2dbe601b9238c25a32d104ad710

SHA1
780b9619c7d3499686e6339b036735e39902d440

SHA256
09bbe6617aa1d7ac238501796136b3f0aae46bd8238b45534963b20c123ab20d

SHA512
7260304b2de36c9aa329125e1ee045771ba28a4a6f3c0525bf0ca25a1deab606499677658b269dc3096454202250f49b432952c5e7300128db2524f051b026a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEON83D8AI.bat

Filesize
193B

MD5
433909759e5b48f760a8f38174ecef74

SHA1
a88e385047b26d610a4a22d953a7e4cda5d3aa20

SHA256
0d1abd4eb33fb1634eb0409b91a06ebc9725ed913c82c5fd55c81b5a05c12678

SHA512
3110558e5accc50a932790ab3aac1176170fadba8193bcb234d3d8cc7836a42457205c04dff0dd333cbb0860cda8d26d1a4738a1ecf7bbc480ff6bb981e738cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\M1TWCJOn7d.bat

Filesize
193B

MD5
56a3df32730508fc304a1277726eff33

SHA1
e94fae5030f3b080a2c9acb548f559811533a24b

SHA256
b9b443fa16200fbaa187c7699a5b4581e01583b5cb8f92401b7910e2ad6226d0

SHA512
0d9ab544fb3f5efd46099b9358c4094449ad9c3ddb1d8c72e1821411ab9b5f4fb2b098cc8d14812c3b559fc81acaf38bfa3e50aedf983e0ed3f0c80f72c7d9a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\OxVZsORhRP.bat

Filesize
193B

MD5
526df9bb5b8cf6d77865e6151126038f

SHA1
8836e43eda3592f17bf95eb9688010fd02e78a96

SHA256
e4d9c3ba6c32f62288b77b002d3df015deedf5a494c04e19a1b2ad3c7a89367e

SHA512
213f40ec3c230fc8a233f94383d23682000c831daf447dc5c42eaf4e26bc74bc773503198834704c55787737e7aaefadf7badc09dff1df642a019f9f60b7af1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ww6iFNwlpp.bat

Filesize
193B

MD5
4125d911f0f4a5e9f084c6a20c97cdfa

SHA1
2bb533f3641120cdc823216ffe004703c3c714f2

SHA256
8c74da14152fff4ecd5fe3bb426733312e53b5b9d63e3e4bbb8a8b3b80a3eaa2

SHA512
409a403e8a9c9d2c4d4d023c30b62dbe893d8b9d3118eae06ef3046e997df679bd08b2c96ee0357bba907e4e3f0d857a2ff800ad2f28065bb193d0288d1770ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hceyi0un.wfb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\auWhjrprfd.bat

Filesize
193B

MD5
fff134ed46db2e795a729c669f9c6d16

SHA1
fc31e8acb6f7634bc62e8fb762abf06287f452bd

SHA256
dd5181771354c7e8247497e2e976e28e36af5b3793ca5a71e1299a6808430204

SHA512
f78ded2efb75cdcf94524ddb07fd3783024bb2611017cba3807e36dbd54ef1ec37730b29c0b5628d437bf8f7eb963d3de719ceaf6669f7f7cb443d1bb8743db5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hoaJIq3kmc.bat

Filesize
193B

MD5
941a3f14b365fe2f2db9f11fd407955a

SHA1
de15db26d09ea423b805e91e3221255ce4537d3a

SHA256
0323d9c442ac93aecc878a59deaedc4a698ff0b3ac2a661f3e222dd991ff09c3

SHA512
9b5bb8575af476f9bec0b984e9417132cfc2e660588352687ff8d0beacecef39da9aeadbba4c2012063fa1d20a3834065b410638b1cf32e04f50b4f7242acc6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat

Filesize
193B

MD5
1c69571bb8d398337ea762e3532d2193

SHA1
4517e25520da3ec97ac8a317c0c07ec5a06f46a2

SHA256
ad48671effeb7d73019c63666263ca3775dd7ed18b02e23dc4e2a9c9a94c1f41

SHA512
3bb2aeca1cd3159b91a6c87fae507c4daeceec62ae4acf5243ca0bc604d2af493d460c17367d8d73ee1c8378040d1f6841c30224faa1b20c11a6ce9087979a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\qRj2XQE6t6.bat

Filesize
193B

MD5
bd2b73675590445fe32ecd8d65164a66

SHA1
634721f2537e7ec8a16617ffc7700bf04b26cd82

SHA256
33bcfbfb99a0c04cf71eff6220ec5a1b1779a4def85cde2f1a5833bacec610cb

SHA512
11c5ee9b93df3393447ca969d9ac6abdfc330e2e6a0fbe81da0e77914ef559ef23b43d90ec0a28ac7197a811c1b787e37d8c36ce8cf61f00cbc9c06a4a38912a

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/348-157-0x0000000002E60000-0x0000000002E72000-memory.dmp

Filesize
72KB

Download
memory/2764-34-0x0000024D75280000-0x0000024D752A2000-memory.dmp

Filesize
136KB

Download
memory/3032-150-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Filesize
72KB

Download
memory/3116-12-0x00007FF9A0523000-0x00007FF9A0525000-memory.dmp

Filesize
8KB

Download
memory/3116-13-0x00000000007D0000-0x00000000008E0000-memory.dmp

Filesize
1.1MB

Download
memory/3116-14-0x00000000011F0000-0x0000000001202000-memory.dmp

Filesize
72KB

Download
memory/3116-15-0x0000000001200000-0x000000000120C000-memory.dmp

Filesize
48KB

Download
memory/3116-16-0x0000000002B10000-0x0000000002B1C000-memory.dmp

Filesize
48KB

Download
memory/3116-17-0x0000000002B20000-0x0000000002B2C000-memory.dmp

Filesize
48KB

Download
memory/3776-164-0x0000000001680000-0x0000000001692000-memory.dmp

Filesize
72KB

Download
memory/4000-124-0x0000000002EF0000-0x0000000002F02000-memory.dmp

Filesize
72KB

Download
memory/4580-195-0x000000001B870000-0x000000001B882000-memory.dmp

Filesize
72KB

Download
memory/4772-137-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download