dcrat | d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8.exe
Size

1.3MB
MD5

47051bf9d9a9a9996aec54269a069779
SHA1

db82e1509a63fae794f6b83d2fc042b5ab5081dc
SHA256

d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8
SHA512

a232b55420e54fd9b96c5aed64e8fae60f7fa333f3de4c1c62e813d965ece4f1cd5e1a7a4850e8eebf874ace56b86b821a43bf10da4597f8effe21c7c1cf4d8b
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	4788	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	4788	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b72-10.dat	dcrat
behavioral2/memory/3964-13-0x00000000003D0000-0x00000000004E0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1508	powershell.exe
4656	powershell.exe
3716	powershell.exe
1576	powershell.exe
4244	powershell.exe
2384	powershell.exe
3500	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 16 IoCs

pid	Process
3964	DllCommonsvc.exe
2388	dllhost.exe
1728	dllhost.exe
860	dllhost.exe
464	dllhost.exe
3208	dllhost.exe
4528	dllhost.exe
4400	dllhost.exe
3024	dllhost.exe
2532	dllhost.exe
3648	dllhost.exe
3696	dllhost.exe
4832	dllhost.exe
3324	dllhost.exe
544	dllhost.exe
3528	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
56	raw.githubusercontent.com
57	raw.githubusercontent.com
17	raw.githubusercontent.com
32	raw.githubusercontent.com
44	raw.githubusercontent.com
48	raw.githubusercontent.com
19	raw.githubusercontent.com
42	raw.githubusercontent.com
49	raw.githubusercontent.com
59	raw.githubusercontent.com
26	raw.githubusercontent.com
41	raw.githubusercontent.com
58	raw.githubusercontent.com
60	raw.githubusercontent.com
43	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\5b884080fd4f94	DllCommonsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\addins\smss.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\addins\smss.exe	DllCommonsvc.exe
File created	C:\Windows\addins\69ddcba757bf72	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3224	schtasks.exe
3728	schtasks.exe
1812	schtasks.exe
1368	schtasks.exe
4996	schtasks.exe
1832	schtasks.exe
4160	schtasks.exe
3388	schtasks.exe
3696	schtasks.exe
4100	schtasks.exe
2776	schtasks.exe
3536	schtasks.exe
3768	schtasks.exe
1628	schtasks.exe
444	schtasks.exe
3320	schtasks.exe
2548	schtasks.exe
1960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3964	DllCommonsvc.exe
3964	DllCommonsvc.exe
3964	DllCommonsvc.exe
3964	DllCommonsvc.exe
3964	DllCommonsvc.exe
3964	DllCommonsvc.exe
3964	DllCommonsvc.exe
3964	DllCommonsvc.exe
3964	DllCommonsvc.exe
3964	DllCommonsvc.exe
3964	DllCommonsvc.exe
1576	powershell.exe
3500	powershell.exe
4656	powershell.exe
4244	powershell.exe
2384	powershell.exe
1508	powershell.exe
4244	powershell.exe
3716	powershell.exe
1576	powershell.exe
2388	dllhost.exe
4656	powershell.exe
3500	powershell.exe
2384	powershell.exe
1508	powershell.exe
3716	powershell.exe
1728	dllhost.exe
860	dllhost.exe
464	dllhost.exe
3208	dllhost.exe
4528	dllhost.exe
4400	dllhost.exe
3024	dllhost.exe
2532	dllhost.exe
3648	dllhost.exe
3696	dllhost.exe
4832	dllhost.exe
3324	dllhost.exe
544	dllhost.exe
3528	dllhost.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3964	DllCommonsvc.exe
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	2388	dllhost.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	1728	dllhost.exe
Token: SeDebugPrivilege	860	dllhost.exe
Token: SeDebugPrivilege	464	dllhost.exe
Token: SeDebugPrivilege	3208	dllhost.exe
Token: SeDebugPrivilege	4528	dllhost.exe
Token: SeDebugPrivilege	4400	dllhost.exe
Token: SeDebugPrivilege	3024	dllhost.exe
Token: SeDebugPrivilege	2532	dllhost.exe
Token: SeDebugPrivilege	3648	dllhost.exe
Token: SeDebugPrivilege	3696	dllhost.exe
Token: SeDebugPrivilege	4832	dllhost.exe
Token: SeDebugPrivilege	3324	dllhost.exe
Token: SeDebugPrivilege	544	dllhost.exe
Token: SeDebugPrivilege	3528	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2788	4784	JaffaCakes118_d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8.exe	83
PID 4784 wrote to memory of 2788	4784	JaffaCakes118_d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8.exe	83
PID 4784 wrote to memory of 2788	4784	JaffaCakes118_d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8.exe	83
PID 2788 wrote to memory of 3972	2788	WScript.exe	85
PID 2788 wrote to memory of 3972	2788	WScript.exe	85
PID 2788 wrote to memory of 3972	2788	WScript.exe	85
PID 3972 wrote to memory of 3964	3972	cmd.exe	87
PID 3972 wrote to memory of 3964	3972	cmd.exe	87
PID 3964 wrote to memory of 1508	3964	DllCommonsvc.exe	108
PID 3964 wrote to memory of 1508	3964	DllCommonsvc.exe	108
PID 3964 wrote to memory of 4656	3964	DllCommonsvc.exe	109
PID 3964 wrote to memory of 4656	3964	DllCommonsvc.exe	109
PID 3964 wrote to memory of 3716	3964	DllCommonsvc.exe	110
PID 3964 wrote to memory of 3716	3964	DllCommonsvc.exe	110
PID 3964 wrote to memory of 1576	3964	DllCommonsvc.exe	111
PID 3964 wrote to memory of 1576	3964	DllCommonsvc.exe	111
PID 3964 wrote to memory of 4244	3964	DllCommonsvc.exe	112
PID 3964 wrote to memory of 4244	3964	DllCommonsvc.exe	112
PID 3964 wrote to memory of 2384	3964	DllCommonsvc.exe	113
PID 3964 wrote to memory of 2384	3964	DllCommonsvc.exe	113
PID 3964 wrote to memory of 3500	3964	DllCommonsvc.exe	114
PID 3964 wrote to memory of 3500	3964	DllCommonsvc.exe	114
PID 3964 wrote to memory of 2388	3964	DllCommonsvc.exe	121
PID 3964 wrote to memory of 2388	3964	DllCommonsvc.exe	121
PID 2388 wrote to memory of 808	2388	dllhost.exe	128
PID 2388 wrote to memory of 808	2388	dllhost.exe	128
PID 808 wrote to memory of 3536	808	cmd.exe	130
PID 808 wrote to memory of 3536	808	cmd.exe	130
PID 808 wrote to memory of 1728	808	cmd.exe	133
PID 808 wrote to memory of 1728	808	cmd.exe	133
PID 1728 wrote to memory of 2184	1728	dllhost.exe	139
PID 1728 wrote to memory of 2184	1728	dllhost.exe	139
PID 2184 wrote to memory of 4944	2184	cmd.exe	141
PID 2184 wrote to memory of 4944	2184	cmd.exe	141
PID 2184 wrote to memory of 860	2184	cmd.exe	143
PID 2184 wrote to memory of 860	2184	cmd.exe	143
PID 860 wrote to memory of 2504	860	dllhost.exe	147
PID 860 wrote to memory of 2504	860	dllhost.exe	147
PID 2504 wrote to memory of 4860	2504	cmd.exe	149
PID 2504 wrote to memory of 4860	2504	cmd.exe	149
PID 2504 wrote to memory of 464	2504	cmd.exe	152
PID 2504 wrote to memory of 464	2504	cmd.exe	152
PID 464 wrote to memory of 4864	464	dllhost.exe	154
PID 464 wrote to memory of 4864	464	dllhost.exe	154
PID 4864 wrote to memory of 3648	4864	cmd.exe	156
PID 4864 wrote to memory of 3648	4864	cmd.exe	156
PID 4864 wrote to memory of 3208	4864	cmd.exe	158
PID 4864 wrote to memory of 3208	4864	cmd.exe	158
PID 3208 wrote to memory of 376	3208	dllhost.exe	160
PID 3208 wrote to memory of 376	3208	dllhost.exe	160
PID 376 wrote to memory of 2448	376	cmd.exe	162
PID 376 wrote to memory of 2448	376	cmd.exe	162
PID 376 wrote to memory of 4528	376	cmd.exe	164
PID 376 wrote to memory of 4528	376	cmd.exe	164
PID 4528 wrote to memory of 1168	4528	dllhost.exe	166
PID 4528 wrote to memory of 1168	4528	dllhost.exe	166
PID 1168 wrote to memory of 628	1168	cmd.exe	168
PID 1168 wrote to memory of 628	1168	cmd.exe	168
PID 1168 wrote to memory of 4400	1168	cmd.exe	170
PID 1168 wrote to memory of 4400	1168	cmd.exe	170
PID 4400 wrote to memory of 4944	4400	dllhost.exe	173
PID 4400 wrote to memory of 4944	4400	dllhost.exe	173
PID 4944 wrote to memory of 2920	4944	cmd.exe	175
PID 4944 wrote to memory of 2920	4944	cmd.exe	175

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d2b7e3f6f61cf721a071f454124c3b4d4dae2d31fd8fb6a04396ea18d3b844b8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3500
    - - C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2388
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN1wkOWwnv.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3536
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4944
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6n1oUPmZQq.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4860
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n3vYZhDjEH.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3648
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XC59y11ueh.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2448
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:628
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2920
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat"
        20⤵
        
        PID:4116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2980
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tlraSVrJxn.bat"
        22⤵
        
        PID:3268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4836
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat"
        24⤵
        
        PID:4408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4200
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat"
        26⤵
        
        PID:1940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4528
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mylROGge0S.bat"
        28⤵
        
        PID:4524
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4612
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9avng9MHpa.bat"
        30⤵
        
        PID:4752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:5016
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0tZmJrpaGF.bat"
        32⤵
        
        PID:2504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:600
        
        C:\providercommon\dllhost.exe
        
        "C:\providercommon\dllhost.exe"
        33⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\addins\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\0tZmJrpaGF.bat

Filesize
194B

MD5
b4ff43efe94485a78bd4b7d916a5e142

SHA1
232d96816431d14ac637b24154b7cad6f6f1b939

SHA256
4727ce048dcf52163bab44aa9f4678b72ac5f4cb17941890977ffaa93201256d

SHA512
9c44723db6f0088cc4dd0c60c099d722e81becb7b2ced5c1f42411a6d2e4b3879a322e4ef111cbd202cca296de1d4867557512419b63489a76eea7e52fe8cfd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat

Filesize
194B

MD5
946b3b516ab9692fbe1b63b67aa42cd7

SHA1
0e80a6b93c8f2dc4051ea9771dd3f2895d3e686c

SHA256
5a3c38b9e7537c6c93abf8fba97757538982cf71208926af9d7139c3fa7b0990

SHA512
0729d38a54b884a987a4a0376828c2ad3ad94a632d5431fdb39ee66fe85f11a3494bcbc3a77788876d6570ca462f6fa8158364397765df94ca1803860ff98c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat

Filesize
194B

MD5
4846f66c771936d9a2575992475eee59

SHA1
bb10f9b04d3cf8c22a84862b3f2922923a9081b5

SHA256
974d160acb9951ebb649632da5f5dc305ab584177d788ba6acd1d9a09f45ca1d

SHA512
45aa25d67529c9dfde6e772ce02afc0857fbd6ea726f2b3fce6ad9f16f05ff18885c6f1772e2671c9a45908cf2e03702b0ea8c39e49e1c2d7c1a9b3b8c1325da

Download Submit
C:\Users\Admin\AppData\Local\Temp\6n1oUPmZQq.bat

Filesize
194B

MD5
5be362a300c0c0d09d2dc460846bbeca

SHA1
01a71c3f77b99f5cbf08bb9078b757587f3855e4

SHA256
416513f79c96c82ccafcdc1a4b0c964d4d986ade4c0acf2a31885373ccdede95

SHA512
20c5c4b4b6101ce56c56de5be81767b476712aa0b967a90c95499d904c4e51279438b159fcbb65942c4d81e69945ae1167fe6bda71428711ed8df6a6241f764b

Download Submit
C:\Users\Admin\AppData\Local\Temp\9avng9MHpa.bat

Filesize
194B

MD5
20c9af4a5da8790e8c940a4a02fddeb7

SHA1
4aff2e6aa0196ba36c535471ad4316d559209dea

SHA256
d447b36aa622159cb92b8c8d9e5b3fe1b801a78624ebe5673027696ba9733d68

SHA512
573eb65ddc711c802cbe0814fc2b642edf552f577a004256a960bff155d8715bc841c2923ee3bd3d8fbebde136dd6358204ee991e622cc486cf407db2061f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\GN1wkOWwnv.bat

Filesize
194B

MD5
afe6e154459d9bbc9fb592c546cdcdbe

SHA1
0a08006a11c0cb3a6a2829224ccb8962f43621cd

SHA256
c66be1f5617de03d597a04a98dd2cfa1e97b2f92a7382fe03c6264dfd64c8fd4

SHA512
31361dd6c00e731f8fdeca3d1a51456b172c5fe10be6a82fdc45f9f82d93914330ca0ce5abb57ab67902eba193b60ad2bd275c1b168b89bffba5af7ae21338a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat

Filesize
194B

MD5
adb2a1b3f1fdb68431d3d21eff0f9d1e

SHA1
f4ea840891dc8c764506ce81827dda354b2a0dea

SHA256
e210b5e150b34e6d438b024b19f61c79d766f00e80db0a8b131ed38df4d593da

SHA512
f739783aade9ad8f90b7131a2741c2e865b62cde0bfd22e47325d7c42e68bbf89bcf06fba98d922bb97100c40a0963b2b6b0b2d493e13c0195f06029c624d57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XC59y11ueh.bat

Filesize
194B

MD5
66256fa38e81d4eae24999fc463d3df4

SHA1
e33ea2fb7e442de939f01976de8465240f83c7c2

SHA256
2c355a36c75cbbcb0dde5bedf371264aa2340b2ca91d3e0f1a24041cca86aada

SHA512
e1a52bf93efdeb67ed7a44fcdf21b829e35cbe6ce88fe91149a7408ed07ff0c440c95ec2f4eed1a40bf94f536a5d6dabe12e4d7ecbfcd218bd657dc0f5e5bbd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h2iutreb.r2o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fBgHK1Vy37.bat

Filesize
194B

MD5
789374b4993023aa3b7db9d43b5ed677

SHA1
57a880c564c395154a23f9552b588fd3e9d66a58

SHA256
8b8d504d8417b11d2910059e4cfdc35c6c99a19288b8d8ce759fe9bc1546a33f

SHA512
add650997fd77c210bc896225f715ab720cab800b025cf54974e4f8190c9b13f13ac76fd4be2936c6f577181211981a71836d26fb8f7fa838638ef5e9f83fd1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mylROGge0S.bat

Filesize
194B

MD5
1c803f129c9dedaea3c2bdcdcf77b013

SHA1
2c47cb645b85c5a0502ad2c6e6cd21613eb79da0

SHA256
b013f7f72f9515160dea0bd6fa7ab8390ddc1e9290c259cdd6bef6775bcea872

SHA512
1bd55b4cc9ecedb6eb0d9c47a8a1b5b9e50aa96cf9f87bddeb9ce21cf10d347bc956915527bc56113bf9c3dfd52f578b1ccddc551bef53a6a703493a2a50a7c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\n3vYZhDjEH.bat

Filesize
194B

MD5
d45fb5caed2f8ec7d5f2dac3a09154b6

SHA1
b8b42a1913929e7ca6c334263655649ae4b0fe75

SHA256
dfbc55eea0e9c0dbbda400d741612b6ad83ff8db11e979045ebcba5851c06c52

SHA512
fda264339b1f93a2dadd9050a9873e76642fef2ea6a9453c1e902a6caea5a39fd1c6c687bd79bf5810b1fae7dd191deb6b371fa68dc4d1a8c3e39a47f223cad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tlraSVrJxn.bat

Filesize
194B

MD5
b2397647b1a541c97accd46bf00367bd

SHA1
aff4656d15ae4ad7ad0020a669ae3d52f6928b9f

SHA256
66b6d1db35b066928d4b708c6d9b56a7804c5843d6657eba59cbed59993fac70

SHA512
49b7d76b8e8ea80fccfc6e3bfa441f144e9bf6717b4630708a17deb449f6a12e168d36cf143bfb88bed6ab06a9a797397d5cd581f5f093068f21123f3645b12d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat

Filesize
194B

MD5
c59454e195bb9a78fe370302e95023eb

SHA1
58fdd29cadfd56e1147a1a2f25fc2ffbb45c0fe2

SHA256
cc081922e812a509bd452526e85b8efd0c2358157321b2c54d7b6f8e70ee0be6

SHA512
e32d773fdf49191a93bfabc7985f5fbbd6a0ec27ce582794590bfcb597a4f6adec5ed797a99c7e5a6b09714f595b6f787fd4f95c82f06c27f8e1f4c61ae54d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat

Filesize
194B

MD5
420fe421c35d413b84cb78077351492b

SHA1
ad0de816ddd5ff3dc4ecc4a1d376dc0e693339cf

SHA256
d4b159538b783aaa14d794099b078ab6e35487954a063d2feaa87f0b20927380

SHA512
34fedee126a1e639735459f2fa6be71436bec9689cea09c9557d348e958d1276f05138297c73ee3f2a9db3c76166118806dea7ff5509a3c85b685ffd663eb14a

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/464-141-0x00000000027F0000-0x0000000002802000-memory.dmp

Filesize
72KB

Download
memory/2388-96-0x000000001AF00000-0x000000001AF12000-memory.dmp

Filesize
72KB

Download
memory/3024-166-0x00000000018D0000-0x00000000018E2000-memory.dmp

Filesize
72KB

Download
memory/3324-197-0x0000000002250000-0x0000000002262000-memory.dmp

Filesize
72KB

Download
memory/3500-45-0x0000019061890000-0x00000190618B2000-memory.dmp

Filesize
136KB

Download
memory/3964-17-0x0000000002620000-0x000000000262C000-memory.dmp

Filesize
48KB

Download
memory/3964-16-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Filesize
48KB

Download
memory/3964-15-0x0000000000E10000-0x0000000000E1C000-memory.dmp

Filesize
48KB

Download
memory/3964-14-0x0000000000AA0000-0x0000000000AB2000-memory.dmp

Filesize
72KB

Download
memory/3964-13-0x00000000003D0000-0x00000000004E0000-memory.dmp

Filesize
1.1MB

Download
memory/3964-12-0x00007FF8A7DC3000-0x00007FF8A7DC5000-memory.dmp

Filesize
8KB

Download