dcrat | 928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5.exe
Size

1.3MB
MD5

bb9fde841f13265ed7cb346dea6599ed
SHA1

8722e36a8ad766f9bd996abade0af69f6668817f
SHA256

928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5
SHA512

fad665902515da0fa1291f432d569630bffd830b1b345717c6fb17de4ed27b9175ce57875dd7889457ec7c68bf39231510b6440504a60bd9c5a02f3fcb67300f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	3024	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	3024	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c93-9.dat	dcrat
behavioral2/memory/2556-13-0x0000000000DD0000-0x0000000000EE0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
856	powershell.exe
812	powershell.exe
2060	powershell.exe
1752	powershell.exe
912	powershell.exe
5040	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	JaffaCakes118_928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	wininit.exe

Executes dropped EXE 16 IoCs

pid	Process
2556	DllCommonsvc.exe
2884	wininit.exe
4956	wininit.exe
4184	wininit.exe
3276	wininit.exe
2212	wininit.exe
4980	wininit.exe
3564	wininit.exe
1868	wininit.exe
3996	wininit.exe
1732	wininit.exe
2484	wininit.exe
3624	wininit.exe
3352	wininit.exe
1756	wininit.exe
4460	wininit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
53	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com
36	raw.githubusercontent.com
37	raw.githubusercontent.com
38	raw.githubusercontent.com
14	raw.githubusercontent.com
15	raw.githubusercontent.com
44	raw.githubusercontent.com
52	raw.githubusercontent.com
54	raw.githubusercontent.com
43	raw.githubusercontent.com
50	raw.githubusercontent.com
39	raw.githubusercontent.com
51	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\56085415360792	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\tracing\sysmon.exe	DllCommonsvc.exe
File created	C:\Windows\tracing\121e5b5079f7c0	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	JaffaCakes118_928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	wininit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2300	schtasks.exe
4472	schtasks.exe
944	schtasks.exe
432	schtasks.exe
3712	schtasks.exe
2768	schtasks.exe
4412	schtasks.exe
3868	schtasks.exe
1600	schtasks.exe
4160	schtasks.exe
2064	schtasks.exe
3856	schtasks.exe
4192	schtasks.exe
3200	schtasks.exe
1360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
2556	DllCommonsvc.exe
5040	powershell.exe
912	powershell.exe
2060	powershell.exe
812	powershell.exe
856	powershell.exe
856	powershell.exe
1752	powershell.exe
5040	powershell.exe
912	powershell.exe
2060	powershell.exe
812	powershell.exe
1752	powershell.exe
2884	wininit.exe
4956	wininit.exe
4184	wininit.exe
3276	wininit.exe
2212	wininit.exe
4980	wininit.exe
3564	wininit.exe
1868	wininit.exe
3996	wininit.exe
1732	wininit.exe
2484	wininit.exe
3624	wininit.exe
3352	wininit.exe
1756	wininit.exe
4460	wininit.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	DllCommonsvc.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	812	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	2884	wininit.exe
Token: SeDebugPrivilege	4956	wininit.exe
Token: SeDebugPrivilege	4184	wininit.exe
Token: SeDebugPrivilege	3276	wininit.exe
Token: SeDebugPrivilege	2212	wininit.exe
Token: SeDebugPrivilege	4980	wininit.exe
Token: SeDebugPrivilege	3564	wininit.exe
Token: SeDebugPrivilege	1868	wininit.exe
Token: SeDebugPrivilege	3996	wininit.exe
Token: SeDebugPrivilege	1732	wininit.exe
Token: SeDebugPrivilege	2484	wininit.exe
Token: SeDebugPrivilege	3624	wininit.exe
Token: SeDebugPrivilege	3352	wininit.exe
Token: SeDebugPrivilege	1756	wininit.exe
Token: SeDebugPrivilege	4460	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2212	1904	JaffaCakes118_928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5.exe	85
PID 1904 wrote to memory of 2212	1904	JaffaCakes118_928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5.exe	85
PID 1904 wrote to memory of 2212	1904	JaffaCakes118_928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5.exe	85
PID 2212 wrote to memory of 4092	2212	WScript.exe	87
PID 2212 wrote to memory of 4092	2212	WScript.exe	87
PID 2212 wrote to memory of 4092	2212	WScript.exe	87
PID 4092 wrote to memory of 2556	4092	cmd.exe	89
PID 4092 wrote to memory of 2556	4092	cmd.exe	89
PID 2556 wrote to memory of 856	2556	DllCommonsvc.exe	107
PID 2556 wrote to memory of 856	2556	DllCommonsvc.exe	107
PID 2556 wrote to memory of 812	2556	DllCommonsvc.exe	108
PID 2556 wrote to memory of 812	2556	DllCommonsvc.exe	108
PID 2556 wrote to memory of 2060	2556	DllCommonsvc.exe	109
PID 2556 wrote to memory of 2060	2556	DllCommonsvc.exe	109
PID 2556 wrote to memory of 1752	2556	DllCommonsvc.exe	110
PID 2556 wrote to memory of 1752	2556	DllCommonsvc.exe	110
PID 2556 wrote to memory of 912	2556	DllCommonsvc.exe	111
PID 2556 wrote to memory of 912	2556	DllCommonsvc.exe	111
PID 2556 wrote to memory of 5040	2556	DllCommonsvc.exe	112
PID 2556 wrote to memory of 5040	2556	DllCommonsvc.exe	112
PID 2556 wrote to memory of 4652	2556	DllCommonsvc.exe	119
PID 2556 wrote to memory of 4652	2556	DllCommonsvc.exe	119
PID 4652 wrote to memory of 3092	4652	cmd.exe	121
PID 4652 wrote to memory of 3092	4652	cmd.exe	121
PID 4652 wrote to memory of 2884	4652	cmd.exe	129
PID 4652 wrote to memory of 2884	4652	cmd.exe	129
PID 2884 wrote to memory of 1600	2884	wininit.exe	131
PID 2884 wrote to memory of 1600	2884	wininit.exe	131
PID 1600 wrote to memory of 3176	1600	cmd.exe	133
PID 1600 wrote to memory of 3176	1600	cmd.exe	133
PID 1600 wrote to memory of 4956	1600	cmd.exe	139
PID 1600 wrote to memory of 4956	1600	cmd.exe	139
PID 4956 wrote to memory of 3380	4956	wininit.exe	141
PID 4956 wrote to memory of 3380	4956	wininit.exe	141
PID 3380 wrote to memory of 2688	3380	cmd.exe	143
PID 3380 wrote to memory of 2688	3380	cmd.exe	143
PID 3380 wrote to memory of 4184	3380	cmd.exe	145
PID 3380 wrote to memory of 4184	3380	cmd.exe	145
PID 4184 wrote to memory of 3160	4184	wininit.exe	147
PID 4184 wrote to memory of 3160	4184	wininit.exe	147
PID 3160 wrote to memory of 4676	3160	cmd.exe	149
PID 3160 wrote to memory of 4676	3160	cmd.exe	149
PID 3160 wrote to memory of 3276	3160	cmd.exe	154
PID 3160 wrote to memory of 3276	3160	cmd.exe	154
PID 3276 wrote to memory of 4360	3276	wininit.exe	156
PID 3276 wrote to memory of 4360	3276	wininit.exe	156
PID 4360 wrote to memory of 2724	4360	cmd.exe	158
PID 4360 wrote to memory of 2724	4360	cmd.exe	158
PID 4360 wrote to memory of 2212	4360	cmd.exe	160
PID 4360 wrote to memory of 2212	4360	cmd.exe	160
PID 2212 wrote to memory of 5116	2212	wininit.exe	162
PID 2212 wrote to memory of 5116	2212	wininit.exe	162
PID 5116 wrote to memory of 1188	5116	cmd.exe	164
PID 5116 wrote to memory of 1188	5116	cmd.exe	164
PID 5116 wrote to memory of 4980	5116	cmd.exe	166
PID 5116 wrote to memory of 4980	5116	cmd.exe	166
PID 4980 wrote to memory of 2384	4980	wininit.exe	168
PID 4980 wrote to memory of 2384	4980	wininit.exe	168
PID 2384 wrote to memory of 3712	2384	cmd.exe	170
PID 2384 wrote to memory of 3712	2384	cmd.exe	170
PID 2384 wrote to memory of 3564	2384	cmd.exe	172
PID 2384 wrote to memory of 3564	2384	cmd.exe	172
PID 3564 wrote to memory of 3184	3564	wininit.exe	174
PID 3564 wrote to memory of 3184	3564	wininit.exe	174

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_928f0eac6a7f4e9afacbcba0a8e13c7a7a6ab1e376cc0a4e82a563a21b29e7b5.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\tracing\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B6Mq9E4PEA.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4652
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3092
      - C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KYEunsIO9t.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3176
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2688
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SNhzeWIHcH.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4676
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eNTIt1NKYH.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2724
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cRRFCwJQFV.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1188
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3712
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gJVLZ7RDs3.bat"
        19⤵
        
        PID:3184
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:3824
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WOs9W2tFAs.bat"
        21⤵
        
        PID:3592
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1780
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat"
        23⤵
        
        PID:4336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3724
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KYEunsIO9t.bat"
        25⤵
        
        PID:1156
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:5092
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\USq6qxpMr5.bat"
        27⤵
        
        PID:2564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3436
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1n8esAjYxK.bat"
        29⤵
        
        PID:1632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:5108
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b7oBPqXqtO.bat"
        31⤵
        
        PID:1792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:3360
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZBm8ilTxac.bat"
        33⤵
        
        PID:1096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:2408
        
        C:\Program Files (x86)\Windows Portable Devices\wininit.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\wininit.exe"
        34⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Pictures\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Public\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Windows\tracing\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\tracing\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Windows\tracing\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\1n8esAjYxK.bat

Filesize
224B

MD5
999b6f17c5a3716bca134ad36bb626ca

SHA1
731e974ebda9437506977f600ff9b8a074ad5a09

SHA256
e9390363de5387461aba5899e8e65f1bc710cd17744644ad763b3d3504b78ab7

SHA512
7d34f4391acdeb89eb627d83bf60e9048671a4110626579208cac25fc8e55a54d8e9d0a8f6b8db847ff5dcbe58b82060e17061153b06fbd55c4006db9c4b2819

Download Submit
C:\Users\Admin\AppData\Local\Temp\B6Mq9E4PEA.bat

Filesize
224B

MD5
bcb9f88bb2d48fbb544cf497a9cb8fc5

SHA1
06936e949c0035310526451ee1ae07ce51fbec05

SHA256
10ee6a26ef8c7c7ab70458d357fe11d1f438474979387be2e2c9f24ed263c9e5

SHA512
a6c8b2ebf2e485be216e6465850a3746e6373ad5036891b9162120f51b5d983bdb009ee5178410446560b9c11b15876cbde3b483887407c189dd586562845373

Download Submit
C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat

Filesize
224B

MD5
348510aedd88db2269660826eb3cd633

SHA1
02f2c9e4b56cdb1d0febabe8e064a232b292d73b

SHA256
f6672c696f7f7678c9f81b904cc36ba3acf23104c402e62a780fb228fdce957a

SHA512
2b254ad3f616465f01c93e90a0ccb9f195271553416123f358b8b75ea23fa25aa48c92b2c133c9b243db9f9030ac96064efe5c0fbe99b6b5738da7bfb7aa7a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\KYEunsIO9t.bat

Filesize
224B

MD5
cc36d8f7c4cb57f93ed93d888ebf16c7

SHA1
82cb4209f4bdf4d91d7e89ed78ff092c522c818c

SHA256
0d6c3c8553725020c0e4b299b5737939c04db60200d8b812dded345b6a9beb74

SHA512
5c896d0534a2430a43e9d7907b21220eaaae79f62de8c02b782d57f722b06f75712c3f726057c482d7d64728fca24b997cd0face35df3b73310c2e6b9d1e2392

Download Submit
C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat

Filesize
224B

MD5
69bafde14641819cab506138e2a175be

SHA1
9d7c9a622203b492094f902b5a9a98c0a64a257e

SHA256
2ee0a517df7c9e371333be2deed22425ee67aecceb0ae1e89ece7c530bee9fbf

SHA512
4c63a073e9430bc5df2cbaa984dd551786d22cdcb69312503a5bc6fb33bfdac7453076a6dd7f80fdc07525a8cc4c01c7beb254c507e0491fcc59d0fd85194553

Download Submit
C:\Users\Admin\AppData\Local\Temp\SNhzeWIHcH.bat

Filesize
224B

MD5
4fc41dabc053d79943b03f970a251f2f

SHA1
ee3ac15a2ca3b7769835e48163739c99ec5f49e3

SHA256
8ae1d5eb802885e2eb72771868f510ece11b1f62f4c940890d3d77059fb3707c

SHA512
595c807049adb9af5c77a54c8709404a74918fca627848d1dc65d87d5e6c9f84422d92b05c0d297cd52d512d9d25341ca2ecafc4308ff66224de3e27029ee66a

Download Submit
C:\Users\Admin\AppData\Local\Temp\USq6qxpMr5.bat

Filesize
224B

MD5
081b578e559c8f2c58c0a84e13b8dd98

SHA1
be0ad1ee85bbc0ac87acdba483949262de4c9997

SHA256
f9da5a3838591e4ef6b5089e309bb9c9d6fb7bb1736f2fe2def401f69def781d

SHA512
2226eae8dd5c69f0ba0d5fd2767a11576542155215dd7ce2f214dd2655b3aeae5753a16dd5d8004af034acb3b6ee54802ec5540d6a8e624834744818fd9693aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\WOs9W2tFAs.bat

Filesize
224B

MD5
751bdec2ec7ac097e89c0f7aa65c78f7

SHA1
00b0fad7ec686f85254780fb5ee5120910654e0d

SHA256
71c6d5e8f8bc7c06651e9a285415b1d79c7eb94027a5836480225b26ca3e820d

SHA512
f6f34cd170240d20c998d03d45c7260eff76c56c5b427110442c9adbdef5437cd83ba01bd9a814a77b9ca50f9b1001d1d16afbaa80fc9380008d4f7d4d1b1181

Download Submit
C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat

Filesize
224B

MD5
27af21592e445c88db05936ae65697b6

SHA1
4313cfca4afac621c3037520322c7044d47c1d98

SHA256
86c58cf13fb85f5745f16cec3af3cae2f9c0029b6128b96e2b3f02359f23074b

SHA512
0a4c5e308ca8d997effbe0cb499e21e60844e99ee13bdffeaee4264d65fe3b60ed3ef95a8c9978af885292fac373b04122688ecfe57c765af3a83d9a7aa8f4e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZBm8ilTxac.bat

Filesize
224B

MD5
50c9f6a0d7f13b390298a444c13743e8

SHA1
68283e9c4973674c9b00fefdd0476f94c7671f23

SHA256
c36a6fcab25d445712bb8f29fc97418ef271e2785f018b854289ee61a42c07b9

SHA512
83b685b49a9b6ea6fbe6d1f88289901219dd790e3f5e846edc0fb3f4543b6791ee7492bd65aa2963cf6ab871879beb6df523b7991599f8f157f04dd5e1818617

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ejw0qbhd.lnx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b7oBPqXqtO.bat

Filesize
224B

MD5
e92ef90a4f0e22ccc1f03faf62fb971f

SHA1
0b2e483095e43cbfc4df2ee78f5219f906d66518

SHA256
61e55edeaa1db42539866ac1ba696bbf081e94bbefb34781d762151bc0225767

SHA512
a2008278a322807d3f5fa83b985b050980ed42bac61979ef3bdc8513224bf7e30cf9ecb60d9aa6e729a984901c6a04ba7b00ddb41b15dd6a6e00e11e47a7b6c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cRRFCwJQFV.bat

Filesize
224B

MD5
ff3381214e97b22735ee705e1b46752e

SHA1
1fb15fb53f914e99af82622b4d2e9afc03793875

SHA256
72ee0f7755fe0833a1e7c1266dd88e299ae25768231ffc3ea2b5ac3c697125bf

SHA512
5612385683539bf5cd66a96de36d1213ca7d03cb2b6ea95c59bc43e47b1ec936533eedc8482e7493c91928a4449c4461a7ca71c0b4f010c28c0b2a84582fdc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\eNTIt1NKYH.bat

Filesize
224B

MD5
1464ceee73d74f88fb555a3e23ba1b02

SHA1
f1da997fa53c1375c039107055ac5f6096767c6f

SHA256
2c6deef7c042a1fd9d4bd2882858b097bda1a1176f68b9903ef5034456144845

SHA512
2fae4f05e6635fea5871ad89fbae9317f998d80254183bb14e99e598b1d2e1ba3d399c0064d6f527f67f6b7c57c24f03e9d33ec084d2c8f029227e131ff787a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\gJVLZ7RDs3.bat

Filesize
224B

MD5
fa84aadbf1b56235290a107462c51236

SHA1
5d36de4b1a7351a9952977621295ebddf8ec9b40

SHA256
e67c81f44d24785c74887122a2e83c0616e0d8989476094234df55365a8132e0

SHA512
92a7d0c3de0e5e0583c904c2322dd1271261ddc7f384a7952d3efca9e4efa1f1b1899b19270ef60795c23dab3b3f7e694cf9a61fe68f811ff8742858e3f3bb5c

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1732-167-0x0000000000B80000-0x0000000000B92000-memory.dmp

Filesize
72KB

Download
memory/1868-158-0x000000001BB80000-0x000000001BCEA000-memory.dmp

Filesize
1.4MB

Download
memory/1868-153-0x0000000002200000-0x0000000002212000-memory.dmp

Filesize
72KB

Download
memory/2212-136-0x000000001C460000-0x000000001C5CA000-memory.dmp

Filesize
1.4MB

Download
memory/2556-13-0x0000000000DD0000-0x0000000000EE0000-memory.dmp

Filesize
1.1MB

Download
memory/2556-15-0x000000001B9F0000-0x000000001B9FC000-memory.dmp

Filesize
48KB

Download
memory/2556-14-0x000000001B9E0000-0x000000001B9F2000-memory.dmp

Filesize
72KB

Download
memory/2556-12-0x00007FF9D8D73000-0x00007FF9D8D75000-memory.dmp

Filesize
8KB

Download
memory/2556-16-0x000000001BA00000-0x000000001BA0C000-memory.dmp

Filesize
48KB

Download
memory/2556-17-0x000000001BA10000-0x000000001BA1C000-memory.dmp

Filesize
48KB

Download
memory/3276-125-0x00000000032B0000-0x00000000032C2000-memory.dmp

Filesize
72KB

Download
memory/3352-187-0x0000000003060000-0x0000000003072000-memory.dmp

Filesize
72KB

Download
memory/3564-146-0x0000000001320000-0x0000000001332000-memory.dmp

Filesize
72KB

Download
memory/3624-180-0x00000000029C0000-0x00000000029D2000-memory.dmp

Filesize
72KB

Download
memory/4980-139-0x0000000001480000-0x0000000001492000-memory.dmp

Filesize
72KB

Download
memory/5040-37-0x000002529BC60000-0x000002529BC82000-memory.dmp

Filesize
136KB

Download