dcrat | ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c.exe
Size

1.3MB
MD5

3006f561d7afc62c236edd2d928d09a6
SHA1

a8b358e87bc77d44ecd4e398ef18fc893329bba7
SHA256

ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c
SHA512

657e323eb662054c9372f77d32ff4434b68616b9baa4d2c75a6d5f44f97f7bf34fbcf709c2f2e134cab46438b0f40e5f10ec09f8fabe96e2235a45fa22624ace
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	4064	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	4064	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	4064	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	4064	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	4064	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	4064	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	4064	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	4064	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	4064	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cbb-10.dat	dcrat
behavioral2/memory/4484-13-0x0000000000EF0000-0x0000000001000000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3484	powershell.exe
1288	powershell.exe
2212	powershell.exe
1380	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	JaffaCakes118_ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 15 IoCs

pid	Process
4484	DllCommonsvc.exe
1540	RuntimeBroker.exe
4560	RuntimeBroker.exe
1648	RuntimeBroker.exe
3128	RuntimeBroker.exe
4036	RuntimeBroker.exe
396	RuntimeBroker.exe
5044	RuntimeBroker.exe
2260	RuntimeBroker.exe
3464	RuntimeBroker.exe
2736	RuntimeBroker.exe
2804	RuntimeBroker.exe
404	RuntimeBroker.exe
3948	RuntimeBroker.exe
3208	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
22	raw.githubusercontent.com
25	raw.githubusercontent.com
39	raw.githubusercontent.com
40	raw.githubusercontent.com
55	raw.githubusercontent.com
47	raw.githubusercontent.com
56	raw.githubusercontent.com
21	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
57	raw.githubusercontent.com
24	raw.githubusercontent.com
41	raw.githubusercontent.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	JaffaCakes118_ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4796	schtasks.exe
3496	schtasks.exe
5024	schtasks.exe
2144	schtasks.exe
4168	schtasks.exe
4236	schtasks.exe
3228	schtasks.exe
4784	schtasks.exe
4612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4484	DllCommonsvc.exe
1380	powershell.exe
3484	powershell.exe
2212	powershell.exe
1288	powershell.exe
1380	powershell.exe
1288	powershell.exe
3484	powershell.exe
2212	powershell.exe
1540	RuntimeBroker.exe
4560	RuntimeBroker.exe
1648	RuntimeBroker.exe
3128	RuntimeBroker.exe
4036	RuntimeBroker.exe
396	RuntimeBroker.exe
5044	RuntimeBroker.exe
2260	RuntimeBroker.exe
3464	RuntimeBroker.exe
2736	RuntimeBroker.exe
2804	RuntimeBroker.exe
404	RuntimeBroker.exe
3948	RuntimeBroker.exe
3208	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	DllCommonsvc.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	1540	RuntimeBroker.exe
Token: SeDebugPrivilege	4560	RuntimeBroker.exe
Token: SeDebugPrivilege	1648	RuntimeBroker.exe
Token: SeDebugPrivilege	3128	RuntimeBroker.exe
Token: SeDebugPrivilege	4036	RuntimeBroker.exe
Token: SeDebugPrivilege	396	RuntimeBroker.exe
Token: SeDebugPrivilege	5044	RuntimeBroker.exe
Token: SeDebugPrivilege	2260	RuntimeBroker.exe
Token: SeDebugPrivilege	3464	RuntimeBroker.exe
Token: SeDebugPrivilege	2736	RuntimeBroker.exe
Token: SeDebugPrivilege	2804	RuntimeBroker.exe
Token: SeDebugPrivilege	404	RuntimeBroker.exe
Token: SeDebugPrivilege	3948	RuntimeBroker.exe
Token: SeDebugPrivilege	3208	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 1440	3264	JaffaCakes118_ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c.exe	82
PID 3264 wrote to memory of 1440	3264	JaffaCakes118_ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c.exe	82
PID 3264 wrote to memory of 1440	3264	JaffaCakes118_ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c.exe	82
PID 1440 wrote to memory of 412	1440	WScript.exe	85
PID 1440 wrote to memory of 412	1440	WScript.exe	85
PID 1440 wrote to memory of 412	1440	WScript.exe	85
PID 412 wrote to memory of 4484	412	cmd.exe	87
PID 412 wrote to memory of 4484	412	cmd.exe	87
PID 4484 wrote to memory of 2212	4484	DllCommonsvc.exe	99
PID 4484 wrote to memory of 2212	4484	DllCommonsvc.exe	99
PID 4484 wrote to memory of 1380	4484	DllCommonsvc.exe	100
PID 4484 wrote to memory of 1380	4484	DllCommonsvc.exe	100
PID 4484 wrote to memory of 3484	4484	DllCommonsvc.exe	101
PID 4484 wrote to memory of 3484	4484	DllCommonsvc.exe	101
PID 4484 wrote to memory of 1288	4484	DllCommonsvc.exe	102
PID 4484 wrote to memory of 1288	4484	DllCommonsvc.exe	102
PID 4484 wrote to memory of 2452	4484	DllCommonsvc.exe	107
PID 4484 wrote to memory of 2452	4484	DllCommonsvc.exe	107
PID 2452 wrote to memory of 3972	2452	cmd.exe	109
PID 2452 wrote to memory of 3972	2452	cmd.exe	109
PID 2452 wrote to memory of 1540	2452	cmd.exe	111
PID 2452 wrote to memory of 1540	2452	cmd.exe	111
PID 1540 wrote to memory of 4192	1540	RuntimeBroker.exe	114
PID 1540 wrote to memory of 4192	1540	RuntimeBroker.exe	114
PID 4192 wrote to memory of 2648	4192	cmd.exe	116
PID 4192 wrote to memory of 2648	4192	cmd.exe	116
PID 4192 wrote to memory of 4560	4192	cmd.exe	117
PID 4192 wrote to memory of 4560	4192	cmd.exe	117
PID 4560 wrote to memory of 1304	4560	RuntimeBroker.exe	118
PID 4560 wrote to memory of 1304	4560	RuntimeBroker.exe	118
PID 1304 wrote to memory of 2156	1304	cmd.exe	120
PID 1304 wrote to memory of 2156	1304	cmd.exe	120
PID 1304 wrote to memory of 1648	1304	cmd.exe	121
PID 1304 wrote to memory of 1648	1304	cmd.exe	121
PID 1648 wrote to memory of 864	1648	RuntimeBroker.exe	123
PID 1648 wrote to memory of 864	1648	RuntimeBroker.exe	123
PID 864 wrote to memory of 4408	864	cmd.exe	125
PID 864 wrote to memory of 4408	864	cmd.exe	125
PID 864 wrote to memory of 3128	864	cmd.exe	127
PID 864 wrote to memory of 3128	864	cmd.exe	127
PID 3128 wrote to memory of 4244	3128	RuntimeBroker.exe	128
PID 3128 wrote to memory of 4244	3128	RuntimeBroker.exe	128
PID 4244 wrote to memory of 4292	4244	cmd.exe	130
PID 4244 wrote to memory of 4292	4244	cmd.exe	130
PID 4244 wrote to memory of 4036	4244	cmd.exe	131
PID 4244 wrote to memory of 4036	4244	cmd.exe	131
PID 4036 wrote to memory of 4416	4036	RuntimeBroker.exe	132
PID 4036 wrote to memory of 4416	4036	RuntimeBroker.exe	132
PID 4416 wrote to memory of 1848	4416	cmd.exe	134
PID 4416 wrote to memory of 1848	4416	cmd.exe	134
PID 4416 wrote to memory of 396	4416	cmd.exe	135
PID 4416 wrote to memory of 396	4416	cmd.exe	135
PID 396 wrote to memory of 4544	396	RuntimeBroker.exe	136
PID 396 wrote to memory of 4544	396	RuntimeBroker.exe	136
PID 4544 wrote to memory of 2632	4544	cmd.exe	138
PID 4544 wrote to memory of 2632	4544	cmd.exe	138
PID 4544 wrote to memory of 5044	4544	cmd.exe	139
PID 4544 wrote to memory of 5044	4544	cmd.exe	139
PID 5044 wrote to memory of 2084	5044	RuntimeBroker.exe	140
PID 5044 wrote to memory of 2084	5044	RuntimeBroker.exe	140
PID 2084 wrote to memory of 4444	2084	cmd.exe	142
PID 2084 wrote to memory of 4444	2084	cmd.exe	142
PID 2084 wrote to memory of 2260	2084	cmd.exe	143
PID 2084 wrote to memory of 2260	2084	cmd.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ff34d8899ee90bfe5e4c12696a800477b99a3be0a14f06d001bc5f17a0cb9c8c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Favorites\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i6FNlRHyuX.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2452
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3972
      - C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YNa8GmLI5m.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2648
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2156
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PeSwWR6joe.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4408
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4292
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6uMgbjYtd5.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1848
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dFeEewS5jL.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2632
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4444
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat"
        21⤵
        
        PID:4356
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2076
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat"
        23⤵
        
        PID:1304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2684
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat"
        25⤵
        
        PID:3444
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:864
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3npectBbsF.bat"
        27⤵
        
        PID:984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3140
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\00vfQAbtTV.bat"
        29⤵
        
        PID:3556
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:1380
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BlQmztffGe.bat"
        31⤵
        
        PID:2212
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:1432
        
        C:\Users\Default\Downloads\RuntimeBroker.exe
        
        "C:\Users\Default\Downloads\RuntimeBroker.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cU7BGbiaqd.bat"
        33⤵
        
        PID:4988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Favorites\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Favorites\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Favorites\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\00vfQAbtTV.bat

Filesize
209B

MD5
a930529d421fcf20b27808c63aeb519c

SHA1
33e2cb486156ce891c25b787da1a6a22ac1f23be

SHA256
0084f7d640b7785e2cb3bf7e1fde4cf11cea82fa25bc5d22d36b94bbf41d4fa8

SHA512
093e9af4506f88b28e36790c09157863edb466f9116f18abe24aaaf91366ad3474a92799a0df460ee65b2c92cafa852f37005ce0d638cf89d1431a2e2b1ceceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3npectBbsF.bat

Filesize
209B

MD5
9e3410395f1ea7b1b3533f765c3a3aa8

SHA1
f5ccb5fa05c4f5dbf32a18cddcfedb8c0342adce

SHA256
85c496415e8c565e193b3497e6feceb0a62496047dd107a5cfecebd19398432c

SHA512
19966d1ef318cb3210100b9207d9fefcab738d9d7beb004cb7a139c42649b93b3dd8eb4b6e893b7b71ed5a6eee8e7dd2e85715f2b100debbea8cd6f2cfa4bbf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\6uMgbjYtd5.bat

Filesize
209B

MD5
2e75cd90152d8f774858ead2db922402

SHA1
2df2ce8e9ec11d44ac93de4fa9ac7d4a79ae5981

SHA256
ffab1de1c6d274b812edabe1dd831f916a176e61219a33ac741f8e874fde5973

SHA512
906d7d9aee478bd0ee9c8aac7f7d78b93676d666aaa592fa212d99fb0b6ef5a7dbd1687d570c47aaec9fcbd25a26a71ead6e9e3c6439203f4557601f209f1ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat

Filesize
209B

MD5
ff3febe7985b6a25df741eef36c67e3a

SHA1
53b6505f33ffcdde1dcce708951718ee53cacd96

SHA256
341511511cf96659d1f7fd81ac0cf015781ffeb46efcb67d6efd39bc28250240

SHA512
15f97b47ad89bb76702bda4592629313a5b4bb4387ca6b85b955cdc8cf5d3377b0ce06352f838e73e091d1d1dbf6cebebf6018162c6c06bd69963b87e58b8787

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlQmztffGe.bat

Filesize
209B

MD5
f51a671ee5ca849ee7f368ef1005515f

SHA1
226f2e93a0a4813df4118a038f33a4ff04291161

SHA256
ffecfe9b8976e0ecd015ecafd015359a1047b12c3cc0ca66617e2469520163d6

SHA512
558795978c609688f9db4402e40d6ea795e5909d79c7b3687bfb9a110c8d13f301b40245549dab1214c6bc6a9521aebfebe0600c592fbb22d759341915e65411

Download Submit
C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat

Filesize
209B

MD5
8cd8e892316ab1bcc324a494974b0d25

SHA1
9f4063378693aab0ed3d4150a6fd3e93ad44a58c

SHA256
42a580d2466e7021d9d2d884170f2d4c8311a39315c3a3559c16234c16d279b7

SHA512
27661f64e81cb4ae430ee33a2f4b50a9ce8f7c8ace8419d45dc58378d7f4cf46fdaeeef28b3ac93285db3bbf4db54bd4ae606aae1b78391443a49c9a64dcf4f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\PeSwWR6joe.bat

Filesize
209B

MD5
0b56cf93914859a917ebb8e027689509

SHA1
14aa0415861a25171cde33dc6aab316ce654061d

SHA256
c1f94a5a655bd9a760ad0fa35cade913b5e80f3a7d2dd61c67f63ec59b09a27d

SHA512
09a3cff88bd4c2350988ac2133debbb37313d03fae9b88319004cac2290a01cd6dd72457a2171477d35499259aa0b88d8fe70ee0ddb9b0e90d8acc4c2951ebc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat

Filesize
209B

MD5
bc014d7f1cb27e64185950b514f14a89

SHA1
b5fdec81e10ba808ff0410e59dcd84106be1ec74

SHA256
e5438de2b8a472ef37685dbc8090b7ac389f70c98714337deb38e0f0326bf6c6

SHA512
2da9d23c20e3e7a890e879a3ecdc8cef86ce1be2c592899fc2978d9f0fcf462dfdab507a667d261baaa280ef1a50614fa7c5d72c47fde85053bb7caabdc37bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat

Filesize
209B

MD5
050065f4f264271c93a51307f4a80c78

SHA1
838e15ca51c2e5b01a76093b92e51b473be131c4

SHA256
fdc0f2aa2b5c3ffcaf63683a798ba4cb0c1804af7bce878b0ce68d21abdeee20

SHA512
ba3e5f2aced797d939b1d3a1dc9b0818ac88e89a36a07209e341138c858744373a3ee0b47097e649308063c5a606e1aa51b78909cfefcc9fa39ed231d2f1bab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat

Filesize
209B

MD5
bf37f19a0cb33b301795f38b9b89ac1c

SHA1
f87d33a6d3daa6de357844d51602cefa90463926

SHA256
e2f81c4603291b5dd94920849feb55b0c0be5ec6df4d42c1057cf3d73283785e

SHA512
ce781f60e79a737c3d23bc9f12286e55f34b786c92e08aeeab4a099e8c09a80cd3609422ba83f58c901f42d06a62394a6a3c1a499a8580dee868f776ebe84e38

Download Submit
C:\Users\Admin\AppData\Local\Temp\YNa8GmLI5m.bat

Filesize
209B

MD5
2b13a6da4cb5245d0f848194c9b75f14

SHA1
f0870f018c385edca396341953dba6ffb98c2b94

SHA256
293e414e806fab1b089eb48d53ad0dd04ae10a5c0de2ba2296aa3db920d604b9

SHA512
782fa63359de50abaa7615b9b088cf9b235451298c8641563437a8cc08139c527f24ea158a56348adeab771d2faab5e15186656c80f4aa789e8cd6c64dbdf736

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3lgh3lct.san.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cU7BGbiaqd.bat

Filesize
209B

MD5
fc1278f0567043c38185f0269ba1ddc4

SHA1
9a667dce2865601b9207f7c4ab79ba97d31a1441

SHA256
ad9c15e5d8ef113fd131c857c1285b2554a7ef49e2aa3dae2484ee9d5ff7f32a

SHA512
1a9308523a62df2b0dae6d07c846546e7e362e1114870cdfdd59874dd976934ef12815275c99035b2ca50e9177d6b305a545e62ae984ca02ef3bf29786a8ed6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dFeEewS5jL.bat

Filesize
209B

MD5
7a8c8aaf67dc7d5ac3f71f9d7dbf6124

SHA1
5f164a4b4d89ea016921ab1e48aa5df043aaf42b

SHA256
6b74fc09f13e7503b73691fbb9ac9d524159b0ad9d448c67eedb8d8fe078448a

SHA512
aee0a975d8dc1c020f657181a4c527b318d77ef6bc8c9778c9bb0a997cc1ff0ff2d6339be3781e2ec7c2bf4ffadaaae44e0a4341cd899906beffe966a585bb3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\i6FNlRHyuX.bat

Filesize
209B

MD5
860dce4bb4723455a14e8642fa370b27

SHA1
b71669343f6a26eb1d26340c06034c56393734fa

SHA256
adc9794c35eaad243f412d5c87f1ddf7d893c1305caaa14af1d5d17255458d37

SHA512
d84ac3c89119e773121a44c44cd3fa634db6c3f372f9bf414e08c186c12b9144519606cc3ff7071877d73e06082cef772e460629b18f3f6982c4150a54edf9d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat

Filesize
209B

MD5
86473dfbaf3ed783b53b2899c32407ab

SHA1
12f219dafff01d08152e7a0f1e07657be0be0c23

SHA256
ea97591ff8a659970f0412912c0f5efb28b129db092889933da4dca13e836907

SHA512
316fa3743208435ac7dcda91d5eaccec9bed559ac867e6afaba81274456bf0b0a21ef6d030bf4507ab67cea34f6bfd937b6b422776440744521bef8c7f62d980

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/396-119-0x000000001D850000-0x000000001D8A6000-memory.dmp

Filesize
344KB

Download
memory/1380-38-0x000002E29AFE0000-0x000002E29B002000-memory.dmp

Filesize
136KB

Download
memory/1540-79-0x0000000000BF0000-0x0000000000C02000-memory.dmp

Filesize
72KB

Download
memory/3128-105-0x000000001DF80000-0x000000001DFD6000-memory.dmp

Filesize
344KB

Download
memory/4036-112-0x000000001D940000-0x000000001D996000-memory.dmp

Filesize
344KB

Download
memory/4484-13-0x0000000000EF0000-0x0000000001000000-memory.dmp

Filesize
1.1MB

Download
memory/4484-17-0x0000000003240000-0x000000000324C000-memory.dmp

Filesize
48KB

Download
memory/4484-16-0x00000000018F0000-0x00000000018FC000-memory.dmp

Filesize
48KB

Download
memory/4484-15-0x00000000018E0000-0x00000000018EC000-memory.dmp

Filesize
48KB

Download
memory/4484-14-0x00000000018C0000-0x00000000018D2000-memory.dmp

Filesize
72KB

Download
memory/4484-12-0x00007FFCA5353000-0x00007FFCA5355000-memory.dmp

Filesize
8KB

Download
memory/4560-88-0x000000001AFC0000-0x000000001AFD2000-memory.dmp

Filesize
72KB

Download
memory/5044-126-0x000000001D940000-0x000000001D996000-memory.dmp

Filesize
344KB

Download