dcrat | c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce.exe
Size

1.3MB
MD5

3b0ca74b09ecb9d8eac4c4f69a4a0716
SHA1

5770d40cebaafde4a9ad69be1a1d046d18e9cf6b
SHA256

c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce
SHA512

6e2ea4cea3f82a14f452ee0d6d45d71cd673296fa8a28e268dabab83cdbedbd9c295b109197e29315b60d4eb2090d8b0b1ee3b8acb8e63f7c844d0c43f553682
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	3204	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	3204	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b72-10.dat	dcrat
behavioral2/memory/2468-13-0x0000000000BE0000-0x0000000000CF0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1500	powershell.exe
5080	powershell.exe
1004	powershell.exe
3268	powershell.exe
3016	powershell.exe
5028	powershell.exe
912	powershell.exe
5052	powershell.exe
1076	powershell.exe
3540	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	wininit.exe

Executes dropped EXE 15 IoCs

pid	Process
2468	DllCommonsvc.exe
872	wininit.exe
2364	wininit.exe
1932	wininit.exe
2744	wininit.exe
4900	wininit.exe
4796	wininit.exe
3744	wininit.exe
4388	wininit.exe
2420	wininit.exe
4732	wininit.exe
1792	wininit.exe
4796	wininit.exe
1476	wininit.exe
3608	wininit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
54	raw.githubusercontent.com
58	raw.githubusercontent.com
19	raw.githubusercontent.com
32	raw.githubusercontent.com
47	raw.githubusercontent.com
48	raw.githubusercontent.com
55	raw.githubusercontent.com
18	raw.githubusercontent.com
23	raw.githubusercontent.com
41	raw.githubusercontent.com
46	raw.githubusercontent.com
42	raw.githubusercontent.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dllhost.exe	DllCommonsvc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\upfc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\ea1d8f6d871115	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SKB\LanguageModels\sysmon.exe	DllCommonsvc.exe
File created	C:\Windows\SKB\LanguageModels\121e5b5079f7c0	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	wininit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4140	schtasks.exe
1380	schtasks.exe
4536	schtasks.exe
3120	schtasks.exe
4804	schtasks.exe
4516	schtasks.exe
1448	schtasks.exe
4812	schtasks.exe
4156	schtasks.exe
3604	schtasks.exe
4052	schtasks.exe
4300	schtasks.exe
2472	schtasks.exe
3612	schtasks.exe
4528	schtasks.exe
3768	schtasks.exe
3580	schtasks.exe
4928	schtasks.exe
1632	schtasks.exe
3836	schtasks.exe
2492	schtasks.exe
2876	schtasks.exe
3696	schtasks.exe
544	schtasks.exe
1220	schtasks.exe
2668	schtasks.exe
4248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2468	DllCommonsvc.exe
2468	DllCommonsvc.exe
2468	DllCommonsvc.exe
2468	DllCommonsvc.exe
2468	DllCommonsvc.exe
1500	powershell.exe
1500	powershell.exe
1076	powershell.exe
1076	powershell.exe
3540	powershell.exe
3540	powershell.exe
1004	powershell.exe
1004	powershell.exe
912	powershell.exe
912	powershell.exe
5052	powershell.exe
5052	powershell.exe
3016	powershell.exe
3016	powershell.exe
5080	powershell.exe
5080	powershell.exe
1500	powershell.exe
3268	powershell.exe
3268	powershell.exe
5080	powershell.exe
5028	powershell.exe
5028	powershell.exe
872	wininit.exe
872	wininit.exe
1076	powershell.exe
1004	powershell.exe
912	powershell.exe
5052	powershell.exe
3268	powershell.exe
3540	powershell.exe
3016	powershell.exe
5028	powershell.exe
2364	wininit.exe
1932	wininit.exe
2744	wininit.exe
4900	wininit.exe
4796	wininit.exe
3744	wininit.exe
4388	wininit.exe
2420	wininit.exe
4732	wininit.exe
1792	wininit.exe
4796	wininit.exe
1476	wininit.exe
3608	wininit.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	DllCommonsvc.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	872	wininit.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	2364	wininit.exe
Token: SeDebugPrivilege	1932	wininit.exe
Token: SeDebugPrivilege	2744	wininit.exe
Token: SeDebugPrivilege	4900	wininit.exe
Token: SeDebugPrivilege	4796	wininit.exe
Token: SeDebugPrivilege	3744	wininit.exe
Token: SeDebugPrivilege	4388	wininit.exe
Token: SeDebugPrivilege	2420	wininit.exe
Token: SeDebugPrivilege	4732	wininit.exe
Token: SeDebugPrivilege	1792	wininit.exe
Token: SeDebugPrivilege	4796	wininit.exe
Token: SeDebugPrivilege	1476	wininit.exe
Token: SeDebugPrivilege	3608	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4316	3528	JaffaCakes118_c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce.exe	83
PID 3528 wrote to memory of 4316	3528	JaffaCakes118_c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce.exe	83
PID 3528 wrote to memory of 4316	3528	JaffaCakes118_c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce.exe	83
PID 4316 wrote to memory of 4168	4316	WScript.exe	85
PID 4316 wrote to memory of 4168	4316	WScript.exe	85
PID 4316 wrote to memory of 4168	4316	WScript.exe	85
PID 4168 wrote to memory of 2468	4168	cmd.exe	87
PID 4168 wrote to memory of 2468	4168	cmd.exe	87
PID 2468 wrote to memory of 3016	2468	DllCommonsvc.exe	119
PID 2468 wrote to memory of 3016	2468	DllCommonsvc.exe	119
PID 2468 wrote to memory of 5028	2468	DllCommonsvc.exe	120
PID 2468 wrote to memory of 5028	2468	DllCommonsvc.exe	120
PID 2468 wrote to memory of 1500	2468	DllCommonsvc.exe	121
PID 2468 wrote to memory of 1500	2468	DllCommonsvc.exe	121
PID 2468 wrote to memory of 912	2468	DllCommonsvc.exe	122
PID 2468 wrote to memory of 912	2468	DllCommonsvc.exe	122
PID 2468 wrote to memory of 5080	2468	DllCommonsvc.exe	123
PID 2468 wrote to memory of 5080	2468	DllCommonsvc.exe	123
PID 2468 wrote to memory of 1004	2468	DllCommonsvc.exe	124
PID 2468 wrote to memory of 1004	2468	DllCommonsvc.exe	124
PID 2468 wrote to memory of 5052	2468	DllCommonsvc.exe	125
PID 2468 wrote to memory of 5052	2468	DllCommonsvc.exe	125
PID 2468 wrote to memory of 1076	2468	DllCommonsvc.exe	126
PID 2468 wrote to memory of 1076	2468	DllCommonsvc.exe	126
PID 2468 wrote to memory of 3268	2468	DllCommonsvc.exe	127
PID 2468 wrote to memory of 3268	2468	DllCommonsvc.exe	127
PID 2468 wrote to memory of 3540	2468	DllCommonsvc.exe	128
PID 2468 wrote to memory of 3540	2468	DllCommonsvc.exe	128
PID 2468 wrote to memory of 872	2468	DllCommonsvc.exe	139
PID 2468 wrote to memory of 872	2468	DllCommonsvc.exe	139
PID 872 wrote to memory of 2468	872	wininit.exe	141
PID 872 wrote to memory of 2468	872	wininit.exe	141
PID 2468 wrote to memory of 3244	2468	cmd.exe	144
PID 2468 wrote to memory of 3244	2468	cmd.exe	144
PID 2468 wrote to memory of 2364	2468	cmd.exe	147
PID 2468 wrote to memory of 2364	2468	cmd.exe	147
PID 2364 wrote to memory of 4756	2364	wininit.exe	153
PID 2364 wrote to memory of 4756	2364	wininit.exe	153
PID 4756 wrote to memory of 2104	4756	cmd.exe	155
PID 4756 wrote to memory of 2104	4756	cmd.exe	155
PID 4756 wrote to memory of 1932	4756	cmd.exe	157
PID 4756 wrote to memory of 1932	4756	cmd.exe	157
PID 1932 wrote to memory of 3116	1932	wininit.exe	161
PID 1932 wrote to memory of 3116	1932	wininit.exe	161
PID 3116 wrote to memory of 5068	3116	cmd.exe	163
PID 3116 wrote to memory of 5068	3116	cmd.exe	163
PID 3116 wrote to memory of 2744	3116	cmd.exe	166
PID 3116 wrote to memory of 2744	3116	cmd.exe	166
PID 2744 wrote to memory of 1576	2744	wininit.exe	168
PID 2744 wrote to memory of 1576	2744	wininit.exe	168
PID 1576 wrote to memory of 372	1576	cmd.exe	170
PID 1576 wrote to memory of 372	1576	cmd.exe	170
PID 1576 wrote to memory of 4900	1576	cmd.exe	172
PID 1576 wrote to memory of 4900	1576	cmd.exe	172
PID 4900 wrote to memory of 3224	4900	wininit.exe	174
PID 4900 wrote to memory of 3224	4900	wininit.exe	174
PID 3224 wrote to memory of 4232	3224	cmd.exe	176
PID 3224 wrote to memory of 4232	3224	cmd.exe	176
PID 3224 wrote to memory of 4796	3224	cmd.exe	179
PID 3224 wrote to memory of 4796	3224	cmd.exe	179
PID 4796 wrote to memory of 4752	4796	wininit.exe	181
PID 4796 wrote to memory of 4752	4796	wininit.exe	181
PID 4752 wrote to memory of 3252	4752	cmd.exe	183
PID 4752 wrote to memory of 3252	4752	cmd.exe	183

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c48d602db2a07fea3798803b63fdc2f4328b6c7fda512863cd5d00697f9a27ce.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Templates\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SKB\LanguageModels\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3540
    - - C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:872
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3244
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2104
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mQXsfud8LV.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:5068
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dhQfvaPZ4N.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:372
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\N4rS0hE0df.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4232
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3252
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fmZn61weJC.bat"
        18⤵
        
        PID:2264
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2444
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat"
        20⤵
        
        PID:3932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1756
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat"
        22⤵
        
        PID:4836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:3012
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gW6qUMg8Bu.bat"
        24⤵
        
        PID:2488
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1280
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uP802u8Cku.bat"
        26⤵
        
        PID:2328
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1660
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat"
        28⤵
        
        PID:4632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:3192
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OxVZsORhRP.bat"
        30⤵
        
        PID:4660
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:3612
        
        C:\providercommon\wininit.exe
        
        "C:\providercommon\wininit.exe"
        31⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Templates\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Windows\SKB\LanguageModels\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Windows\SKB\LanguageModels\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat

Filesize
194B

MD5
ea4d3e669ad9b4382705dc4ce61834c2

SHA1
516f2ae9a11750bca6056667863f92f2cc0d2ecd

SHA256
96d21035e35f38775e4f66980a30e89ad6986fe6b0b629a0067e82717e0192eb

SHA512
bf4a612098f056769cfbb8a4905b662b9d1a56e87fd3d74ebd42fc934264367fd81b8e3519ca10cdb44775dfc13760c713ea05ef36c00b5e3fb4f1d58e2ee5c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat

Filesize
194B

MD5
085a5bc8274e25f8f3887e34c3524fc0

SHA1
f18abcda94dde737956fd18099888c211dd889e2

SHA256
a69821a49f4dfb305ed72ac4434636e1fe4c6185f669b26503c25a9697c386e4

SHA512
fc41ab17473feb8a0fd87f9d63c31c3e51987a58c1db3cf00dbc0338a8efd02dc8cd0c0ead23abfaa838274792af7f41b2ef1f0386c4f98985cf235b13fbe268

Download Submit
C:\Users\Admin\AppData\Local\Temp\N4rS0hE0df.bat

Filesize
194B

MD5
88ddcf6e21161e6fc3e39543118c20f3

SHA1
487dafc85136e1d701ab96864d97ab100c31bb8f

SHA256
4ec94b88638a642a577624ed869868d38e520e7efd15c9f318b9c15b3fe9cdac

SHA512
6ad341ad20dd72607ddd4baaa49795a165b47c2187709ee1b2c937b9cdaffe56ba5cf354c9b07dc38b70e0434bb1e8011f7b3d4fdc07d6baa1bb6cdbe9661b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\OxVZsORhRP.bat

Filesize
194B

MD5
1712a999cb3208d876efae4b3e0b13a1

SHA1
c819991344936830b5ba7125986ba25d61de7f0d

SHA256
ec2643c8d2d98196645870d68ba569a21c30e636608a2677e21609c6257687f8

SHA512
d6e8e664fdf009f716df0db7b86e06e43105da8a81afdbac784c58b2a5e1cc0fdc5906226ecf4679d883f4aff64e91f394b0b97c969474a812dbe0a742224b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat

Filesize
194B

MD5
db8a94f383f1cd2a16e1844d97cf268d

SHA1
bf656087d660ecddf886a73d5c8641fa3b101224

SHA256
91e560f13d6fbe69a509066d4c11b46db1885d5bf8702c80e8ad92be35a8a882

SHA512
221a7d553a571ef29c146c2b23053406c5dc84bac27d6b6bfde22e9152e6f71ff893101fd9dbf2b64b67f4c706696b5e2114ccab9593638d37a31d757be8b234

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dtiamvlf.b03.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhQfvaPZ4N.bat

Filesize
194B

MD5
546610121f394654e6287a53ccb631a4

SHA1
432c173c364d98966bc13bccfdb8db66de4ec0b6

SHA256
7e8e59e3c7d44b88c143b7939ae439e0008cad3102cc54e99092a43eb18a886c

SHA512
c5ba9bb827fc27b226b126aab6c844a19e331fa3b19007c8403335d978b4dc6a89182becdfa491d52431412630d4088c9688d38cbf59bf872b3ac4b560337416

Download Submit
C:\Users\Admin\AppData\Local\Temp\fmZn61weJC.bat

Filesize
194B

MD5
ae88334330c3f90021d827bc11615bfe

SHA1
21a3cea0b9af34cb601da018c39dd0d8c2fb2612

SHA256
33d0e402c57ad6fdcfab8ced7b6ac42ada42133f2209b62ecb13d2a4c0fc678b

SHA512
eacf5aa28b0454921789f8f9d0b8d315834a3b2638215783e26575cffe38fc23ba9260b7491cafa84d688ef806e6f385310020b74797b787643c45023d8ef452

Download Submit
C:\Users\Admin\AppData\Local\Temp\gW6qUMg8Bu.bat

Filesize
194B

MD5
84e7e828347e2d7784501629fa09bbe0

SHA1
3a5b3e9656093856d3d58d73be79973ef7bafc4b

SHA256
91c35839f47ee32b4cd2dec50ae7d1a0e4d42511f6ffeaa4c6be2b48d5db0c4d

SHA512
6c5f4d864956c5d7536af4354a219299230ad0c434c07a221f5eb42464aa64794a9aba6f3918f927890fd6d4d13902a100ec2e950345743cbaa5b76c1f4afd20

Download Submit
C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat

Filesize
194B

MD5
f12e0ca36d1b1f0ccab21c77a6295b0c

SHA1
fd4951dad5193f169ed8eeb4019b620f388512dc

SHA256
979816ecb4d4fcdb3691ca1ba9314632a9cbba741a86d2f16866db3decd6363b

SHA512
c495d547d868a4298ad495968f2a6f6d883620b46365317deadea4bc79c9490c8d7a51986354bab89201315944846964fdff5d7dcc9a8ba105e1f91a4b372467

Download Submit
C:\Users\Admin\AppData\Local\Temp\mQXsfud8LV.bat

Filesize
194B

MD5
257b384d7f2ce8d4f3d3f41db146cd22

SHA1
8afbebcf0bddf44001d0af7a94f3a19ec1549bf7

SHA256
dee2f8a662b8105feb26ad98165458bce5d905a9f17bbdd2b77590b72c9d00bb

SHA512
52f0af30f4d03f4c50b48bd5dd026e7144f84bca818722af3b85908fd9768f83797b2e13808375c4101b891e86683f5f88e1d9b125aba8979c7a41857dabddfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\uP802u8Cku.bat

Filesize
194B

MD5
860b53ccfc61fe84102aa72aa93c0dd7

SHA1
bbedf6990304e790000c7ad9eaf192fcd87ff490

SHA256
89214cdc67fe4941048847b4897e04197a804f7fa0bad9ddea578def845a5f6e

SHA512
8bd57504488f2db2909f641bfef7b974a7f4330fcbe49668cc05195ae18a81c8301795da7161af0ea9acba0f46fbb2281e8211cdd63309102e0b3576cd53dcd0

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/872-80-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/1076-47-0x00000173A9920000-0x00000173A9942000-memory.dmp

Filesize
136KB

Download
memory/2420-210-0x0000000003000000-0x0000000003012000-memory.dmp

Filesize
72KB

Download
memory/2468-12-0x00007FF8A7DC3000-0x00007FF8A7DC5000-memory.dmp

Filesize
8KB

Download
memory/2468-13-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

Filesize
1.1MB

Download
memory/2468-14-0x0000000002D70000-0x0000000002D82000-memory.dmp

Filesize
72KB

Download
memory/2468-15-0x0000000002E30000-0x0000000002E3C000-memory.dmp

Filesize
48KB

Download
memory/2468-16-0x0000000002E20000-0x0000000002E2C000-memory.dmp

Filesize
48KB

Download
memory/2468-17-0x0000000002E50000-0x0000000002E5C000-memory.dmp

Filesize
48KB

Download
memory/3608-241-0x0000000002DD0000-0x0000000002DE2000-memory.dmp

Filesize
72KB

Download