dcrat | 1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7.exe
Size

1.3MB
MD5

30e701cc8cd27ab94e77ea8d5622bd11
SHA1

43f3304833a89cea9c06cefae2c762b52d2b6303
SHA256

1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7
SHA512

2eb54d0b1336860f04b58c7c6eff22990c017a1dee1baa508dba049ba6c7dd02733f0cc2aa58fcf2e0aaae78f358ab814ca2335a667db7eef9d8ae3b0b023a87
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	5072	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	5072	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c85-10.dat	dcrat
behavioral2/memory/3336-13-0x0000000000F00000-0x0000000001010000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1744	powershell.exe
888	powershell.exe
3184	powershell.exe
2052	powershell.exe
5016	powershell.exe
5084	powershell.exe
3796	powershell.exe
5040	powershell.exe
4692	powershell.exe
1412	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 13 IoCs

pid	Process
3336	DllCommonsvc.exe
1632	dllhost.exe
852	dllhost.exe
4116	dllhost.exe
3672	dllhost.exe
4568	dllhost.exe
1076	dllhost.exe
3480	dllhost.exe
1560	dllhost.exe
1264	dllhost.exe
3800	dllhost.exe
4780	dllhost.exe
5016	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
55	raw.githubusercontent.com
24	raw.githubusercontent.com
40	raw.githubusercontent.com
52	raw.githubusercontent.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com
50	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
23	raw.githubusercontent.com
38	raw.githubusercontent.com
41	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\5b884080fd4f94	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Branding\shellbrd\Idle.exe	DllCommonsvc.exe
File created	C:\Windows\Branding\shellbrd\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Windows\debug\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Windows\debug\55b276f4edf653	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4768	schtasks.exe
2672	schtasks.exe
1244	schtasks.exe
624	schtasks.exe
5096	schtasks.exe
3176	schtasks.exe
2232	schtasks.exe
1716	schtasks.exe
3124	schtasks.exe
2992	schtasks.exe
2856	schtasks.exe
4956	schtasks.exe
3404	schtasks.exe
4144	schtasks.exe
3732	schtasks.exe
4972	schtasks.exe
2272	schtasks.exe
1108	schtasks.exe
2252	schtasks.exe
3020	schtasks.exe
2356	schtasks.exe
1856	schtasks.exe
3472	schtasks.exe
4640	schtasks.exe
2760	schtasks.exe
4740	schtasks.exe
4308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3336	DllCommonsvc.exe
3336	DllCommonsvc.exe
3336	DllCommonsvc.exe
3336	DllCommonsvc.exe
3336	DllCommonsvc.exe
2052	powershell.exe
2052	powershell.exe
4692	powershell.exe
4692	powershell.exe
3184	powershell.exe
3184	powershell.exe
5016	powershell.exe
5016	powershell.exe
5084	powershell.exe
5084	powershell.exe
3796	powershell.exe
3796	powershell.exe
1412	powershell.exe
1412	powershell.exe
888	powershell.exe
888	powershell.exe
5040	powershell.exe
5040	powershell.exe
5040	powershell.exe
1744	powershell.exe
1744	powershell.exe
2052	powershell.exe
4692	powershell.exe
3184	powershell.exe
5016	powershell.exe
3796	powershell.exe
5084	powershell.exe
1412	powershell.exe
888	powershell.exe
1744	powershell.exe
1632	dllhost.exe
852	dllhost.exe
4116	dllhost.exe
3672	dllhost.exe
4568	dllhost.exe
1076	dllhost.exe
3480	dllhost.exe
1560	dllhost.exe
1264	dllhost.exe
3800	dllhost.exe
4780	dllhost.exe
5016	dllhost.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	DllCommonsvc.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1632	dllhost.exe
Token: SeDebugPrivilege	852	dllhost.exe
Token: SeDebugPrivilege	4116	dllhost.exe
Token: SeDebugPrivilege	3672	dllhost.exe
Token: SeDebugPrivilege	4568	dllhost.exe
Token: SeDebugPrivilege	1076	dllhost.exe
Token: SeDebugPrivilege	3480	dllhost.exe
Token: SeDebugPrivilege	1560	dllhost.exe
Token: SeDebugPrivilege	1264	dllhost.exe
Token: SeDebugPrivilege	3800	dllhost.exe
Token: SeDebugPrivilege	4780	dllhost.exe
Token: SeDebugPrivilege	5016	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 4256	2752	JaffaCakes118_1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7.exe	83
PID 2752 wrote to memory of 4256	2752	JaffaCakes118_1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7.exe	83
PID 2752 wrote to memory of 4256	2752	JaffaCakes118_1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7.exe	83
PID 4256 wrote to memory of 2840	4256	WScript.exe	85
PID 4256 wrote to memory of 2840	4256	WScript.exe	85
PID 4256 wrote to memory of 2840	4256	WScript.exe	85
PID 2840 wrote to memory of 3336	2840	cmd.exe	87
PID 2840 wrote to memory of 3336	2840	cmd.exe	87
PID 3336 wrote to memory of 1744	3336	DllCommonsvc.exe	117
PID 3336 wrote to memory of 1744	3336	DllCommonsvc.exe	117
PID 3336 wrote to memory of 5040	3336	DllCommonsvc.exe	118
PID 3336 wrote to memory of 5040	3336	DllCommonsvc.exe	118
PID 3336 wrote to memory of 3796	3336	DllCommonsvc.exe	119
PID 3336 wrote to memory of 3796	3336	DllCommonsvc.exe	119
PID 3336 wrote to memory of 5084	3336	DllCommonsvc.exe	120
PID 3336 wrote to memory of 5084	3336	DllCommonsvc.exe	120
PID 3336 wrote to memory of 5016	3336	DllCommonsvc.exe	122
PID 3336 wrote to memory of 5016	3336	DllCommonsvc.exe	122
PID 3336 wrote to memory of 2052	3336	DllCommonsvc.exe	123
PID 3336 wrote to memory of 2052	3336	DllCommonsvc.exe	123
PID 3336 wrote to memory of 1412	3336	DllCommonsvc.exe	124
PID 3336 wrote to memory of 1412	3336	DllCommonsvc.exe	124
PID 3336 wrote to memory of 4692	3336	DllCommonsvc.exe	125
PID 3336 wrote to memory of 4692	3336	DllCommonsvc.exe	125
PID 3336 wrote to memory of 3184	3336	DllCommonsvc.exe	126
PID 3336 wrote to memory of 3184	3336	DllCommonsvc.exe	126
PID 3336 wrote to memory of 888	3336	DllCommonsvc.exe	127
PID 3336 wrote to memory of 888	3336	DllCommonsvc.exe	127
PID 3336 wrote to memory of 3800	3336	DllCommonsvc.exe	137
PID 3336 wrote to memory of 3800	3336	DllCommonsvc.exe	137
PID 3800 wrote to memory of 1424	3800	cmd.exe	139
PID 3800 wrote to memory of 1424	3800	cmd.exe	139
PID 3800 wrote to memory of 1632	3800	cmd.exe	146
PID 3800 wrote to memory of 1632	3800	cmd.exe	146
PID 1632 wrote to memory of 1308	1632	dllhost.exe	154
PID 1632 wrote to memory of 1308	1632	dllhost.exe	154
PID 1308 wrote to memory of 4300	1308	cmd.exe	156
PID 1308 wrote to memory of 4300	1308	cmd.exe	156
PID 1308 wrote to memory of 852	1308	cmd.exe	158
PID 1308 wrote to memory of 852	1308	cmd.exe	158
PID 852 wrote to memory of 4880	852	dllhost.exe	163
PID 852 wrote to memory of 4880	852	dllhost.exe	163
PID 4880 wrote to memory of 3924	4880	cmd.exe	165
PID 4880 wrote to memory of 3924	4880	cmd.exe	165
PID 4880 wrote to memory of 4116	4880	cmd.exe	167
PID 4880 wrote to memory of 4116	4880	cmd.exe	167
PID 4116 wrote to memory of 888	4116	dllhost.exe	169
PID 4116 wrote to memory of 888	4116	dllhost.exe	169
PID 888 wrote to memory of 4536	888	cmd.exe	171
PID 888 wrote to memory of 4536	888	cmd.exe	171
PID 888 wrote to memory of 3672	888	cmd.exe	173
PID 888 wrote to memory of 3672	888	cmd.exe	173
PID 3672 wrote to memory of 2108	3672	dllhost.exe	175
PID 3672 wrote to memory of 2108	3672	dllhost.exe	175
PID 2108 wrote to memory of 4420	2108	cmd.exe	178
PID 2108 wrote to memory of 4420	2108	cmd.exe	178
PID 2108 wrote to memory of 4568	2108	cmd.exe	179
PID 2108 wrote to memory of 4568	2108	cmd.exe	179
PID 4568 wrote to memory of 1208	4568	dllhost.exe	181
PID 4568 wrote to memory of 1208	4568	dllhost.exe	181
PID 1208 wrote to memory of 856	1208	cmd.exe	183
PID 1208 wrote to memory of 856	1208	cmd.exe	183
PID 1208 wrote to memory of 1076	1208	cmd.exe	185
PID 1208 wrote to memory of 1076	1208	cmd.exe	185

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f223271e0797d707f249e064949dbac5e232a03a0fdfdecf770a671612ea0b7.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\shellbrd\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Adobe\HelpCfg\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dtwYHtnRtU.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3800
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1424
      - C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4300
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3924
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7bDnwPuEug.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4536
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4420
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1hmmkqxEk5.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:856
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mv5UKbIUPK.bat"
        17⤵
        
        PID:388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:5032
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hC9SSnetfo.bat"
        19⤵
        
        PID:3872
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1244
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1hmmkqxEk5.bat"
        21⤵
        
        PID:1744
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2912
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"
        23⤵
        
        PID:1716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3584
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat"
        25⤵
        
        PID:1504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4732
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZDYK5nApHO.bat"
        27⤵
        
        PID:5008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:1620
        
        C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe
        
        "C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Branding\shellbrd\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Branding\shellbrd\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\Branding\shellbrd\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Adobe\HelpCfg\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\HelpCfg\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Adobe\HelpCfg\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\uninstall\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\debug\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\debug\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\debug\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\1hmmkqxEk5.bat

Filesize
219B

MD5
58d955736caebaba58936ecc1b7864d3

SHA1
632c3acb288c1fb3043db32e0cd8a09e42909de0

SHA256
e5d489c39c0e16691a2ab7658826d00b31e0af1bef765f95dab5fe28ffeaf739

SHA512
acaff8066dfe3a85d92a2640647c6cb8e4e12173c46f77283e5974d2c494c1631e1254abed05b61df7635c86c7e21506ae8d13875a93993e9219389c4cbeb0bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat

Filesize
219B

MD5
de2a93e1989ba459f6d8262ba63624c5

SHA1
a6bb5336d37e63c31a682112128c6bb2becdb994

SHA256
1d30b92b0dec594a57ed3a4f12c9f147c64d26b3ee991eb3983aefce2f8c7b78

SHA512
bc8fc15782662212db7b8574c7f3dc2de00f81effd7ec2f236baf1a79a7d7fa73d21ab0a5d033729f224ce040fb1d0c4cce851d2f531eb047b32940dfee95cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7bDnwPuEug.bat

Filesize
219B

MD5
23977482e763bb8b1c06b7431ece12fb

SHA1
4c9d9b41dcf2b010708980800c63705a74747e46

SHA256
56279b8e3231117d96c88d5b80ea7169cc6ce824e0e3c7fe148eb86e27503dc1

SHA512
a9de09f529134beda5def365570338c5cfb9d31380b2bffaa9ab3917567c25057cc08e7f4a54311b47675c43f048976ce0e75d5872490be0494167aa5676ad6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat

Filesize
219B

MD5
2b1504b8f204c4f3ca199519012a5dd2

SHA1
cd8b597b0b9864f5c07d09ce7c58fb10c02fb58c

SHA256
793d697ddc1080bad38575b7d60f2fe2bf7b6562a1162db3dc5dd599fd6556a0

SHA512
a0377b03b683eb6dbe97c83ac114761d7a82cc32578c3423f18d1e635e9789ddd1ba60322995c9826e41506ce8ccdddc40fc08796120baf8c8cb206d8393b1fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat

Filesize
219B

MD5
2943b6c82513af161770b9de5ac8dd04

SHA1
4a2e9053e97b1e06175279aef8362ec407f9358b

SHA256
1a69e02118f0351acccf6d88f3138258a12c231f6dd0ee73b17ac469ef4a7b06

SHA512
88e4cf5c378bdf930727efa7a67f8a0c121a597ec91efbb2919e8b9c1e9d011f80989a8d58053207cb744b17546719ead8a82736118f920638e320843932abba

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat

Filesize
219B

MD5
18170d1fd3a84c4c0522712ba7c5388f

SHA1
61b05aaed9094d61d8899f830cc65c1f00c192e6

SHA256
74f728fc380e57d8d5e5052c2efb0c1b7fb4dbaa2efa299b5d2579033f627351

SHA512
0ee32ab1035c52193a68dae18b612195192884e5b0af6f61af2e5a1afd25bf245c07f95032050a8105731841092b413d0c548b49fa739e11cb280afddb395f91

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZDYK5nApHO.bat

Filesize
219B

MD5
faff7056ccb03e0690f87c5e38f535f4

SHA1
ea26e6c8f7fc98f203d4ad62779dcec9ba67974a

SHA256
c28c51d904d0db1d79a4e474a1df173d80bd73fa453ae0a3a3721669a9483dc2

SHA512
686146949ce4fd397ddca6ebfc713f9905be9b0c486270a2d042fa83e7b4ea3d6924b8fd4cfd7170741384e4a3f33832091b943e1ce8204cfba93de090386f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4mm5upf.mpu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dtwYHtnRtU.bat

Filesize
219B

MD5
0c071eaaa0b22d3e05ca2f5952502e58

SHA1
da88d08aaaae450a4c6fc72854aee761907c1e0e

SHA256
5cff3d0a382ea6be96ccc77b1d660ffd321421490c2d5a1e0ede25c5ed289064

SHA512
06f9b6060794ce58c7f02f454924c0a52a05d876ddc90a8bc36c328e13dbf67953e69b2ee19f953ad5b291e38a0cf195818a3534eedec2207384c1613dc2c0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\hC9SSnetfo.bat

Filesize
219B

MD5
9eb3b81d8fb5b26bbc9efd62fe6d7f1b

SHA1
400851aa0a341d83a13cccd6bfc4ab807dcf8771

SHA256
3e2e56b824c3f7acb896b6b9edaa0cfcea0ce50e61d1d49c279240ac2260de5d

SHA512
7393c6db7560720adebdb6fd97f1aec661eb7931873f7aec5d45d81eea4a915bdbedc34c0be3f121e2f8d6945a91789ecc5ae7342b6f4e4ff8ead663c9ba1c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\mv5UKbIUPK.bat

Filesize
219B

MD5
8948ccabd84ad676f3cdc38364167def

SHA1
3b73d343273839de64c089da989abf7a3c5f2f87

SHA256
93187fe875c0cd6e1b1b601c3d39f4e48545e9b56887992eb0dfebd612497271

SHA512
97c7d3ad7b1a10244cae98becc61c1105407a8583fab20ead6827c54d3ba5f5a6c7d949c90635a5eabb5332c643030650de07a631747a2c6c7ad01f025f00195

Download Submit
C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat

Filesize
219B

MD5
c4333119de7cb6edf4f67c2db55c4b95

SHA1
6bc5b410d4343c229d4a7b182611ef962f89b452

SHA256
cfe9c8912994164cc74eb0ce02f0038ce592eb8c66193803d7d4d458500c1e97

SHA512
e484a78e358d6357d55301d56c69508ec1dfabdc91b263d23ac9a76a129a869befa2984162eef0ded9724010f3a0b12bd94d47e7873cd2d7c0094fb3680807b6

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/852-166-0x000000001C9B0000-0x000000001CA06000-memory.dmp

Filesize
344KB

Download
memory/1076-194-0x000000001BDB0000-0x000000001BE06000-memory.dmp

Filesize
344KB

Download
memory/1264-210-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/1632-158-0x000000001BAB0000-0x000000001BBB2000-memory.dmp

Filesize
1.0MB

Download
memory/2052-49-0x00000192BE9A0000-0x00000192BE9C2000-memory.dmp

Filesize
136KB

Download
memory/3336-17-0x0000000003260000-0x000000000326C000-memory.dmp

Filesize
48KB

Download
memory/3336-16-0x0000000003250000-0x000000000325C000-memory.dmp

Filesize
48KB

Download
memory/3336-15-0x0000000003240000-0x000000000324C000-memory.dmp

Filesize
48KB

Download
memory/3336-14-0x0000000003230000-0x0000000003242000-memory.dmp

Filesize
72KB

Download
memory/3336-13-0x0000000000F00000-0x0000000001010000-memory.dmp

Filesize
1.1MB

Download
memory/3336-12-0x00007FFD54D43000-0x00007FFD54D45000-memory.dmp

Filesize
8KB

Download
memory/3480-197-0x0000000002CA0000-0x0000000002CB2000-memory.dmp

Filesize
72KB

Download
memory/3672-180-0x000000001C630000-0x000000001C686000-memory.dmp

Filesize
344KB

Download
memory/4116-173-0x000000001C520000-0x000000001C576000-memory.dmp

Filesize
344KB

Download
memory/4568-188-0x000000001C090000-0x000000001C0E6000-memory.dmp

Filesize
344KB

Download
memory/4780-223-0x00000000031B0000-0x00000000031C2000-memory.dmp

Filesize
72KB

Download