dcrat | 11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2024, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe
Size

1.3MB
MD5

f2803766a2f7cea3e91c2840ac2f85a6
SHA1

546004d9f413ae33db3b6d74eceea26e6453b596
SHA256

11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480
SHA512

c6116141dcc7ebb3efcffda6f128e9a5b0c586f26ce6bb86e738eb2d89a781bac053e4f77b7314236e59df4ecf6f4b561be131b025db9fedbf89ec0f1672f491
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	2624	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0008000000023c08-9.dat	dcrat
behavioral2/memory/544-13-0x0000000000BE0000-0x0000000000CF0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5108	powershell.exe
756	powershell.exe
4948	powershell.exe
1508	powershell.exe
4364	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 13 IoCs

pid	Process
544	DllCommonsvc.exe
4388	RuntimeBroker.exe
3024	RuntimeBroker.exe
2428	RuntimeBroker.exe
2916	RuntimeBroker.exe
1252	RuntimeBroker.exe
2308	RuntimeBroker.exe
2912	RuntimeBroker.exe
2528	RuntimeBroker.exe
4620	RuntimeBroker.exe
2372	RuntimeBroker.exe
3600	RuntimeBroker.exe
3404	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
19	raw.githubusercontent.com
34	raw.githubusercontent.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
42	raw.githubusercontent.com
43	raw.githubusercontent.com
44	raw.githubusercontent.com
49	raw.githubusercontent.com
50	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com
53	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\ebf1f9fa8afd6d	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Prefetch\smss.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\Prefetch\smss.exe	DllCommonsvc.exe
File created	C:\Windows\Prefetch\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\PrintDialog\en-US\sppsvc.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1816	schtasks.exe
2304	schtasks.exe
2740	schtasks.exe
4976	schtasks.exe
4572	schtasks.exe
4784	schtasks.exe
3328	schtasks.exe
2696	schtasks.exe
3988	schtasks.exe
4296	schtasks.exe
2412	schtasks.exe
3916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
544	DllCommonsvc.exe
1508	powershell.exe
756	powershell.exe
4948	powershell.exe
4364	powershell.exe
4364	powershell.exe
5108	powershell.exe
5108	powershell.exe
756	powershell.exe
4948	powershell.exe
1508	powershell.exe
4388	RuntimeBroker.exe
3024	RuntimeBroker.exe
2428	RuntimeBroker.exe
2916	RuntimeBroker.exe
1252	RuntimeBroker.exe
2308	RuntimeBroker.exe
2912	RuntimeBroker.exe
2528	RuntimeBroker.exe
4620	RuntimeBroker.exe
2372	RuntimeBroker.exe
3600	RuntimeBroker.exe
3404	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	DllCommonsvc.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	4388	RuntimeBroker.exe
Token: SeDebugPrivilege	3024	RuntimeBroker.exe
Token: SeDebugPrivilege	2428	RuntimeBroker.exe
Token: SeDebugPrivilege	2916	RuntimeBroker.exe
Token: SeDebugPrivilege	1252	RuntimeBroker.exe
Token: SeDebugPrivilege	2308	RuntimeBroker.exe
Token: SeDebugPrivilege	2912	RuntimeBroker.exe
Token: SeDebugPrivilege	2528	RuntimeBroker.exe
Token: SeDebugPrivilege	4620	RuntimeBroker.exe
Token: SeDebugPrivilege	2372	RuntimeBroker.exe
Token: SeDebugPrivilege	3600	RuntimeBroker.exe
Token: SeDebugPrivilege	3404	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 3376	1064	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe	83
PID 1064 wrote to memory of 3376	1064	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe	83
PID 1064 wrote to memory of 3376	1064	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe	83
PID 3376 wrote to memory of 2620	3376	WScript.exe	85
PID 3376 wrote to memory of 2620	3376	WScript.exe	85
PID 3376 wrote to memory of 2620	3376	WScript.exe	85
PID 2620 wrote to memory of 544	2620	cmd.exe	87
PID 2620 wrote to memory of 544	2620	cmd.exe	87
PID 544 wrote to memory of 5108	544	DllCommonsvc.exe	102
PID 544 wrote to memory of 5108	544	DllCommonsvc.exe	102
PID 544 wrote to memory of 756	544	DllCommonsvc.exe	103
PID 544 wrote to memory of 756	544	DllCommonsvc.exe	103
PID 544 wrote to memory of 4948	544	DllCommonsvc.exe	104
PID 544 wrote to memory of 4948	544	DllCommonsvc.exe	104
PID 544 wrote to memory of 1508	544	DllCommonsvc.exe	105
PID 544 wrote to memory of 1508	544	DllCommonsvc.exe	105
PID 544 wrote to memory of 4364	544	DllCommonsvc.exe	106
PID 544 wrote to memory of 4364	544	DllCommonsvc.exe	106
PID 544 wrote to memory of 2288	544	DllCommonsvc.exe	112
PID 544 wrote to memory of 2288	544	DllCommonsvc.exe	112
PID 2288 wrote to memory of 3436	2288	cmd.exe	114
PID 2288 wrote to memory of 3436	2288	cmd.exe	114
PID 2288 wrote to memory of 4388	2288	cmd.exe	115
PID 2288 wrote to memory of 4388	2288	cmd.exe	115
PID 4388 wrote to memory of 2840	4388	RuntimeBroker.exe	128
PID 4388 wrote to memory of 2840	4388	RuntimeBroker.exe	128
PID 2840 wrote to memory of 2392	2840	cmd.exe	130
PID 2840 wrote to memory of 2392	2840	cmd.exe	130
PID 2840 wrote to memory of 3024	2840	cmd.exe	132
PID 2840 wrote to memory of 3024	2840	cmd.exe	132
PID 3024 wrote to memory of 2416	3024	RuntimeBroker.exe	136
PID 3024 wrote to memory of 2416	3024	RuntimeBroker.exe	136
PID 2416 wrote to memory of 4688	2416	cmd.exe	138
PID 2416 wrote to memory of 4688	2416	cmd.exe	138
PID 2416 wrote to memory of 2428	2416	cmd.exe	141
PID 2416 wrote to memory of 2428	2416	cmd.exe	141
PID 2428 wrote to memory of 4792	2428	RuntimeBroker.exe	143
PID 2428 wrote to memory of 4792	2428	RuntimeBroker.exe	143
PID 4792 wrote to memory of 1508	4792	cmd.exe	145
PID 4792 wrote to memory of 1508	4792	cmd.exe	145
PID 4792 wrote to memory of 2916	4792	cmd.exe	147
PID 4792 wrote to memory of 2916	4792	cmd.exe	147
PID 2916 wrote to memory of 4632	2916	RuntimeBroker.exe	149
PID 2916 wrote to memory of 4632	2916	RuntimeBroker.exe	149
PID 4632 wrote to memory of 3520	4632	cmd.exe	151
PID 4632 wrote to memory of 3520	4632	cmd.exe	151
PID 4632 wrote to memory of 1252	4632	cmd.exe	153
PID 4632 wrote to memory of 1252	4632	cmd.exe	153
PID 1252 wrote to memory of 1632	1252	RuntimeBroker.exe	155
PID 1252 wrote to memory of 1632	1252	RuntimeBroker.exe	155
PID 1632 wrote to memory of 4976	1632	cmd.exe	157
PID 1632 wrote to memory of 4976	1632	cmd.exe	157
PID 1632 wrote to memory of 2308	1632	cmd.exe	159
PID 1632 wrote to memory of 2308	1632	cmd.exe	159
PID 2308 wrote to memory of 4624	2308	RuntimeBroker.exe	161
PID 2308 wrote to memory of 4624	2308	RuntimeBroker.exe	161
PID 4624 wrote to memory of 4404	4624	cmd.exe	163
PID 4624 wrote to memory of 4404	4624	cmd.exe	163
PID 4624 wrote to memory of 2912	4624	cmd.exe	165
PID 4624 wrote to memory of 2912	4624	cmd.exe	165
PID 2912 wrote to memory of 2844	2912	RuntimeBroker.exe	167
PID 2912 wrote to memory of 2844	2912	RuntimeBroker.exe	167
PID 2844 wrote to memory of 800	2844	cmd.exe	169
PID 2844 wrote to memory of 800	2844	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4364
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IdFEdbtPnD.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2288
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3436
      - C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5mXdMdden9.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2392
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4688
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pbn0SniZDX.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1508
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3520
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l8nFZEr7oq.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4976
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WVE2eLfZN7.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4404
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:800
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Dk8ljd7jBY.bat"
        21⤵
        
        PID:2188
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4944
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o4pIGJu18c.bat"
        23⤵
        
        PID:3636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4204
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HiXkD60p2N.bat"
        25⤵
        
        PID:2120
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:3584
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FgAoPiAcVL.bat"
        27⤵
        
        PID:5104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2408
        
        C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pFKIY4EPZg.bat"
        29⤵
        
        PID:1772
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Prefetch\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Prefetch\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
71fa55c67a762ba70e40011153e19b3c

SHA1
a36d2bb4802a8ec7db1a68de5f0c3d6007987492

SHA256
b8be6896ca89d3ebe9ee8a94e3407483f4750badaf7fa33526817cfc926dc291

SHA512
32760af7c05e20fec8cbddf56c2df544a69335f930f1d313cd1fdceaa90ed2afe81e54ac1b6770097d6f5ca5f30955f95970171a453579aa19239a17aaefe47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat

Filesize
221B

MD5
6f018589a9c00d3754a36df09ff7838c

SHA1
c95ad50cdb1276f40bc40779b1d758dabea0d651

SHA256
15b33dd57dda2f486f5017b8bb8f0ce2271e140de3277d73529868bea7fd29fa

SHA512
1198ef8509d02d9aabedfd0b93d0c645cb52278d27b8c1922535e88b1e90189c6d74ef22e96f807a9e76a8e735cc98c21e9d8ea22e8746ec55b3b0e87ad45ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\5mXdMdden9.bat

Filesize
221B

MD5
bd01fea7a98bb7511fdbc41585a9b004

SHA1
0aa99e782a4eabda765edf5740cee3c9313d4d75

SHA256
199f5606ba57caceb7ef2b664a10f34adcb81323df594dd2e1ce9a19442ae134

SHA512
e7402cf7348d63fa40023028dc56c5947028c36cc8fd9ec28be83d8cad9ddebe7d2a34d48657ee1e4b0dbf28075143d86fb673269c8c0b5d6126e0300ce69cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dk8ljd7jBY.bat

Filesize
221B

MD5
3c40aa5c22ef125b076f60ec93768569

SHA1
d6d9fdb78fd5bb04a6eda702d575fa33c6c3cc00

SHA256
5e7e7c03c3420a75419bb470a516a4faf0fd69732aa4dcdd3b0201658502f2a5

SHA512
2eea60ec1832afd840a8b286f1cea7d9f221bc2c9a5b0e0ad45069e2c792c409d33f045b9eb702706e0005fe6ebd93c2315c4db76f20b29070d4200a9531b41e

Download Submit
C:\Users\Admin\AppData\Local\Temp\FgAoPiAcVL.bat

Filesize
221B

MD5
168e03cf03213ae6dd34c9fe91e93d0d

SHA1
a2551a5f8e88a52a911cfccd89aae08ca1a3aa7c

SHA256
004c4902811b4c8b735d99e5d95e0552ce5aead7b55b3d5bfa44abbd905988d3

SHA512
90ec87621c8eadec76c7ba9f5073a04da7860133c16d9bd026d8a4dfb245a0bc87dbcc5e5ef43a8b87c3c74ea70d098c324e5175263bd1b41d70154a55c3119e

Download Submit
C:\Users\Admin\AppData\Local\Temp\HiXkD60p2N.bat

Filesize
221B

MD5
54037e49fe1775148a2a7b32bea50947

SHA1
e0956e9e9a63b68d1c57a6b31551e90af6736b71

SHA256
a5641c9048320d54c5ee53a1721fc8daae341bfdfe2e6b9fec6df2d3050b11f4

SHA512
9d696e7676969d3a94f3d0e2255eeb8be08118967196aaa651a77aa8af7bffac679a0b2d00c791fe78268e749bd0cfa528bfd979c6892a1b6a69eaa2fa2256d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IdFEdbtPnD.bat

Filesize
221B

MD5
fcac6f9b6c4614c40915b0380dbcd23a

SHA1
a7040a0276b972b27a9d0f0a85237025215bc130

SHA256
95e87c8d6385c8e05a70102192c8766ea2682537aea9b166b6c23265eb709259

SHA512
58d84a1565694e2fa0b55d4be7bd9c9fadc892e7566972b4968a2844e49a781afa83a9beb654b3f09458f9f0cbf58bc3331e57153462c3388e37c56f68d59b53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pbn0SniZDX.bat

Filesize
221B

MD5
842f06094c338b9b8b4a3f74dbb7559b

SHA1
2a2e8da56931373de1bf6fc86aee68673eb6e675

SHA256
b59a3c731edb83d31c6e758c7f7d1eb17609de02e63cbeb4e02e5bb14423c2ce

SHA512
23988c76d286f8098132e7d708b56aba83dcfd54e81dd2837276efe574fe2fcbf31a074a1330a18e44979bde71df6bcb1cb2cfe0298fa9dd3215f5cead5ea159

Download Submit
C:\Users\Admin\AppData\Local\Temp\WVE2eLfZN7.bat

Filesize
221B

MD5
aa1f1e5e539fe3746c5fa0b8ac4c52c7

SHA1
4287f52af6ab10fd191d2ad9f701e1e111153d41

SHA256
57247672ddf8b843b2423716f14836f52385814f3d1f6cf7f19999598adcd7f3

SHA512
9fd3be0ef4a40c38bed65147047ad2efdfd6eb53b6eb840250e1b1caa5850c161b53855d4a8b94b0895077a8a044be9f947429c692bede419b232d57fecabdd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat

Filesize
221B

MD5
9d7f4bc80aaf310660cadcd02214de78

SHA1
647546923daf22cba341edb2485d778232213750

SHA256
bd84cdde5131348a253402babf10378bb19569c63d32d9cd6800971b30eff928

SHA512
2057a9f86caa024881348dfb9025111234cb7f0ad4ee0db3ac428e295cc0aa48e5b867c019ef955a907b5e1197f20f2db49ba7cc1e3f8a210cc5449c3701a915

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wttnqv4z.lf0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\l8nFZEr7oq.bat

Filesize
221B

MD5
f74230b00c28bf3e6c1ccba7adc64d3a

SHA1
a0ae2585b43c15271839b4000377b8c928893858

SHA256
db7360cbeeee61a0f55923e349e9ca044093b634f3337b55040136e4e6164773

SHA512
6a2ed030d0b6993cbb12f3233c66f437d5bdae084504480610ea3a2f595b8675b39be0b9e2550d91476a7142abcf96327479d4f2098fe735de110945d1b2ccb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\o4pIGJu18c.bat

Filesize
221B

MD5
990f20b6e793e2d766acb481c2139415

SHA1
d4e4b7260647ac36df5489994cd961e676d02f50

SHA256
5ba1d372493567ab8d22786343c880e12fedd8d934ba67deb3cff6e38dc292f8

SHA512
b4d8be9d40c7995489d46f9e59c9959010e07f6c24b1ee413bc51170aeb34ea4d6bcbda608170c9794a1e7cfaba8167015ff8188e5992e6d0504d76e1e616451

Download Submit
C:\Users\Admin\AppData\Local\Temp\pFKIY4EPZg.bat

Filesize
221B

MD5
8e92a8ea89a3da979331ab6caec3f4dc

SHA1
8a19e27825ba88e95e8e412a10f16bada2f588c2

SHA256
a4ed5b74502f39a648802a39faada7a5916ef3efc1d0c266747ef2ed5b22fecb

SHA512
2af3be23eecf54acd760f651ffebd0604b0fb6dd751e3e2087cb8828551fda321ab53ba80b7585c3b7f9ceab63c5c1547df0220ec44723baa9963149e2c68622

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat

Filesize
221B

MD5
b39086d65c53b7fc07e56c72ca7edcd0

SHA1
6fcc24d91bf196f300c7307cff0d97329ced0ffd

SHA256
2991e15f1d25416ef5be6cbcb1d1c74c4a46d93b97c7303feb26e8e9d3eb1657

SHA512
45dc99d344a36af23a83933ad799a8b47c465308d7318043a3e6cc5ffbb5510049eb0c5ca2221249cf9d562d329576549156032a4be204427afba9ac8f51b596

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/544-15-0x0000000003030000-0x000000000303C000-memory.dmp

Filesize
48KB

Download
memory/544-12-0x00007FFAB0FE3000-0x00007FFAB0FE5000-memory.dmp

Filesize
8KB

Download
memory/544-13-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

Filesize
1.1MB

Download
memory/544-17-0x0000000003040000-0x000000000304C000-memory.dmp

Filesize
48KB

Download
memory/544-16-0x0000000003020000-0x000000000302C000-memory.dmp

Filesize
48KB

Download
memory/544-14-0x0000000002EB0000-0x0000000002EC2000-memory.dmp

Filesize
72KB

Download
memory/1508-40-0x0000022DAC270000-0x0000022DAC292000-memory.dmp

Filesize
136KB

Download
memory/2372-158-0x000000001D740000-0x000000001D8E9000-memory.dmp

Filesize
1.7MB

Download
memory/2372-159-0x000000001D740000-0x000000001D8E9000-memory.dmp

Filesize
1.7MB

Download
memory/2428-108-0x000000001D440000-0x000000001D452000-memory.dmp

Filesize
72KB

Download
memory/2528-144-0x000000001D080000-0x000000001D229000-memory.dmp

Filesize
1.7MB

Download
memory/2912-133-0x000000001B9F0000-0x000000001BA02000-memory.dmp

Filesize
72KB

Download
memory/3024-99-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download
memory/3024-105-0x000000001DD60000-0x000000001DF09000-memory.dmp

Filesize
1.7MB

Download
memory/3024-104-0x000000001DCB0000-0x000000001DD51000-memory.dmp

Filesize
644KB

Download
memory/3404-169-0x000000001ADF0000-0x000000001AE02000-memory.dmp

Filesize
72KB

Download
memory/3404-175-0x000000001D340000-0x000000001D4E9000-memory.dmp

Filesize
1.7MB

Download
memory/3600-166-0x000000001DB80000-0x000000001DD29000-memory.dmp

Filesize
1.7MB

Download
memory/4388-90-0x00000000013F0000-0x0000000001402000-memory.dmp

Filesize
72KB

Download
memory/4620-151-0x000000001D640000-0x000000001D7E9000-memory.dmp

Filesize
1.7MB

Download