dcrat | 719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50.exe
Size

1.3MB
MD5

a22546d928cea34b793c106e37325125
SHA1

24ffec1c4b946454666f1b22f30bd517c4fa5040
SHA256

719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50
SHA512

9d4eb1939257b9db05e79b71f2aed5bf794176da95997782f214e5ac700765ccb781b8d64d4198b6119a86ae2c3f64e11693399a68251c8b174abaf86f8e1c7b
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	220	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	220	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c83-10.dat	dcrat
behavioral2/memory/2512-13-0x00000000003A0000-0x00000000004B0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4516	powershell.exe
2928	powershell.exe
2292	powershell.exe
3340	powershell.exe
2988	powershell.exe
4416	powershell.exe
2344	powershell.exe
2908	powershell.exe
1808	powershell.exe
396	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe

Executes dropped EXE 14 IoCs

pid	Process
2512	DllCommonsvc.exe
3256	DllCommonsvc.exe
2480	DllCommonsvc.exe
3492	DllCommonsvc.exe
2764	DllCommonsvc.exe
5004	DllCommonsvc.exe
2056	DllCommonsvc.exe
4056	DllCommonsvc.exe
380	DllCommonsvc.exe
3244	DllCommonsvc.exe
404	DllCommonsvc.exe
4588	DllCommonsvc.exe
1076	DllCommonsvc.exe
4932	DllCommonsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
52	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
17	raw.githubusercontent.com
25	raw.githubusercontent.com
39	raw.githubusercontent.com
40	raw.githubusercontent.com
45	raw.githubusercontent.com
56	raw.githubusercontent.com
18	raw.githubusercontent.com
44	raw.githubusercontent.com
46	raw.githubusercontent.com
55	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files\Common Files\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\5b884080fd4f94	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\smss.exe	DllCommonsvc.exe
File created	C:\Windows\L2Schemas\69ddcba757bf72	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	JaffaCakes118_719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2164	schtasks.exe
2692	schtasks.exe
3300	schtasks.exe
4672	schtasks.exe
3908	schtasks.exe
2724	schtasks.exe
3632	schtasks.exe
2668	schtasks.exe
2624	schtasks.exe
2168	schtasks.exe
2852	schtasks.exe
1956	schtasks.exe
1136	schtasks.exe
1496	schtasks.exe
2504	schtasks.exe
1544	schtasks.exe
1584	schtasks.exe
376	schtasks.exe
1752	schtasks.exe
3736	schtasks.exe
4652	schtasks.exe
3004	schtasks.exe
5076	schtasks.exe
740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2512	DllCommonsvc.exe
4416	powershell.exe
2344	powershell.exe
4516	powershell.exe
2988	powershell.exe
2344	powershell.exe
4416	powershell.exe
4516	powershell.exe
2988	powershell.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
3256	DllCommonsvc.exe
2928	powershell.exe
2908	powershell.exe
1808	powershell.exe
396	powershell.exe
2292	powershell.exe
3340	powershell.exe
2908	powershell.exe
2480	DllCommonsvc.exe
2928	powershell.exe
396	powershell.exe
1808	powershell.exe
2292	powershell.exe
3340	powershell.exe
3492	DllCommonsvc.exe
2764	DllCommonsvc.exe
5004	DllCommonsvc.exe
2056	DllCommonsvc.exe
4056	DllCommonsvc.exe
380	DllCommonsvc.exe
3244	DllCommonsvc.exe
404	DllCommonsvc.exe
4588	DllCommonsvc.exe
1076	DllCommonsvc.exe
4932	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	DllCommonsvc.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	3256	DllCommonsvc.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2480	DllCommonsvc.exe
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeDebugPrivilege	3492	DllCommonsvc.exe
Token: SeDebugPrivilege	2764	DllCommonsvc.exe
Token: SeDebugPrivilege	5004	DllCommonsvc.exe
Token: SeDebugPrivilege	2056	DllCommonsvc.exe
Token: SeDebugPrivilege	4056	DllCommonsvc.exe
Token: SeDebugPrivilege	380	DllCommonsvc.exe
Token: SeDebugPrivilege	3244	DllCommonsvc.exe
Token: SeDebugPrivilege	404	DllCommonsvc.exe
Token: SeDebugPrivilege	4588	DllCommonsvc.exe
Token: SeDebugPrivilege	1076	DllCommonsvc.exe
Token: SeDebugPrivilege	4932	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 1464	776	JaffaCakes118_719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50.exe	83
PID 776 wrote to memory of 1464	776	JaffaCakes118_719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50.exe	83
PID 776 wrote to memory of 1464	776	JaffaCakes118_719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50.exe	83
PID 1464 wrote to memory of 3112	1464	WScript.exe	85
PID 1464 wrote to memory of 3112	1464	WScript.exe	85
PID 1464 wrote to memory of 3112	1464	WScript.exe	85
PID 3112 wrote to memory of 2512	3112	cmd.exe	87
PID 3112 wrote to memory of 2512	3112	cmd.exe	87
PID 2512 wrote to memory of 2988	2512	DllCommonsvc.exe	99
PID 2512 wrote to memory of 2988	2512	DllCommonsvc.exe	99
PID 2512 wrote to memory of 4416	2512	DllCommonsvc.exe	100
PID 2512 wrote to memory of 4416	2512	DllCommonsvc.exe	100
PID 2512 wrote to memory of 4516	2512	DllCommonsvc.exe	101
PID 2512 wrote to memory of 4516	2512	DllCommonsvc.exe	101
PID 2512 wrote to memory of 2344	2512	DllCommonsvc.exe	102
PID 2512 wrote to memory of 2344	2512	DllCommonsvc.exe	102
PID 2512 wrote to memory of 1952	2512	DllCommonsvc.exe	107
PID 2512 wrote to memory of 1952	2512	DllCommonsvc.exe	107
PID 1952 wrote to memory of 2188	1952	cmd.exe	109
PID 1952 wrote to memory of 2188	1952	cmd.exe	109
PID 1952 wrote to memory of 3256	1952	cmd.exe	113
PID 1952 wrote to memory of 3256	1952	cmd.exe	113
PID 3256 wrote to memory of 2928	3256	DllCommonsvc.exe	129
PID 3256 wrote to memory of 2928	3256	DllCommonsvc.exe	129
PID 3256 wrote to memory of 396	3256	DllCommonsvc.exe	130
PID 3256 wrote to memory of 396	3256	DllCommonsvc.exe	130
PID 3256 wrote to memory of 3340	3256	DllCommonsvc.exe	131
PID 3256 wrote to memory of 3340	3256	DllCommonsvc.exe	131
PID 3256 wrote to memory of 1808	3256	DllCommonsvc.exe	132
PID 3256 wrote to memory of 1808	3256	DllCommonsvc.exe	132
PID 3256 wrote to memory of 2292	3256	DllCommonsvc.exe	133
PID 3256 wrote to memory of 2292	3256	DllCommonsvc.exe	133
PID 3256 wrote to memory of 2908	3256	DllCommonsvc.exe	134
PID 3256 wrote to memory of 2908	3256	DllCommonsvc.exe	134
PID 3256 wrote to memory of 2480	3256	DllCommonsvc.exe	141
PID 3256 wrote to memory of 2480	3256	DllCommonsvc.exe	141
PID 2480 wrote to memory of 4132	2480	DllCommonsvc.exe	148
PID 2480 wrote to memory of 4132	2480	DllCommonsvc.exe	148
PID 4132 wrote to memory of 2732	4132	cmd.exe	150
PID 4132 wrote to memory of 2732	4132	cmd.exe	150
PID 4132 wrote to memory of 3492	4132	cmd.exe	156
PID 4132 wrote to memory of 3492	4132	cmd.exe	156
PID 3492 wrote to memory of 2384	3492	DllCommonsvc.exe	159
PID 3492 wrote to memory of 2384	3492	DllCommonsvc.exe	159
PID 2384 wrote to memory of 3724	2384	cmd.exe	161
PID 2384 wrote to memory of 3724	2384	cmd.exe	161
PID 2384 wrote to memory of 2764	2384	cmd.exe	165
PID 2384 wrote to memory of 2764	2384	cmd.exe	165
PID 2764 wrote to memory of 1532	2764	DllCommonsvc.exe	167
PID 2764 wrote to memory of 1532	2764	DllCommonsvc.exe	167
PID 1532 wrote to memory of 5032	1532	cmd.exe	169
PID 1532 wrote to memory of 5032	1532	cmd.exe	169
PID 1532 wrote to memory of 5004	1532	cmd.exe	171
PID 1532 wrote to memory of 5004	1532	cmd.exe	171
PID 5004 wrote to memory of 1168	5004	DllCommonsvc.exe	173
PID 5004 wrote to memory of 1168	5004	DllCommonsvc.exe	173
PID 1168 wrote to memory of 3608	1168	cmd.exe	175
PID 1168 wrote to memory of 3608	1168	cmd.exe	175
PID 1168 wrote to memory of 2056	1168	cmd.exe	178
PID 1168 wrote to memory of 2056	1168	cmd.exe	178
PID 2056 wrote to memory of 4476	2056	DllCommonsvc.exe	180
PID 2056 wrote to memory of 4476	2056	DllCommonsvc.exe	180
PID 4476 wrote to memory of 1080	4476	cmd.exe	182
PID 4476 wrote to memory of 1080	4476	cmd.exe	182

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_719d4995340e17d33be626509bfe2322b6a5be7e17b7707db09f0b88763f5d50.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\lua\meta\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\llBcBBNrH4.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1952
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2188
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\RuntimeBroker.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\sppsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\NetHood\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9dbjknkRRi.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2732
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eNTIt1NKYH.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3724
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XFk51gP3Gp.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:5032
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3608
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZBm8ilTxac.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1080
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SNhzeWIHcH.bat"
        18⤵
        
        PID:2380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2036
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WOs9W2tFAs.bat"
        20⤵
        
        PID:2404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2916
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GrfoiSU1wP.bat"
        22⤵
        
        PID:4328
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2008
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Dk8ljd7jBY.bat"
        24⤵
        
        PID:2164
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:756
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VJj2LbMAw3.bat"
        26⤵
        
        PID:4160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4760
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5PKlq1uIo.bat"
        28⤵
        
        PID:232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4028
        
        C:\Users\Default\NetHood\DllCommonsvc.exe
        
        "C:\Users\Default\NetHood\DllCommonsvc.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nDwMkfOC2e.bat"
        30⤵
        
        PID:4320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\lua\meta\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\meta\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\lua\meta\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\L2Schemas\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\L2Schemas\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Gadgets\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Temp\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Users\Default\NetHood\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Default\NetHood\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Users\Default\NetHood\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
dd1d0b083fedf44b482a028fb70b96e8

SHA1
dc9c027937c9f6d52268a1504cbae42a39c8d36a

SHA256
cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c

SHA512
96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cbc41bceec6e8cf6d23f68d952487858

SHA1
f52edbceff042ded7209e8be90ec5e09086d62eb

SHA256
b97a8a2a5dbc3c1b994affa4751e61e1ac6bddcf336a4c77ee96a3ce07c59f4d

SHA512
0f025ea2559e477c56500b9f4ecc251325793629cf1ae8d43ad783f1036b830c51757274b0aa8bb3183ac636cdfc1e0e8be1163a45695b8fb57df98c362534fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
664B

MD5
9fbda811ca535b73a711aaaf6729ea3b

SHA1
8db503bcef91a55ea55a69b9277e299feb460c97

SHA256
47a8ae2b81e4ccd664303c04165f6f0f0a2cbb692803a8f803399b2cb96d789d

SHA512
61654752c5041f544c19f2e79af831f8b3e439f43e2934dc3493585b4f9aeba00b3d2600de8dbc72ad4893c7ef15f60f092047a56a635a3c81761ae2210cbd81

Download Submit
C:\Users\Admin\AppData\Local\Temp\9dbjknkRRi.bat

Filesize
206B

MD5
c372990555572395e54495b4f27ed8b1

SHA1
f9d596ee88934d11817cef1c9de62e850a17ca72

SHA256
10b42c50cb363fc8bfb36e9a09a1dac2092c26edbcbb70d57fa134477389ca4a

SHA512
eb64af7981b8786d8451653a589549263c74fa27637d89ae056f327b35d4613b6163e827787bf32138e8a360befaf319e818f5e9de55d9f28248f0fb4ed0c822

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dk8ljd7jBY.bat

Filesize
206B

MD5
7d0c3451e51ce82d7d83f387a6a0b88c

SHA1
e2ea2cdf7ff07c967e4eaf54552bcbb504c86fcf

SHA256
214baec7d64c6ec0ab88af964b2c1fe6809bf3cbec164dc59b2210e398fb298a

SHA512
dd2c7e349e4f5e5c46bbf947ca2eec42fb1ea4bdaaca023e5e26c8151f7c2aada88eb09d748097cd5b2c4977ff8241179ad2b479a162e300feb4cbc8bd46abd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\GrfoiSU1wP.bat

Filesize
206B

MD5
60c6a663015aa30e44c69139bdf4c61e

SHA1
e0e58f957c525cddc8435c00796775584bd407a6

SHA256
fe33f7b4437c6798e0cfeafbe2f7657cfc70eb1f547ba50e6bd999bbcc0c5f6e

SHA512
e4eaa238e084cd26b250c3ca56c2ca13c5077bb0a5210fe505eae52503f192fb50076f0f78a74f5d304b44dbfd326e069491a1f4e0e7aae68afa2da60c61c2a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SNhzeWIHcH.bat

Filesize
206B

MD5
cb2e8af0cb1d68a23bdf521052db4f14

SHA1
70bbcd170bce9df27fd3d54f48366b9d5740d27c

SHA256
6dd4845154f0178451a160419ad2a71accdc6414427042c08ecee0898ad58a05

SHA512
07b235bda63b60f7012cdea76bcd4c582f5267ac2019523b2fe0556f9c39fcc01a0b2747ad73b306c8243fafbd52a738913ff0c18791d3afb5ba83dc47945b79

Download Submit
C:\Users\Admin\AppData\Local\Temp\VJj2LbMAw3.bat

Filesize
206B

MD5
a10a38415ea61ecefb8ac9817a48693f

SHA1
74e89aa8950cb93e7be350ebc2c3191ab61bbb27

SHA256
6aa788856db8869a3792c4e129845f4510071df1cbfb1fed3c95c75491ba78af

SHA512
3e1f034f9c462ec28c5978d8696f7239286b57c2beb616d9be18bdb03a2fb1d7d47f0d99756e5488157a55c21b7547fb81b8107663a7c83c48b6fe523e565943

Download Submit
C:\Users\Admin\AppData\Local\Temp\WOs9W2tFAs.bat

Filesize
206B

MD5
85a894c5e3428df7cb7f4cd4526c94de

SHA1
f760e4ef3689a154ed010b44a39f9d0336339b6e

SHA256
c05e0a4d1cb5623c8129001e364380fe26b2979608ace5dbd0ce1bf33ff859d5

SHA512
ef4e05a3d551cdca6a8e1a3a8b872a1dff776ef079fd7fb4c7dba62a56a3d411fe26a9944e2c7cbb73b5d1322e5cba2784e76c8b0a20b5a818b79e1d250a3b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\XFk51gP3Gp.bat

Filesize
206B

MD5
68991d2a433f0057f25df7b6b22a2d6b

SHA1
c95f5eb89f5fa526ce0c2979a747cb6cb6055e12

SHA256
b653b0441bf096a45737da812fc8f8a67efb34256e9bdcd17a1b124cff3e9256

SHA512
297ad4344a5dcd4c9744447a278d6db65e52b0f4df593d0f579b7dd190de2937bfd2178c927dc2adbb73d92a91dae0262e7c60db11cc92171338e1a75148aa3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZBm8ilTxac.bat

Filesize
206B

MD5
36907b4058953bc1074e54f1c31c8687

SHA1
ad20d68fcb4a0ebd821b1662b38481355713fe3e

SHA256
81bbeb9752da67484a962fd2d2749fb0fcf05c7853117660e90075225b880a97

SHA512
ca8a653f02d1f4ee880037ba5b3cca6f9e9862ccaa03aeb4bf52204bc939cfd44a28af2bd67dee6a64d7ce4e380922766c39f6abd8f1ba4aa9359fbe49764613

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_czwsphkc.ayk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\eNTIt1NKYH.bat

Filesize
206B

MD5
2101003e1116182c7f3dbe9274200892

SHA1
70de27b4a7edc54901861a3d4ea2852c32074757

SHA256
8b3e801c8ed683c920c6bc8c1b9c0208b8e5a6fdbf1f13c7a73f9b6146415d07

SHA512
12142f2b8a516654648af336018e422c64f188364fede3b104938dfd930caf39c4c82b060e46e1b4e57bcb87d95d13b09526884f59cd5bcd9caacd2057373410

Download Submit
C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat

Filesize
206B

MD5
f89e4c7098d2e1fa58d34cac8d2c09f3

SHA1
3badaad34ea870f71106e1fb694781b454738882

SHA256
c008773bbb0f0e3d34d9e08e1bcc8e09481ecd096b48c44fa36cef7bb0ca8895

SHA512
5a512aa86a5f5b4356cb134842ece37caeaa682480e7922b00747e32f4da8433c7c935ae0f7bc06091c5b3f39c8b595302c0aebf1771eb5b40987fa405be61db

Download Submit
C:\Users\Admin\AppData\Local\Temp\j5PKlq1uIo.bat

Filesize
206B

MD5
d32d55c200d4c037611ce29ec0bb7f3a

SHA1
efee6e6b2aaf45aca4d178ce95e3c8d7e4a536e6

SHA256
042672eb579ede1f46134b68dbc160d72e24b960169bff441cb92d9dc1ec5ddc

SHA512
1ae14164b146613ce95e12f4f4c70d3053630bd8e2d2b8eb17cde8636259d2991e2c4b4ea8d9d4edb057dafc4addb170495422c34b8efa5186e3f87edafba2fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\llBcBBNrH4.bat

Filesize
199B

MD5
f86b0f319b233c8e4b2113680a9b0cb9

SHA1
c8513806a846c7b9efd14a91eee8a05f749fd327

SHA256
19808129f5baf58f456e8a179b22cfcd503534594d285003b58f625772120c76

SHA512
ee746565a7f1c22c0504e0fff76c90e2038428d13664e7fba472087e338312095b9e653c966ee591bd7bf4a172a88ab7c60905b953f4d46937a0a6486d11849a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nDwMkfOC2e.bat

Filesize
206B

MD5
1e67381b7e94b37f7959adfcf3fbea1a

SHA1
ae31303e754ea4ed082597e5a243f39f094aed9b

SHA256
18cbd865254f2e7d6884407b1980dba45c029d7ba87e43bd05060398a6de60be

SHA512
85bc6a78a66d7fe02cdff393828af9ac8bc40cfb5f49058657bd0ca87bbf92188f782c341cb76489053d582baf935ccbb406af02a31e6eca91583410c2b57058

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/404-213-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2512-12-0x00007FFF45453000-0x00007FFF45455000-memory.dmp

Filesize
8KB

Download
memory/2512-13-0x00000000003A0000-0x00000000004B0000-memory.dmp

Filesize
1.1MB

Download
memory/2512-14-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/2512-15-0x0000000002640000-0x000000000264C000-memory.dmp

Filesize
48KB

Download
memory/2512-16-0x000000001AF80000-0x000000001AF8C000-memory.dmp

Filesize
48KB

Download
memory/2512-17-0x000000001AFE0000-0x000000001AFEC000-memory.dmp

Filesize
48KB

Download
memory/4416-34-0x000002CAC5750000-0x000002CAC5772000-memory.dmp

Filesize
136KB

Download