dcrat | 06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2024, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe
Size 1.3MB
Sample241222-wsvvlavqen
SHA256 06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad
MD5 7e2c7b39d2641b61901ff55250a713a4
SHA1 dcbc75d4e25e235754301570402790487cb79a57
SHA512 6a91c7123713b2b3e942f76fe38b6f644f158d20a44ad139e5b2685a799fd1d21a89a67c591018d9699eef55c3b39bf8cfe9009a84af5990cabf043703f97435
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	4256	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c96-10.dat	dcrat
behavioral2/memory/3712-13-0x0000000000D50000-0x0000000000E60000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4008	powershell.exe
3520	powershell.exe
1900	powershell.exe
3868	powershell.exe
3692	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe

Executes dropped EXE 15 IoCs

pid	Process
3712	DllCommonsvc.exe
1700	OfficeClickToRun.exe
2068	OfficeClickToRun.exe
3812	OfficeClickToRun.exe
1936	OfficeClickToRun.exe
2504	OfficeClickToRun.exe
212	OfficeClickToRun.exe
3232	OfficeClickToRun.exe
2880	OfficeClickToRun.exe
1568	OfficeClickToRun.exe
2284	OfficeClickToRun.exe
2752	OfficeClickToRun.exe
4596	OfficeClickToRun.exe
4036	OfficeClickToRun.exe
5028	OfficeClickToRun.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
56	raw.githubusercontent.com
40	raw.githubusercontent.com
43	raw.githubusercontent.com
44	raw.githubusercontent.com
53	raw.githubusercontent.com
55	raw.githubusercontent.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
52	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com
54	raw.githubusercontent.com
24	raw.githubusercontent.com
45	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\sppsvc.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3776	schtasks.exe
380	schtasks.exe
2332	schtasks.exe
5004	schtasks.exe
4744	schtasks.exe
2608	schtasks.exe
4228	schtasks.exe
676	schtasks.exe
3188	schtasks.exe
2848	schtasks.exe
3324	schtasks.exe
2712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3868	powershell.exe
1900	powershell.exe
3520	powershell.exe
3692	powershell.exe
4008	powershell.exe
3520	powershell.exe
3692	powershell.exe
3868	powershell.exe
1900	powershell.exe
4008	powershell.exe
1700	OfficeClickToRun.exe
2068	OfficeClickToRun.exe
3812	OfficeClickToRun.exe
1936	OfficeClickToRun.exe
2504	OfficeClickToRun.exe
212	OfficeClickToRun.exe
3232	OfficeClickToRun.exe
2880	OfficeClickToRun.exe
1568	OfficeClickToRun.exe
2284	OfficeClickToRun.exe
2752	OfficeClickToRun.exe
4596	OfficeClickToRun.exe
4036	OfficeClickToRun.exe
5028	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3712	DllCommonsvc.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	1700	OfficeClickToRun.exe
Token: SeDebugPrivilege	2068	OfficeClickToRun.exe
Token: SeDebugPrivilege	3812	OfficeClickToRun.exe
Token: SeDebugPrivilege	1936	OfficeClickToRun.exe
Token: SeDebugPrivilege	2504	OfficeClickToRun.exe
Token: SeDebugPrivilege	212	OfficeClickToRun.exe
Token: SeDebugPrivilege	3232	OfficeClickToRun.exe
Token: SeDebugPrivilege	2880	OfficeClickToRun.exe
Token: SeDebugPrivilege	1568	OfficeClickToRun.exe
Token: SeDebugPrivilege	2284	OfficeClickToRun.exe
Token: SeDebugPrivilege	2752	OfficeClickToRun.exe
Token: SeDebugPrivilege	4596	OfficeClickToRun.exe
Token: SeDebugPrivilege	4036	OfficeClickToRun.exe
Token: SeDebugPrivilege	5028	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 744	5040	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe	83
PID 5040 wrote to memory of 744	5040	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe	83
PID 5040 wrote to memory of 744	5040	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe	83
PID 744 wrote to memory of 3240	744	WScript.exe	85
PID 744 wrote to memory of 3240	744	WScript.exe	85
PID 744 wrote to memory of 3240	744	WScript.exe	85
PID 3240 wrote to memory of 3712	3240	cmd.exe	87
PID 3240 wrote to memory of 3712	3240	cmd.exe	87
PID 3712 wrote to memory of 4008	3712	DllCommonsvc.exe	102
PID 3712 wrote to memory of 4008	3712	DllCommonsvc.exe	102
PID 3712 wrote to memory of 3520	3712	DllCommonsvc.exe	103
PID 3712 wrote to memory of 3520	3712	DllCommonsvc.exe	103
PID 3712 wrote to memory of 3692	3712	DllCommonsvc.exe	104
PID 3712 wrote to memory of 3692	3712	DllCommonsvc.exe	104
PID 3712 wrote to memory of 3868	3712	DllCommonsvc.exe	105
PID 3712 wrote to memory of 3868	3712	DllCommonsvc.exe	105
PID 3712 wrote to memory of 1900	3712	DllCommonsvc.exe	106
PID 3712 wrote to memory of 1900	3712	DllCommonsvc.exe	106
PID 3712 wrote to memory of 4140	3712	DllCommonsvc.exe	112
PID 3712 wrote to memory of 4140	3712	DllCommonsvc.exe	112
PID 4140 wrote to memory of 3172	4140	cmd.exe	114
PID 4140 wrote to memory of 3172	4140	cmd.exe	114
PID 4140 wrote to memory of 1700	4140	cmd.exe	115
PID 4140 wrote to memory of 1700	4140	cmd.exe	115
PID 1700 wrote to memory of 1768	1700	OfficeClickToRun.exe	122
PID 1700 wrote to memory of 1768	1700	OfficeClickToRun.exe	122
PID 1768 wrote to memory of 216	1768	cmd.exe	124
PID 1768 wrote to memory of 216	1768	cmd.exe	124
PID 1768 wrote to memory of 2068	1768	cmd.exe	132
PID 1768 wrote to memory of 2068	1768	cmd.exe	132
PID 2068 wrote to memory of 4012	2068	OfficeClickToRun.exe	134
PID 2068 wrote to memory of 4012	2068	OfficeClickToRun.exe	134
PID 4012 wrote to memory of 4640	4012	cmd.exe	136
PID 4012 wrote to memory of 4640	4012	cmd.exe	136
PID 4012 wrote to memory of 3812	4012	cmd.exe	141
PID 4012 wrote to memory of 3812	4012	cmd.exe	141
PID 3812 wrote to memory of 3692	3812	OfficeClickToRun.exe	143
PID 3812 wrote to memory of 3692	3812	OfficeClickToRun.exe	143
PID 3692 wrote to memory of 2104	3692	cmd.exe	145
PID 3692 wrote to memory of 2104	3692	cmd.exe	145
PID 3692 wrote to memory of 1936	3692	cmd.exe	147
PID 3692 wrote to memory of 1936	3692	cmd.exe	147
PID 1936 wrote to memory of 4852	1936	OfficeClickToRun.exe	149
PID 1936 wrote to memory of 4852	1936	OfficeClickToRun.exe	149
PID 4852 wrote to memory of 4396	4852	cmd.exe	151
PID 4852 wrote to memory of 4396	4852	cmd.exe	151
PID 4852 wrote to memory of 2504	4852	cmd.exe	153
PID 4852 wrote to memory of 2504	4852	cmd.exe	153
PID 2504 wrote to memory of 4324	2504	OfficeClickToRun.exe	155
PID 2504 wrote to memory of 4324	2504	OfficeClickToRun.exe	155
PID 4324 wrote to memory of 2712	4324	cmd.exe	157
PID 4324 wrote to memory of 2712	4324	cmd.exe	157
PID 4324 wrote to memory of 212	4324	cmd.exe	159
PID 4324 wrote to memory of 212	4324	cmd.exe	159
PID 212 wrote to memory of 3096	212	OfficeClickToRun.exe	161
PID 212 wrote to memory of 3096	212	OfficeClickToRun.exe	161
PID 3096 wrote to memory of 2116	3096	cmd.exe	163
PID 3096 wrote to memory of 2116	3096	cmd.exe	163
PID 3096 wrote to memory of 3232	3096	cmd.exe	165
PID 3096 wrote to memory of 3232	3096	cmd.exe	165
PID 3232 wrote to memory of 2700	3232	OfficeClickToRun.exe	167
PID 3232 wrote to memory of 2700	3232	OfficeClickToRun.exe	167
PID 2700 wrote to memory of 4020	2700	cmd.exe	169
PID 2700 wrote to memory of 4020	2700	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6MycdEczud.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4140
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3172
      - C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:216
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vIn8vbLsXf.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4640
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2104
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4396
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2712
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wUI7DLfHyj.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2116
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4020
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iS8tBRk2Vg.bat"
        21⤵
        
        PID:3416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3480
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E3sOpJujjE.bat"
        23⤵
        
        PID:4400
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4140
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat"
        25⤵
        
        PID:4088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2840
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\95TPLp0dsP.bat"
        27⤵
        
        PID:2940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:100
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oPL6j2OtN4.bat"
        29⤵
        
        PID:1856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4920
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SpZgFYZT4y.bat"
        31⤵
        
        PID:896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:3148
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        32⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OfficeClickToRun.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OfficeClickToRun.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

0LMDaVm4bI.bat

Path C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat
Size 235B
SHA256 36f10914b094fab22d6e58eb1762e34fd7e42296828a3d7e3523967e3132716a
MD5 6b00527829906b10866a4119b0029c8f
SHA1 461839b6487c65802ac48788b8d5be51c4e3e55d
SHA512 c0b52fa009b864da70ba52b3244baa2b46fd89851e8f8fb6949bf4c42f50031432510eb39ee16e89577bceecc90564a5dbcc00aa3fb3d354f541e23c49338184
MD5 SHA1 SHA512

Submit Download

6MycdEczud.bat

Path C:\Users\Admin\AppData\Local\Temp\6MycdEczud.bat
Size 235B
SHA256 90c349af4eb48a75d1fd6c201299c26bc894560a4555d60cc7fbf3f0cac8e90e
MD5 883bfa881418ed2cb63da3b07cf7648f
SHA1 01d9f8e184b157cc685634b477885c82e2f86aac
SHA512 80a5392570d24b98f21bdc7220742502802bbd1c3baf74cb3756a5e0ea0d1946023c69e778f88cb8bae398f934be6b280fd1f7612d59aa6af6e895d94761afe3
MD5 SHA1 SHA512

Submit Download

95TPLp0dsP.bat

Path C:\Users\Admin\AppData\Local\Temp\95TPLp0dsP.bat
Size 235B
SHA256 c82ebf05fef0a9d03a6ff21f019e0e9912967cba7bb75dddf4a2e9f47c92436c
MD5 5556533dc442e48ac4b0ca1a66703718
SHA1 08674453ec972768911fbfdb12ee9b8c5de6735a
SHA512 62b58ea2835be0459f7420df9fb56133a4c76f9e6c114af00b6e7c9ce7ddcd4910182af865e4df3328128df9405a6950f6410cb94ff02d8541c3656048cdc0ad
MD5 SHA1 SHA512

Submit Download

E3sOpJujjE.bat

Path C:\Users\Admin\AppData\Local\Temp\E3sOpJujjE.bat
Size 235B
SHA256 26bc16e264b3d2d63273c8e53168b2a54f80ae44be59cbe3004b633a5d19d1c1
MD5 44b140b8a8009ad566421cb0c2d06f4c
SHA1 0e6a233d39ca84e804181f0557916eff2f07ca42
SHA512 12ee840e3ad8f5241afe05887c2fc1fb5c99a09d9237fc1b51242800000111580eab7076d8b904e353d3a47eaf59514d5d9713481cd2f64d511df20372f675a4
MD5 SHA1 SHA512

Submit Download

SpZgFYZT4y.bat

Path C:\Users\Admin\AppData\Local\Temp\SpZgFYZT4y.bat
Size 235B
SHA256 834060401391b1ae8d2c95bff6c0a553d32ed99ba8dcb4a149613c93e99e637b
MD5 584c03926e2f169f36410d1516ca9540
SHA1 5a809c2d4ba0f5cf5690a8fe080f232f3c770e94
SHA512 8f9bf0d49eb752c2421d7ce1ed5dd273b6dd0177525f6018469354a78f867b73d5276c6b232e7a06bad79991aead025285b0d0a6d37ce89c46c05a8b584cdfb7
MD5 SHA1 SHA512

Submit Download

VlbjwdcMOl.bat

Path C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat
Size 235B
SHA256 fc16208a93453d6a6b141496fc0b62aceb62f8ca478e10f06865cf7976b8f33e
MD5 bfd452bf955e71507b16288bbd6e49dc
SHA1 002e69687612fdad328a0c6071957ab5e1d9b8d7
SHA512 4e80a795812ebc65a4caa04f83b6e8ea9dffa417794ca0de993345bd333c67ed22de20079f6cae5427b0361267c838e1d3d04421309b5f2a76717faf15641fad
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_02qgyipi.cec.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_02qgyipi.cec.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cYhs0sn2L6.bat

Path C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat
Size 235B
SHA256 c341445a0cef202469637618239a7f2a5982a8205380c0aecf79c037462dbe5a
MD5 f2fcc28de7481e4ba354e7088738f849
SHA1 8c57ac0cbfb58b638e774ba13fc07964ad83d8f6
SHA512 42282f7a260684f417257f329d2bf702c511e7095b041fe517f3c3ef296efd728347db26041a432711eb6fe957caeb5b86972a50b5a44ab19694d62d7d40e023
MD5 SHA1 SHA512

Submit Download

iS8tBRk2Vg.bat

Path C:\Users\Admin\AppData\Local\Temp\iS8tBRk2Vg.bat
Size 235B
SHA256 7838108c6f483264cabf4762d8c333f12f93811f569194e3adae5e46eb1d31df
MD5 8ee6c2921cfd50d7d65b7ec90f33252c
SHA1 dff5126f29f8b45eea140dddb2b3e78dad158f02
SHA512 f12c5f9c06aed6515461b426022c462f4b9951535296c92e8c7fa1b41421e5201230e358839da7b0376895b74e8326a34928f391148052314ca9e70b712981d0
MD5 SHA1 SHA512

Submit Download

oPL6j2OtN4.bat

Path C:\Users\Admin\AppData\Local\Temp\oPL6j2OtN4.bat
Size 235B
SHA256 ad82767901008bbfbd8918b66819677151d6e62e980cb80f43d607df91f6fc6b
MD5 b5295bfe75e7f5ba7301317cd9274e43
SHA1 8c1e8b5aef2ca26f666ee8d2ba5dec79bd0d4685
SHA512 8da867e46d10c1cbf0b7299847a305e17256ab750d3ad7dfc1571cbe046a63d73f24cb58ce1b855f46c84ff6862056ea18aa297405b7c24fed2bb8489f449c46
MD5 SHA1 SHA512

Submit Download

paq62miIo8.bat

Path C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat
Size 235B
SHA256 93737754c5c3799a5b4e4d7933e8e4bfb0bd772b681b057562c33c313e0a9420
MD5 ac0c4024deb704c16591a21fd9f4201a
SHA1 5914a5f301f56ee48481e079de509d808bdafba0
SHA512 d5e77ee678ab7393cc1dcfaa7b39a9735235cefdbb576e83c11d975e65c89ad694ed3005c243af66de62b21cec3da8a47c82ebb24163397d6327e3a90f8db176
MD5 SHA1 SHA512

Submit Download

sWs9jrlB8v.bat

Path C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat
Size 235B
SHA256 3b57b6adfd45fa86a7c2651d568ab3a48f1de9b7f8f6db2baa711ea4943c13ec
MD5 fbd9d498b29d0289f03c1cc72e17f980
SHA1 4e145248240778b20cb1b9bd6a8a168720f55bcd
SHA512 d2b4f6107b3c85ef47eeccef4f3f2bf346f3c9efab0b891b53a3f536823111a47f4909342389044675c4044ae2a609d1b18e735f99472f430c132f26638408ce
MD5 SHA1 SHA512

Submit Download

vIn8vbLsXf.bat

Path C:\Users\Admin\AppData\Local\Temp\vIn8vbLsXf.bat
Size 235B
SHA256 a380d2218e96554fc4d11b25a2222c6eeceadf889aaf319c7ece239b6dae152b
MD5 b2e5bff1a010189517aacd644a63f105
SHA1 6912d03d384c3daf3ed6c837cc13f4391bed5d3f
SHA512 66cac05c51885b1d6eddfd69db2bbc469f9212f7640a47227c7f7525d0ef4b5a7cc33943fc5e1004ad174c38a0e7c1e8432f41f02d7416434b0e497ce7111039
MD5 SHA1 SHA512

Submit Download

wUI7DLfHyj.bat

Path C:\Users\Admin\AppData\Local\Temp\wUI7DLfHyj.bat
Size 235B
SHA256 6c2243f4f64a7f065453e8bf74916622b4757033c58f905eb1e1eff29a02b915
MD5 5a3a5cf8b3d0979115913f3280d4742b
SHA1 aefde7a4313f0e226e209425a1a6b2af6c1f80e4
SHA512 2ab7d38fd94b0b1efe0f0b61346ca30014340e44511330eacc227f1539b9a17be6493b18918ad8c8025e8479e1dc7bec558944a730fda531c6608d06d564a34b
MD5 SHA1 SHA512

Submit Download

1zu9dW.bat

Path C:\providercommon\1zu9dW.bat
Size 36B
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
MD5 SHA1 SHA512

Submit Download

DllCommonsvc.exe

Path C:\providercommon\DllCommonsvc.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

yTUdeXjbLOhnrN32dgrxVg.vbe

Path C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
Size 197B
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478
MD5 SHA1 SHA512

Submit Download

memory/212-134-0x000000001C260000-0x000000001C409000-memory.dmp

Download

memory/1568-150-0x0000000002880000-0x0000000002892000-memory.dmp

Download

memory/1700-92-0x0000000002930000-0x0000000002942000-memory.dmp

Download

memory/1936-119-0x000000001BD30000-0x000000001BED9000-memory.dmp

Download

memory/2068-105-0x000000001C670000-0x000000001C7DA000-memory.dmp

Download

memory/2284-157-0x0000000001780000-0x0000000001792000-memory.dmp

Download

memory/2504-127-0x000000001C760000-0x000000001C909000-memory.dmp

Download

memory/2752-164-0x0000000001490000-0x00000000014A2000-memory.dmp

Download

memory/2880-147-0x000000001CAA0000-0x000000001CC49000-memory.dmp

Download

memory/3232-140-0x000000001BD00000-0x000000001BEA9000-memory.dmp

Download

memory/3712-17-0x0000000002FB0000-0x0000000002FBC000-memory.dmp

Download

memory/3712-16-0x00000000016F0000-0x00000000016FC000-memory.dmp

Download

memory/3712-15-0x0000000001690000-0x000000000169C000-memory.dmp

Download

memory/3712-14-0x0000000001620000-0x0000000001632000-memory.dmp

Download

memory/3712-13-0x0000000000D50000-0x0000000000E60000-memory.dmp

Download

memory/3712-12-0x00007FFAE22D3000-0x00007FFAE22D5000-memory.dmp

Download

memory/3812-112-0x000000001C080000-0x000000001C229000-memory.dmp

Download

memory/3868-38-0x0000017D6A480000-0x0000017D6A4A2000-memory.dmp

Download

memory/5028-183-0x0000000002C30000-0x0000000002C42000-memory.dmp

Download