dcrat | 06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe
Size

1.3MB
MD5

7e2c7b39d2641b61901ff55250a713a4
SHA1

dcbc75d4e25e235754301570402790487cb79a57
SHA256

06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad
SHA512

6a91c7123713b2b3e942f76fe38b6f644f158d20a44ad139e5b2685a799fd1d21a89a67c591018d9699eef55c3b39bf8cfe9009a84af5990cabf043703f97435
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	4256	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	4256	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c96-10.dat	dcrat
behavioral2/memory/3712-13-0x0000000000D50000-0x0000000000E60000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4008	powershell.exe
3520	powershell.exe
1900	powershell.exe
3868	powershell.exe
3692	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe

Executes dropped EXE 15 IoCs

pid	Process
3712	DllCommonsvc.exe
1700	OfficeClickToRun.exe
2068	OfficeClickToRun.exe
3812	OfficeClickToRun.exe
1936	OfficeClickToRun.exe
2504	OfficeClickToRun.exe
212	OfficeClickToRun.exe
3232	OfficeClickToRun.exe
2880	OfficeClickToRun.exe
1568	OfficeClickToRun.exe
2284	OfficeClickToRun.exe
2752	OfficeClickToRun.exe
4596	OfficeClickToRun.exe
4036	OfficeClickToRun.exe
5028	OfficeClickToRun.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
56	raw.githubusercontent.com
40	raw.githubusercontent.com
43	raw.githubusercontent.com
44	raw.githubusercontent.com
53	raw.githubusercontent.com
55	raw.githubusercontent.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
52	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com
54	raw.githubusercontent.com
24	raw.githubusercontent.com
45	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\sppsvc.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3776	schtasks.exe
380	schtasks.exe
2332	schtasks.exe
5004	schtasks.exe
4744	schtasks.exe
2608	schtasks.exe
4228	schtasks.exe
676	schtasks.exe
3188	schtasks.exe
2848	schtasks.exe
3324	schtasks.exe
2712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3712	DllCommonsvc.exe
3868	powershell.exe
1900	powershell.exe
3520	powershell.exe
3692	powershell.exe
4008	powershell.exe
3520	powershell.exe
3692	powershell.exe
3868	powershell.exe
1900	powershell.exe
4008	powershell.exe
1700	OfficeClickToRun.exe
2068	OfficeClickToRun.exe
3812	OfficeClickToRun.exe
1936	OfficeClickToRun.exe
2504	OfficeClickToRun.exe
212	OfficeClickToRun.exe
3232	OfficeClickToRun.exe
2880	OfficeClickToRun.exe
1568	OfficeClickToRun.exe
2284	OfficeClickToRun.exe
2752	OfficeClickToRun.exe
4596	OfficeClickToRun.exe
4036	OfficeClickToRun.exe
5028	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3712	DllCommonsvc.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	1700	OfficeClickToRun.exe
Token: SeDebugPrivilege	2068	OfficeClickToRun.exe
Token: SeDebugPrivilege	3812	OfficeClickToRun.exe
Token: SeDebugPrivilege	1936	OfficeClickToRun.exe
Token: SeDebugPrivilege	2504	OfficeClickToRun.exe
Token: SeDebugPrivilege	212	OfficeClickToRun.exe
Token: SeDebugPrivilege	3232	OfficeClickToRun.exe
Token: SeDebugPrivilege	2880	OfficeClickToRun.exe
Token: SeDebugPrivilege	1568	OfficeClickToRun.exe
Token: SeDebugPrivilege	2284	OfficeClickToRun.exe
Token: SeDebugPrivilege	2752	OfficeClickToRun.exe
Token: SeDebugPrivilege	4596	OfficeClickToRun.exe
Token: SeDebugPrivilege	4036	OfficeClickToRun.exe
Token: SeDebugPrivilege	5028	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 744	5040	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe	83
PID 5040 wrote to memory of 744	5040	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe	83
PID 5040 wrote to memory of 744	5040	JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe	83
PID 744 wrote to memory of 3240	744	WScript.exe	85
PID 744 wrote to memory of 3240	744	WScript.exe	85
PID 744 wrote to memory of 3240	744	WScript.exe	85
PID 3240 wrote to memory of 3712	3240	cmd.exe	87
PID 3240 wrote to memory of 3712	3240	cmd.exe	87
PID 3712 wrote to memory of 4008	3712	DllCommonsvc.exe	102
PID 3712 wrote to memory of 4008	3712	DllCommonsvc.exe	102
PID 3712 wrote to memory of 3520	3712	DllCommonsvc.exe	103
PID 3712 wrote to memory of 3520	3712	DllCommonsvc.exe	103
PID 3712 wrote to memory of 3692	3712	DllCommonsvc.exe	104
PID 3712 wrote to memory of 3692	3712	DllCommonsvc.exe	104
PID 3712 wrote to memory of 3868	3712	DllCommonsvc.exe	105
PID 3712 wrote to memory of 3868	3712	DllCommonsvc.exe	105
PID 3712 wrote to memory of 1900	3712	DllCommonsvc.exe	106
PID 3712 wrote to memory of 1900	3712	DllCommonsvc.exe	106
PID 3712 wrote to memory of 4140	3712	DllCommonsvc.exe	112
PID 3712 wrote to memory of 4140	3712	DllCommonsvc.exe	112
PID 4140 wrote to memory of 3172	4140	cmd.exe	114
PID 4140 wrote to memory of 3172	4140	cmd.exe	114
PID 4140 wrote to memory of 1700	4140	cmd.exe	115
PID 4140 wrote to memory of 1700	4140	cmd.exe	115
PID 1700 wrote to memory of 1768	1700	OfficeClickToRun.exe	122
PID 1700 wrote to memory of 1768	1700	OfficeClickToRun.exe	122
PID 1768 wrote to memory of 216	1768	cmd.exe	124
PID 1768 wrote to memory of 216	1768	cmd.exe	124
PID 1768 wrote to memory of 2068	1768	cmd.exe	132
PID 1768 wrote to memory of 2068	1768	cmd.exe	132
PID 2068 wrote to memory of 4012	2068	OfficeClickToRun.exe	134
PID 2068 wrote to memory of 4012	2068	OfficeClickToRun.exe	134
PID 4012 wrote to memory of 4640	4012	cmd.exe	136
PID 4012 wrote to memory of 4640	4012	cmd.exe	136
PID 4012 wrote to memory of 3812	4012	cmd.exe	141
PID 4012 wrote to memory of 3812	4012	cmd.exe	141
PID 3812 wrote to memory of 3692	3812	OfficeClickToRun.exe	143
PID 3812 wrote to memory of 3692	3812	OfficeClickToRun.exe	143
PID 3692 wrote to memory of 2104	3692	cmd.exe	145
PID 3692 wrote to memory of 2104	3692	cmd.exe	145
PID 3692 wrote to memory of 1936	3692	cmd.exe	147
PID 3692 wrote to memory of 1936	3692	cmd.exe	147
PID 1936 wrote to memory of 4852	1936	OfficeClickToRun.exe	149
PID 1936 wrote to memory of 4852	1936	OfficeClickToRun.exe	149
PID 4852 wrote to memory of 4396	4852	cmd.exe	151
PID 4852 wrote to memory of 4396	4852	cmd.exe	151
PID 4852 wrote to memory of 2504	4852	cmd.exe	153
PID 4852 wrote to memory of 2504	4852	cmd.exe	153
PID 2504 wrote to memory of 4324	2504	OfficeClickToRun.exe	155
PID 2504 wrote to memory of 4324	2504	OfficeClickToRun.exe	155
PID 4324 wrote to memory of 2712	4324	cmd.exe	157
PID 4324 wrote to memory of 2712	4324	cmd.exe	157
PID 4324 wrote to memory of 212	4324	cmd.exe	159
PID 4324 wrote to memory of 212	4324	cmd.exe	159
PID 212 wrote to memory of 3096	212	OfficeClickToRun.exe	161
PID 212 wrote to memory of 3096	212	OfficeClickToRun.exe	161
PID 3096 wrote to memory of 2116	3096	cmd.exe	163
PID 3096 wrote to memory of 2116	3096	cmd.exe	163
PID 3096 wrote to memory of 3232	3096	cmd.exe	165
PID 3096 wrote to memory of 3232	3096	cmd.exe	165
PID 3232 wrote to memory of 2700	3232	OfficeClickToRun.exe	167
PID 3232 wrote to memory of 2700	3232	OfficeClickToRun.exe	167
PID 2700 wrote to memory of 4020	2700	cmd.exe	169
PID 2700 wrote to memory of 4020	2700	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6MycdEczud.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4140
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3172
      - C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:216
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vIn8vbLsXf.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4640
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2104
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4396
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2712
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wUI7DLfHyj.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2116
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4020
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iS8tBRk2Vg.bat"
        21⤵
        
        PID:3416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3480
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E3sOpJujjE.bat"
        23⤵
        
        PID:4400
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4140
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat"
        25⤵
        
        PID:4088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2840
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\95TPLp0dsP.bat"
        27⤵
        
        PID:2940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:100
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oPL6j2OtN4.bat"
        29⤵
        
        PID:1856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4920
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SpZgFYZT4y.bat"
        31⤵
        
        PID:896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:3148
        
        C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
        32⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OfficeClickToRun.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat

Filesize
235B

MD5
6b00527829906b10866a4119b0029c8f

SHA1
461839b6487c65802ac48788b8d5be51c4e3e55d

SHA256
36f10914b094fab22d6e58eb1762e34fd7e42296828a3d7e3523967e3132716a

SHA512
c0b52fa009b864da70ba52b3244baa2b46fd89851e8f8fb6949bf4c42f50031432510eb39ee16e89577bceecc90564a5dbcc00aa3fb3d354f541e23c49338184

Download Submit
C:\Users\Admin\AppData\Local\Temp\6MycdEczud.bat

Filesize
235B

MD5
883bfa881418ed2cb63da3b07cf7648f

SHA1
01d9f8e184b157cc685634b477885c82e2f86aac

SHA256
90c349af4eb48a75d1fd6c201299c26bc894560a4555d60cc7fbf3f0cac8e90e

SHA512
80a5392570d24b98f21bdc7220742502802bbd1c3baf74cb3756a5e0ea0d1946023c69e778f88cb8bae398f934be6b280fd1f7612d59aa6af6e895d94761afe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\95TPLp0dsP.bat

Filesize
235B

MD5
5556533dc442e48ac4b0ca1a66703718

SHA1
08674453ec972768911fbfdb12ee9b8c5de6735a

SHA256
c82ebf05fef0a9d03a6ff21f019e0e9912967cba7bb75dddf4a2e9f47c92436c

SHA512
62b58ea2835be0459f7420df9fb56133a4c76f9e6c114af00b6e7c9ce7ddcd4910182af865e4df3328128df9405a6950f6410cb94ff02d8541c3656048cdc0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\E3sOpJujjE.bat

Filesize
235B

MD5
44b140b8a8009ad566421cb0c2d06f4c

SHA1
0e6a233d39ca84e804181f0557916eff2f07ca42

SHA256
26bc16e264b3d2d63273c8e53168b2a54f80ae44be59cbe3004b633a5d19d1c1

SHA512
12ee840e3ad8f5241afe05887c2fc1fb5c99a09d9237fc1b51242800000111580eab7076d8b904e353d3a47eaf59514d5d9713481cd2f64d511df20372f675a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\SpZgFYZT4y.bat

Filesize
235B

MD5
584c03926e2f169f36410d1516ca9540

SHA1
5a809c2d4ba0f5cf5690a8fe080f232f3c770e94

SHA256
834060401391b1ae8d2c95bff6c0a553d32ed99ba8dcb4a149613c93e99e637b

SHA512
8f9bf0d49eb752c2421d7ce1ed5dd273b6dd0177525f6018469354a78f867b73d5276c6b232e7a06bad79991aead025285b0d0a6d37ce89c46c05a8b584cdfb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\VlbjwdcMOl.bat

Filesize
235B

MD5
bfd452bf955e71507b16288bbd6e49dc

SHA1
002e69687612fdad328a0c6071957ab5e1d9b8d7

SHA256
fc16208a93453d6a6b141496fc0b62aceb62f8ca478e10f06865cf7976b8f33e

SHA512
4e80a795812ebc65a4caa04f83b6e8ea9dffa417794ca0de993345bd333c67ed22de20079f6cae5427b0361267c838e1d3d04421309b5f2a76717faf15641fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_02qgyipi.cec.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cYhs0sn2L6.bat

Filesize
235B

MD5
f2fcc28de7481e4ba354e7088738f849

SHA1
8c57ac0cbfb58b638e774ba13fc07964ad83d8f6

SHA256
c341445a0cef202469637618239a7f2a5982a8205380c0aecf79c037462dbe5a

SHA512
42282f7a260684f417257f329d2bf702c511e7095b041fe517f3c3ef296efd728347db26041a432711eb6fe957caeb5b86972a50b5a44ab19694d62d7d40e023

Download Submit
C:\Users\Admin\AppData\Local\Temp\iS8tBRk2Vg.bat

Filesize
235B

MD5
8ee6c2921cfd50d7d65b7ec90f33252c

SHA1
dff5126f29f8b45eea140dddb2b3e78dad158f02

SHA256
7838108c6f483264cabf4762d8c333f12f93811f569194e3adae5e46eb1d31df

SHA512
f12c5f9c06aed6515461b426022c462f4b9951535296c92e8c7fa1b41421e5201230e358839da7b0376895b74e8326a34928f391148052314ca9e70b712981d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\oPL6j2OtN4.bat

Filesize
235B

MD5
b5295bfe75e7f5ba7301317cd9274e43

SHA1
8c1e8b5aef2ca26f666ee8d2ba5dec79bd0d4685

SHA256
ad82767901008bbfbd8918b66819677151d6e62e980cb80f43d607df91f6fc6b

SHA512
8da867e46d10c1cbf0b7299847a305e17256ab750d3ad7dfc1571cbe046a63d73f24cb58ce1b855f46c84ff6862056ea18aa297405b7c24fed2bb8489f449c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat

Filesize
235B

MD5
ac0c4024deb704c16591a21fd9f4201a

SHA1
5914a5f301f56ee48481e079de509d808bdafba0

SHA256
93737754c5c3799a5b4e4d7933e8e4bfb0bd772b681b057562c33c313e0a9420

SHA512
d5e77ee678ab7393cc1dcfaa7b39a9735235cefdbb576e83c11d975e65c89ad694ed3005c243af66de62b21cec3da8a47c82ebb24163397d6327e3a90f8db176

Download Submit
C:\Users\Admin\AppData\Local\Temp\sWs9jrlB8v.bat

Filesize
235B

MD5
fbd9d498b29d0289f03c1cc72e17f980

SHA1
4e145248240778b20cb1b9bd6a8a168720f55bcd

SHA256
3b57b6adfd45fa86a7c2651d568ab3a48f1de9b7f8f6db2baa711ea4943c13ec

SHA512
d2b4f6107b3c85ef47eeccef4f3f2bf346f3c9efab0b891b53a3f536823111a47f4909342389044675c4044ae2a609d1b18e735f99472f430c132f26638408ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\vIn8vbLsXf.bat

Filesize
235B

MD5
b2e5bff1a010189517aacd644a63f105

SHA1
6912d03d384c3daf3ed6c837cc13f4391bed5d3f

SHA256
a380d2218e96554fc4d11b25a2222c6eeceadf889aaf319c7ece239b6dae152b

SHA512
66cac05c51885b1d6eddfd69db2bbc469f9212f7640a47227c7f7525d0ef4b5a7cc33943fc5e1004ad174c38a0e7c1e8432f41f02d7416434b0e497ce7111039

Download Submit
C:\Users\Admin\AppData\Local\Temp\wUI7DLfHyj.bat

Filesize
235B

MD5
5a3a5cf8b3d0979115913f3280d4742b

SHA1
aefde7a4313f0e226e209425a1a6b2af6c1f80e4

SHA256
6c2243f4f64a7f065453e8bf74916622b4757033c58f905eb1e1eff29a02b915

SHA512
2ab7d38fd94b0b1efe0f0b61346ca30014340e44511330eacc227f1539b9a17be6493b18918ad8c8025e8479e1dc7bec558944a730fda531c6608d06d564a34b

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/212-134-0x000000001C260000-0x000000001C409000-memory.dmp

Filesize
1.7MB

Download
memory/1568-150-0x0000000002880000-0x0000000002892000-memory.dmp

Filesize
72KB

Download
memory/1700-92-0x0000000002930000-0x0000000002942000-memory.dmp

Filesize
72KB

Download
memory/1936-119-0x000000001BD30000-0x000000001BED9000-memory.dmp

Filesize
1.7MB

Download
memory/2068-105-0x000000001C670000-0x000000001C7DA000-memory.dmp

Filesize
1.4MB

Download
memory/2284-157-0x0000000001780000-0x0000000001792000-memory.dmp

Filesize
72KB

Download
memory/2504-127-0x000000001C760000-0x000000001C909000-memory.dmp

Filesize
1.7MB

Download
memory/2752-164-0x0000000001490000-0x00000000014A2000-memory.dmp

Filesize
72KB

Download
memory/2880-147-0x000000001CAA0000-0x000000001CC49000-memory.dmp

Filesize
1.7MB

Download
memory/3232-140-0x000000001BD00000-0x000000001BEA9000-memory.dmp

Filesize
1.7MB

Download
memory/3712-16-0x00000000016F0000-0x00000000016FC000-memory.dmp

Filesize
48KB

Download
memory/3712-17-0x0000000002FB0000-0x0000000002FBC000-memory.dmp

Filesize
48KB

Download
memory/3712-15-0x0000000001690000-0x000000000169C000-memory.dmp

Filesize
48KB

Download
memory/3712-14-0x0000000001620000-0x0000000001632000-memory.dmp

Filesize
72KB

Download
memory/3712-13-0x0000000000D50000-0x0000000000E60000-memory.dmp

Filesize
1.1MB

Download
memory/3712-12-0x00007FFAE22D3000-0x00007FFAE22D5000-memory.dmp

Filesize
8KB

Download
memory/3812-112-0x000000001C080000-0x000000001C229000-memory.dmp

Filesize
1.7MB

Download
memory/3868-38-0x0000017D6A480000-0x0000017D6A4A2000-memory.dmp

Filesize
136KB

Download
memory/5028-183-0x0000000002C30000-0x0000000002C42000-memory.dmp

Filesize
72KB

Download