dcrat | 862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c.exe
Size

1.3MB
MD5

1ce19df762f1951a95f182650250f154
SHA1

19b39b049dcac75786078168fa6ef0b3882cd4a1
SHA256

862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c
SHA512

c66cb5e3f22b1bc3315cb2f8f05b4cd4ea1a5b944fb9cfcfaa6f3288d6f03971bfbfc0ae4543d6d8b5bdcdfa7589ceaa04a3d673591f0261cd288abf1af3f19b
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3212	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3316	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	3676	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	3676	schtasks.exe	91

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c9c-10.dat	dcrat
behavioral2/memory/3436-13-0x0000000000B40000-0x0000000000C50000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5056	powershell.exe
3420	powershell.exe
4708	powershell.exe
1588	powershell.exe
5068	powershell.exe
3536	powershell.exe
3624	powershell.exe
1592	powershell.exe
1496	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	JaffaCakes118_862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysmon.exe

Executes dropped EXE 14 IoCs

pid	Process
3436	DllCommonsvc.exe
748	sysmon.exe
3132	sysmon.exe
2696	sysmon.exe
3128	sysmon.exe
4148	sysmon.exe
1028	sysmon.exe
2892	sysmon.exe
2156	sysmon.exe
1688	sysmon.exe
1664	sysmon.exe
3668	sysmon.exe
1324	sysmon.exe
396	sysmon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
50	raw.githubusercontent.com
22	raw.githubusercontent.com
36	raw.githubusercontent.com
37	raw.githubusercontent.com
40	raw.githubusercontent.com
42	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
14	raw.githubusercontent.com
15	raw.githubusercontent.com
43	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\upfc.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\es-ES\121e5b5079f7c0	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files\Common Files\microsoft shared\Triedit\WaaSMedicAgent.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\microsoft shared\Triedit\c82b8037eab33d	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\upfc.exe	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\ea1d8f6d871115	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\es-ES\sysmon.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Prefetch\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\Prefetch\9e8d7a4ca61bd9	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	JaffaCakes118_862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	sysmon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4340	schtasks.exe
4544	schtasks.exe
3316	schtasks.exe
3552	schtasks.exe
1908	schtasks.exe
1892	schtasks.exe
696	schtasks.exe
3944	schtasks.exe
1432	schtasks.exe
2152	schtasks.exe
2124	schtasks.exe
1088	schtasks.exe
2336	schtasks.exe
2380	schtasks.exe
212	schtasks.exe
3212	schtasks.exe
1956	schtasks.exe
3388	schtasks.exe
5116	schtasks.exe
4120	schtasks.exe
3492	schtasks.exe
5112	schtasks.exe
4428	schtasks.exe
3292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3436	DllCommonsvc.exe
3436	DllCommonsvc.exe
3436	DllCommonsvc.exe
3420	powershell.exe
3420	powershell.exe
3624	powershell.exe
3624	powershell.exe
5056	powershell.exe
5056	powershell.exe
1592	powershell.exe
1592	powershell.exe
4708	powershell.exe
4708	powershell.exe
1496	powershell.exe
1496	powershell.exe
3536	powershell.exe
3536	powershell.exe
5068	powershell.exe
5068	powershell.exe
1588	powershell.exe
1588	powershell.exe
1588	powershell.exe
748	sysmon.exe
748	sysmon.exe
3420	powershell.exe
1496	powershell.exe
3624	powershell.exe
4708	powershell.exe
5056	powershell.exe
5068	powershell.exe
1592	powershell.exe
3536	powershell.exe
3132	sysmon.exe
2696	sysmon.exe
3128	sysmon.exe
4148	sysmon.exe
1028	sysmon.exe
2892	sysmon.exe
2156	sysmon.exe
1688	sysmon.exe
1664	sysmon.exe
3668	sysmon.exe
1324	sysmon.exe
396	sysmon.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3436	DllCommonsvc.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	748	sysmon.exe
Token: SeDebugPrivilege	3132	sysmon.exe
Token: SeDebugPrivilege	2696	sysmon.exe
Token: SeDebugPrivilege	3128	sysmon.exe
Token: SeDebugPrivilege	4148	sysmon.exe
Token: SeDebugPrivilege	1028	sysmon.exe
Token: SeDebugPrivilege	2892	sysmon.exe
Token: SeDebugPrivilege	2156	sysmon.exe
Token: SeDebugPrivilege	1688	sysmon.exe
Token: SeDebugPrivilege	1664	sysmon.exe
Token: SeDebugPrivilege	3668	sysmon.exe
Token: SeDebugPrivilege	1324	sysmon.exe
Token: SeDebugPrivilege	396	sysmon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 4404	3544	JaffaCakes118_862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c.exe	83
PID 3544 wrote to memory of 4404	3544	JaffaCakes118_862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c.exe	83
PID 3544 wrote to memory of 4404	3544	JaffaCakes118_862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c.exe	83
PID 4404 wrote to memory of 3880	4404	WScript.exe	86
PID 4404 wrote to memory of 3880	4404	WScript.exe	86
PID 4404 wrote to memory of 3880	4404	WScript.exe	86
PID 3880 wrote to memory of 3436	3880	cmd.exe	88
PID 3880 wrote to memory of 3436	3880	cmd.exe	88
PID 3436 wrote to memory of 5068	3436	DllCommonsvc.exe	116
PID 3436 wrote to memory of 5068	3436	DllCommonsvc.exe	116
PID 3436 wrote to memory of 3536	3436	DllCommonsvc.exe	117
PID 3436 wrote to memory of 3536	3436	DllCommonsvc.exe	117
PID 3436 wrote to memory of 4708	3436	DllCommonsvc.exe	118
PID 3436 wrote to memory of 4708	3436	DllCommonsvc.exe	118
PID 3436 wrote to memory of 3624	3436	DllCommonsvc.exe	119
PID 3436 wrote to memory of 3624	3436	DllCommonsvc.exe	119
PID 3436 wrote to memory of 5056	3436	DllCommonsvc.exe	120
PID 3436 wrote to memory of 5056	3436	DllCommonsvc.exe	120
PID 3436 wrote to memory of 3420	3436	DllCommonsvc.exe	121
PID 3436 wrote to memory of 3420	3436	DllCommonsvc.exe	121
PID 3436 wrote to memory of 1496	3436	DllCommonsvc.exe	123
PID 3436 wrote to memory of 1496	3436	DllCommonsvc.exe	123
PID 3436 wrote to memory of 1592	3436	DllCommonsvc.exe	124
PID 3436 wrote to memory of 1592	3436	DllCommonsvc.exe	124
PID 3436 wrote to memory of 1588	3436	DllCommonsvc.exe	125
PID 3436 wrote to memory of 1588	3436	DllCommonsvc.exe	125
PID 3436 wrote to memory of 748	3436	DllCommonsvc.exe	133
PID 3436 wrote to memory of 748	3436	DllCommonsvc.exe	133
PID 748 wrote to memory of 4644	748	sysmon.exe	141
PID 748 wrote to memory of 4644	748	sysmon.exe	141
PID 4644 wrote to memory of 1984	4644	cmd.exe	143
PID 4644 wrote to memory of 1984	4644	cmd.exe	143
PID 4644 wrote to memory of 3132	4644	cmd.exe	145
PID 4644 wrote to memory of 3132	4644	cmd.exe	145
PID 3132 wrote to memory of 3492	3132	sysmon.exe	147
PID 3132 wrote to memory of 3492	3132	sysmon.exe	147
PID 3492 wrote to memory of 4944	3492	cmd.exe	149
PID 3492 wrote to memory of 4944	3492	cmd.exe	149
PID 3492 wrote to memory of 2696	3492	cmd.exe	153
PID 3492 wrote to memory of 2696	3492	cmd.exe	153
PID 2696 wrote to memory of 228	2696	sysmon.exe	156
PID 2696 wrote to memory of 228	2696	sysmon.exe	156
PID 228 wrote to memory of 2088	228	cmd.exe	158
PID 228 wrote to memory of 2088	228	cmd.exe	158
PID 228 wrote to memory of 3128	228	cmd.exe	160
PID 228 wrote to memory of 3128	228	cmd.exe	160
PID 3128 wrote to memory of 3328	3128	sysmon.exe	162
PID 3128 wrote to memory of 3328	3128	sysmon.exe	162
PID 3328 wrote to memory of 3848	3328	cmd.exe	164
PID 3328 wrote to memory of 3848	3328	cmd.exe	164
PID 3328 wrote to memory of 4148	3328	cmd.exe	166
PID 3328 wrote to memory of 4148	3328	cmd.exe	166
PID 4148 wrote to memory of 3136	4148	sysmon.exe	168
PID 4148 wrote to memory of 3136	4148	sysmon.exe	168
PID 3136 wrote to memory of 440	3136	cmd.exe	170
PID 3136 wrote to memory of 440	3136	cmd.exe	170
PID 3136 wrote to memory of 1028	3136	cmd.exe	172
PID 3136 wrote to memory of 1028	3136	cmd.exe	172
PID 1028 wrote to memory of 1324	1028	sysmon.exe	174
PID 1028 wrote to memory of 1324	1028	sysmon.exe	174
PID 1324 wrote to memory of 452	1324	cmd.exe	176
PID 1324 wrote to memory of 452	1324	cmd.exe	176
PID 1324 wrote to memory of 2892	1324	cmd.exe	178
PID 1324 wrote to memory of 2892	1324	cmd.exe	178

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_862e161ee80ee85f4ecd2d27731a189fdfd20ea6c8b623d97fca74147671631c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\es-ES\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\Triedit\WaaSMedicAgent.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\3D Objects\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
    - - C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:748
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UWQnaEvoMY.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1984
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rHhDMS4c5i.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4944
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\daA37ewxym.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2088
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gN51JOWfNX.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3848
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uItNEyebdJ.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:440
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CKPPXbanu.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:452
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GptcLQn9Ec.bat"
        18⤵
        
        PID:4204
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3464
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NczlPfxoCy.bat"
        20⤵
        
        PID:788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:700
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A1nTHBcTHH.bat"
        22⤵
        
        PID:4992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1148
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat"
        24⤵
        
        PID:4608
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2304
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PfMhC4n1i0.bat"
        26⤵
        
        PID:5116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2340
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zGIMjSYhT8.bat"
        28⤵
        
        PID:2404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:5112
        
        C:\Program Files\Windows Defender\es-ES\sysmon.exe
        
        "C:\Program Files\Windows Defender\es-ES\sysmon.exe"
        29⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Crashpad\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files\Crashpad\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Admin\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\es-ES\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\es-ES\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Prefetch\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\Prefetch\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\3D Objects\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\3D Objects\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\3D Objects\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Temp\1CKPPXbanu.bat

Filesize
215B

MD5
977e8ad633b7e005746997068ab00f37

SHA1
efb8a3172765b72aa1650527091c940590592ea3

SHA256
94b2d918dac313c438c40ae9354af6bce0d9aae2d168c067ce70b418d9d987b3

SHA512
f99a02d6c569e3eba407b3e164c29a2d7fd4ce48da9c27fc764a5e8304946774068d315b9a3a7780bfaa955e0664f41b0072edb97b305e6a6f62b79896542c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1nTHBcTHH.bat

Filesize
215B

MD5
37c14c2c5643929d4d71a49f5269b049

SHA1
4133d25fbfa4c6a52e93d2993f1206a10757d3d1

SHA256
ad1716744b37a5fd69162a11fde2e6294d5c1e518f39d66fbeb14ef4fc1c3820

SHA512
aa35109c43048d7e5d467de00733215278b4cba50b31380e13d08556ff41f334bb2069a88c42c990892da0175d2f90be04503d109183619d77a70534d2408b94

Download Submit
C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat

Filesize
215B

MD5
cb3a7c6a16f68fa9fdce00f7c1af97e7

SHA1
5326e7eeda7974e4ee669874d8c491dcf86c6f7f

SHA256
dfd4d2ca5115501ed75a76812bc1b2afa6952fda8e15b3915b4f90dc6a9f370f

SHA512
85a5a582318723dbbc446095175ff3c39d663b29cec0c9a66022a2e89844d9b78dac735017c9a8f598c649e407cdb05de65fbdc572544a895c9ea826f0a6838a

Download Submit
C:\Users\Admin\AppData\Local\Temp\GptcLQn9Ec.bat

Filesize
215B

MD5
9ad51c3cdc6086baf11994b6baf9f2d6

SHA1
9846a11bc3972890af30702ed24458c3433db368

SHA256
d26aa663ea242b3f9897fd7c14ab733433362d10c9dd26dfb3f343351a33722a

SHA512
6afd02f1be4730a4d41c543339f6d653dc40402fa6116f233eaf4c48ddb800523d8e3f241ba83e21dda66ddef0e05b4bde7afb3c078fd2fe082404bbe8084568

Download Submit
C:\Users\Admin\AppData\Local\Temp\NczlPfxoCy.bat

Filesize
215B

MD5
88bb1fccbfb8bb6b155105c8ed0bd08b

SHA1
136059da4836e12a0dccf8df5d71673eaedcc2d1

SHA256
57d5a5362ef8067d777628d2bbd2ebbf319a646fff75bbcfd4acf570b8d73b26

SHA512
1c6e104fa4905a7911a90c4528b800438a2e630f61f163d5d36ea88dcc97e9cfc3ed868556ea13f29d0c32c121f91327d3931f7c1fd88809482eb509ea610bc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\PfMhC4n1i0.bat

Filesize
215B

MD5
01635f0136d0a6c2c408ad425f61ed82

SHA1
ef15ae40666b93b5cee458de99bfecc32363bb1d

SHA256
097dde3baf8d104b28d4a56cd21a63ac32eb34d4966e249a4e9419edde0cdeb0

SHA512
a9cbecbb40ec099128532a87f64f9a615b527b6627f64309722061afe1784bc30fea9231516295572b68f5eb39d5e9c2422c58f095e46e870f4d0ebd93785d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\UWQnaEvoMY.bat

Filesize
215B

MD5
6e02a2e03d96ee219041cde42d14f57d

SHA1
f0563b65f195322df9ebcb2dec74d3698318cad7

SHA256
af981b306fc8e5da0012e7523cd16a2b5f108f8beeec694c9d664af6fa849212

SHA512
b78dd269b2d778ccd68811e188a1741569b7a36641a592186a84275477963a790ea9befbdd8e451a299ca81b655a205a36aa88e4c5ce54da5d7b80bb260df80d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eoe3w1ys.gmz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\daA37ewxym.bat

Filesize
215B

MD5
9d17616c90781acba508f82e6765c4a2

SHA1
24e436e15b7c866db8522419baabedecee354b39

SHA256
1fa25caeafca4411f437ff6e884c7ae26c0628e40a05eadee53c72635ad4519c

SHA512
ffbd39c59bbd4ef782a19fbb3bcfda47da488307fcb00aa9876c3bd69d2b08812a5d48d6c5346ac8eff8b91f34674b8381fb00783799794b556bbe193eaaa0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\gN51JOWfNX.bat

Filesize
215B

MD5
73190b181d0510543147f90d8fb67244

SHA1
9dcab89c7ed816a6f9e8b89262748edcc6ab2cea

SHA256
dc25c77a67930e0e745a2855f5ff699b3a6e604816eca825b7ad935f7f05eeec

SHA512
f740fc0aa55c21a83eb991da0797cdeab862b33227fee40a445f31e778db11820ad38e96f0fa5d640a11d0435d30323337400962c7162d83536cc3107f738894

Download Submit
C:\Users\Admin\AppData\Local\Temp\rHhDMS4c5i.bat

Filesize
215B

MD5
1a98ac19d0882795ad44c1a52d2e17f6

SHA1
49bb93fcd22b6e5fd8988cb1d01e81190cc8ed6f

SHA256
737c9bf5daccc1e90f6732cde7c12800cfacc30de5222c9418bb2b537bbd824a

SHA512
61b51425df7c577c4a979702aed1aec75f624d834f63e4ec293e5eaea9e99b81138404201161859aabf767985a314420ecbd449fccace428be1524492dcc79ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\uItNEyebdJ.bat

Filesize
215B

MD5
10b23b33317db68d3cbd70507746e73c

SHA1
78c12fc50d81a374df009635fa65e535ee822a8a

SHA256
0f06e09c4bdfc99e53f27158db3bd9498bc344aac16db85dc12929094bebd00a

SHA512
c32cc2ac296b7c6306dabbf873a61c88e73f163ff0c097e8200c82186a57610d7e3dd2510c8db3d4fe9cde7188588adbc2e8cb01dc825829fc69d887a6b6ae16

Download Submit
C:\Users\Admin\AppData\Local\Temp\zGIMjSYhT8.bat

Filesize
215B

MD5
da5fac57a6511e30bb5eec2063474899

SHA1
006c0e53ac46e3ca77a78f20701d34b4f2d32b42

SHA256
0350e2ea1dd823d670119094651c662c4a4f6e98229606c8e70a046570cf0080

SHA512
23ed97bb12d7fc8fbbffec67f6affec0b52a7b04c8ce97cc4b820fefb7fd656a56189987b22e4c89a2b5af833b7ef9285d903023ad0610ea77974c3ea62ff877

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/748-114-0x00000000009C0000-0x00000000009D2000-memory.dmp

Filesize
72KB

Download
memory/1028-189-0x00000000017A0000-0x00000000017B2000-memory.dmp

Filesize
72KB

Download
memory/1496-137-0x0000023353AF0000-0x0000023353C5A000-memory.dmp

Filesize
1.4MB

Download
memory/1588-131-0x000001C9EC320000-0x000001C9EC48A000-memory.dmp

Filesize
1.4MB

Download
memory/1592-153-0x00000276D7180000-0x00000276D72EA000-memory.dmp

Filesize
1.4MB

Download
memory/1688-209-0x0000000002F40000-0x0000000002F52000-memory.dmp

Filesize
72KB

Download
memory/2696-170-0x00000000022F0000-0x0000000002302000-memory.dmp

Filesize
72KB

Download
memory/2892-196-0x0000000002190000-0x00000000021A2000-memory.dmp

Filesize
72KB

Download
memory/3132-162-0x0000000000AF0000-0x0000000000B02000-memory.dmp

Filesize
72KB

Download
memory/3132-167-0x000000001B670000-0x000000001B772000-memory.dmp

Filesize
1.0MB

Download
memory/3420-138-0x0000020BDED40000-0x0000020BDEEAA000-memory.dmp

Filesize
1.4MB

Download
memory/3420-54-0x0000020BDEAB0000-0x0000020BDEAD2000-memory.dmp

Filesize
136KB

Download
memory/3436-12-0x00007FFCD38A3000-0x00007FFCD38A5000-memory.dmp

Filesize
8KB

Download
memory/3436-13-0x0000000000B40000-0x0000000000C50000-memory.dmp

Filesize
1.1MB

Download
memory/3436-17-0x0000000002E80000-0x0000000002E8C000-memory.dmp

Filesize
48KB

Download
memory/3436-16-0x00000000015C0000-0x00000000015CC000-memory.dmp

Filesize
48KB

Download
memory/3436-15-0x0000000002E90000-0x0000000002E9C000-memory.dmp

Filesize
48KB

Download
memory/3436-14-0x0000000001310000-0x0000000001322000-memory.dmp

Filesize
72KB

Download
memory/3536-152-0x0000021E74190000-0x0000021E742FA000-memory.dmp

Filesize
1.4MB

Download
memory/3624-143-0x000002435C6C0000-0x000002435C82A000-memory.dmp

Filesize
1.4MB

Download
memory/3668-222-0x0000000000C90000-0x0000000000CA2000-memory.dmp

Filesize
72KB

Download
memory/4708-132-0x0000022733B50000-0x0000022733CBA000-memory.dmp

Filesize
1.4MB

Download
memory/5056-148-0x000001FA371F0000-0x000001FA3735A000-memory.dmp

Filesize
1.4MB

Download
memory/5068-149-0x000001CE2E9C0000-0x000001CE2EB2A000-memory.dmp

Filesize
1.4MB

Download