dcrat | 417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2024, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87.exe
Size 1.3MB
Sample241230-a71thaslcw
SHA256 417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87
MD5 b2dcf2bfa7e3613e366b7f976507e04b
SHA1 063301ca0a6662072036b84c25062bb6c065baf4
SHA512 e8a6beb3ef0b36c653fbeaf27ba3d211cdd5f71e5f4164a85cbb150e6d36a57aa2004c0b643701988aa543b979b39e18989baae7377d3fa7e6e4c1038e1bdbc6
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	3096	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	3096	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c8d-10.dat	dcrat
behavioral2/memory/2660-13-0x0000000000960000-0x0000000000A70000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1624	powershell.exe
2020	powershell.exe
4816	powershell.exe
2956	powershell.exe
4204	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	JaffaCakes118_417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe

Executes dropped EXE 13 IoCs

pid	Process
2660	DllCommonsvc.exe
1896	SppExtComObj.exe
2660	SppExtComObj.exe
1400	SppExtComObj.exe
4212	SppExtComObj.exe
2160	SppExtComObj.exe
1880	SppExtComObj.exe
3304	SppExtComObj.exe
4460	SppExtComObj.exe
4780	SppExtComObj.exe
2280	SppExtComObj.exe
2292	SppExtComObj.exe
1032	SppExtComObj.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
43	raw.githubusercontent.com
44	raw.githubusercontent.com
51	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
16	raw.githubusercontent.com
36	raw.githubusercontent.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
50	raw.githubusercontent.com
52	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\e1ef82546f0b02	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	JaffaCakes118_417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	SppExtComObj.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4060	schtasks.exe
2368	schtasks.exe
4852	schtasks.exe
3328	schtasks.exe
4836	schtasks.exe
2196	schtasks.exe
3756	schtasks.exe
4008	schtasks.exe
2096	schtasks.exe
2292	schtasks.exe
2908	schtasks.exe
4992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2660	DllCommonsvc.exe
1624	powershell.exe
4204	powershell.exe
2020	powershell.exe
4816	powershell.exe
2956	powershell.exe
2020	powershell.exe
2956	powershell.exe
1624	powershell.exe
4204	powershell.exe
4816	powershell.exe
1896	SppExtComObj.exe
2660	SppExtComObj.exe
1400	SppExtComObj.exe
4212	SppExtComObj.exe
2160	SppExtComObj.exe
1880	SppExtComObj.exe
3304	SppExtComObj.exe
4460	SppExtComObj.exe
4780	SppExtComObj.exe
2280	SppExtComObj.exe
2292	SppExtComObj.exe
1032	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	DllCommonsvc.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	1896	SppExtComObj.exe
Token: SeDebugPrivilege	2660	SppExtComObj.exe
Token: SeDebugPrivilege	1400	SppExtComObj.exe
Token: SeDebugPrivilege	4212	SppExtComObj.exe
Token: SeDebugPrivilege	2160	SppExtComObj.exe
Token: SeDebugPrivilege	1880	SppExtComObj.exe
Token: SeDebugPrivilege	3304	SppExtComObj.exe
Token: SeDebugPrivilege	4460	SppExtComObj.exe
Token: SeDebugPrivilege	4780	SppExtComObj.exe
Token: SeDebugPrivilege	2280	SppExtComObj.exe
Token: SeDebugPrivilege	2292	SppExtComObj.exe
Token: SeDebugPrivilege	1032	SppExtComObj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1348	2176	JaffaCakes118_417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87.exe	83
PID 2176 wrote to memory of 1348	2176	JaffaCakes118_417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87.exe	83
PID 2176 wrote to memory of 1348	2176	JaffaCakes118_417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87.exe	83
PID 1348 wrote to memory of 1488	1348	WScript.exe	85
PID 1348 wrote to memory of 1488	1348	WScript.exe	85
PID 1348 wrote to memory of 1488	1348	WScript.exe	85
PID 1488 wrote to memory of 2660	1488	cmd.exe	87
PID 1488 wrote to memory of 2660	1488	cmd.exe	87
PID 2660 wrote to memory of 2956	2660	DllCommonsvc.exe	102
PID 2660 wrote to memory of 2956	2660	DllCommonsvc.exe	102
PID 2660 wrote to memory of 4816	2660	DllCommonsvc.exe	103
PID 2660 wrote to memory of 4816	2660	DllCommonsvc.exe	103
PID 2660 wrote to memory of 4204	2660	DllCommonsvc.exe	104
PID 2660 wrote to memory of 4204	2660	DllCommonsvc.exe	104
PID 2660 wrote to memory of 1624	2660	DllCommonsvc.exe	105
PID 2660 wrote to memory of 1624	2660	DllCommonsvc.exe	105
PID 2660 wrote to memory of 2020	2660	DllCommonsvc.exe	106
PID 2660 wrote to memory of 2020	2660	DllCommonsvc.exe	106
PID 2660 wrote to memory of 3276	2660	DllCommonsvc.exe	111
PID 2660 wrote to memory of 3276	2660	DllCommonsvc.exe	111
PID 3276 wrote to memory of 3736	3276	cmd.exe	114
PID 3276 wrote to memory of 3736	3276	cmd.exe	114
PID 3276 wrote to memory of 1896	3276	cmd.exe	116
PID 3276 wrote to memory of 1896	3276	cmd.exe	116
PID 1896 wrote to memory of 4316	1896	SppExtComObj.exe	125
PID 1896 wrote to memory of 4316	1896	SppExtComObj.exe	125
PID 4316 wrote to memory of 3368	4316	cmd.exe	127
PID 4316 wrote to memory of 3368	4316	cmd.exe	127
PID 4316 wrote to memory of 2660	4316	cmd.exe	133
PID 4316 wrote to memory of 2660	4316	cmd.exe	133
PID 2660 wrote to memory of 4628	2660	SppExtComObj.exe	138
PID 2660 wrote to memory of 4628	2660	SppExtComObj.exe	138
PID 4628 wrote to memory of 4496	4628	cmd.exe	140
PID 4628 wrote to memory of 4496	4628	cmd.exe	140
PID 4628 wrote to memory of 1400	4628	cmd.exe	142
PID 4628 wrote to memory of 1400	4628	cmd.exe	142
PID 1400 wrote to memory of 1408	1400	SppExtComObj.exe	144
PID 1400 wrote to memory of 1408	1400	SppExtComObj.exe	144
PID 1408 wrote to memory of 3264	1408	cmd.exe	146
PID 1408 wrote to memory of 3264	1408	cmd.exe	146
PID 1408 wrote to memory of 4212	1408	cmd.exe	148
PID 1408 wrote to memory of 4212	1408	cmd.exe	148
PID 4212 wrote to memory of 3816	4212	SppExtComObj.exe	150
PID 4212 wrote to memory of 3816	4212	SppExtComObj.exe	150
PID 3816 wrote to memory of 3060	3816	cmd.exe	152
PID 3816 wrote to memory of 3060	3816	cmd.exe	152
PID 3816 wrote to memory of 2160	3816	cmd.exe	154
PID 3816 wrote to memory of 2160	3816	cmd.exe	154
PID 2160 wrote to memory of 2292	2160	SppExtComObj.exe	156
PID 2160 wrote to memory of 2292	2160	SppExtComObj.exe	156
PID 2292 wrote to memory of 3200	2292	cmd.exe	158
PID 2292 wrote to memory of 3200	2292	cmd.exe	158
PID 2292 wrote to memory of 1880	2292	cmd.exe	160
PID 2292 wrote to memory of 1880	2292	cmd.exe	160
PID 1880 wrote to memory of 2004	1880	SppExtComObj.exe	162
PID 1880 wrote to memory of 2004	1880	SppExtComObj.exe	162
PID 2004 wrote to memory of 3804	2004	cmd.exe	164
PID 2004 wrote to memory of 3804	2004	cmd.exe	164
PID 2004 wrote to memory of 3304	2004	cmd.exe	166
PID 2004 wrote to memory of 3304	2004	cmd.exe	166
PID 3304 wrote to memory of 3320	3304	SppExtComObj.exe	168
PID 3304 wrote to memory of 3320	3304	SppExtComObj.exe	168
PID 3320 wrote to memory of 2976	3320	cmd.exe	170
PID 3320 wrote to memory of 2976	3320	cmd.exe	170

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_417d486583ff8e7bf02137f054f8b2f19a3fe98c1a793137beab49b1f9156f87.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WAmQrpS1zx.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3276
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3736
      - C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3368
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X5pWA5YIY7.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4496
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a1rZrAbBst.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:3264
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MzhLoGhvPq.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3060
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xc1v93Hoh1.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3200
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JCnMdX7E06.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3804
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CPhDZIwY3l.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2976
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a1rZrAbBst.bat"
        21⤵
        
        PID:2268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4372
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YpMZYQImRp.bat"
        23⤵
        
        PID:1236
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1904
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat"
        25⤵
        
        PID:3540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:3484
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zY3yp8Lh1n.bat"
        27⤵
        
        PID:892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4900
        
        C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe
        
        "C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SppExtComObj.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SppExtComObj.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 360B
SHA256 03debee02ec6145cf8e0263da48cc2a41e6c65feb1479174fb5f0d194b68b1d8
MD5 1f2caad630ffad2b8b886f4ca8de30f2
SHA1 46916bce6c26f7acdf6b2aef68d5eca861c8fa9f
SHA512 fc79befa1ae59c0965306587bf8aad89f5ab481a30a526bea1ec74abe19fbb63cdb650e3f5eac6bcb79ed6b1c9b06193f31bfb9d23a4b2a70b847bd29e4ca6a3
MD5 SHA1 SHA512

Submit Download

CPhDZIwY3l.bat

Path C:\Users\Admin\AppData\Local\Temp\CPhDZIwY3l.bat
Size 238B
SHA256 7897c9542af74a651abe7344c9e9acd565f6c7b721ba21e43d575bb8ea4eb448
MD5 4108371d46bdb5bcc375a232da783fcd
SHA1 f3a2c10906dc16e68c3d6c33d0952062ce298914
SHA512 bf9c4e8fbe018e0d58dcf4eea7d8270651847babaaf7d9a1e1c39deeae9fe44303e2c44bb288a9f5b8059cb6e2e2874a9ad6ea3a36719e33dc6bb4f7122af983
MD5 SHA1 SHA512

Submit Download

JCnMdX7E06.bat

Path C:\Users\Admin\AppData\Local\Temp\JCnMdX7E06.bat
Size 238B
SHA256 ecb5e4a5543b7a2ea00f7a94a3da600e59461b1e6719f8fefa50ca091a5a7051
MD5 289d18df3c9f599e0885ccda5fd1d9b7
SHA1 1ec1a0517c324062584bd6e9066cd81c861358d4
SHA512 2e0c3d641a07116933b86b46b9e2cf6519fa05d8db8a87c7b7734d614c68563f5d15f9fde2bc3f133d6b87ebaaa746c92425b7fbd26488ab8a1209c9f689f5ec
MD5 SHA1 SHA512

Submit Download

MzhLoGhvPq.bat

Path C:\Users\Admin\AppData\Local\Temp\MzhLoGhvPq.bat
Size 238B
SHA256 b26b384e4102e18dca136b391077a66fb10109c306db4ac739dce56d99a1b26f
MD5 70f8535bfb3d272c77486e3242f9b3ed
SHA1 71ae70cb56a4f0de2043ef96b5571de2380ddcdc
SHA512 68649ec933a5baff7238a3ea0e5c39cb7f39d75d2275838354ed991e03db4d2f96141f90ce578f8735113312238103683de173e41b87a195faa1674247fa3769
MD5 SHA1 SHA512

Submit Download

WAmQrpS1zx.bat

Path C:\Users\Admin\AppData\Local\Temp\WAmQrpS1zx.bat
Size 238B
SHA256 decba40c15dde7504597ce4e9b4c5d4ffdd75e0ed9fe8a797877f008efa0beca
MD5 1cc1bd1bafe6ae4570f0cbdf50b66a32
SHA1 5984f4a22bdfa85c67094fdd47c6d218f4a1ee0b
SHA512 1ff758d25a0c2f9c67153c5ff0a7f49139ed582a2bc226f5ba4a54bd689ac70ee2df26aa68d7a49fa63c7336d96e60dbd870eaeb55e51b664ce30fdd965ffe50
MD5 SHA1 SHA512

Submit Download

X5pWA5YIY7.bat

Path C:\Users\Admin\AppData\Local\Temp\X5pWA5YIY7.bat
Size 238B
SHA256 6f3265934b77729378c8bc87fbb5ac4a712be7b05d3663bce6b864624dad192b
MD5 d01f5f28717ed591cde5c72d67af145e
SHA1 53370d378a7a75f91dde56e7de39be311f3ad18c
SHA512 30362b79e313b965063f7f3aa4188d1e963ebc9153654b75856cee5c8cb3c0efd3d78af498a0d21c8d0712fc26f566581b6a618930b09517e8c419926675874c
MD5 SHA1 SHA512

Submit Download

YpMZYQImRp.bat

Path C:\Users\Admin\AppData\Local\Temp\YpMZYQImRp.bat
Size 238B
SHA256 e5937202a1f2eeb0964a0f271d093fded0688613c89d5f31e4bdb84e7d1a0d73
MD5 f6670d1b8af0934263ea35e311e833c6
SHA1 3e6c91b72a2bccff805e8e353704fa091b254f43
SHA512 37ed2823c73e5ee4c989c11f08f4bc7038dbc4edbd4297c730915afe58dc8bc3b7627e41be6ae14b125d7607003d467cad98f00b2ccdeae37db4a36dd1a7f379
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_y1yqfh4k.uiq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y1yqfh4k.uiq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

a1rZrAbBst.bat

Path C:\Users\Admin\AppData\Local\Temp\a1rZrAbBst.bat
Size 238B
SHA256 ed5db277e8eba3df4422f28d12261e8e6709123d55fdf67314d772f6ff49e193
MD5 33f7fb9b3a90cd52597d113f8f71584b
SHA1 d7133dd7b6ce6c23dddba94df5ac0f24f87b4dd4
SHA512 11e51bbbfdbb846d7797d56fca532f156d28ccae2d76939a06b90b8adc4f24f90d8b3c602727f026f16d9b7dba6942be33c82b3938c87d671feec1fa109f6294
MD5 SHA1 SHA512

Submit Download

onYrHPGvDe.bat

Path C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat
Size 238B
SHA256 81c05d7b7118bc1c2b573a2907857f17e61490318795db426fa91c8447adb824
MD5 1eea8e836ff3a4b5cb23f66834a4e3f2
SHA1 dd3a7c9871cc947d37f380fb738639bcd6cd69c3
SHA512 a87cac4d90eb65c842d69c9b93feff5bd1b228681d2556bcab2d40459652e4bcf2a17185d53cbfa4ad7875c83715df09d6129d89ebbed8b3d8ed2f9c9760e536
MD5 SHA1 SHA512

Submit Download

tebxeZNirC.bat

Path C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat
Size 238B
SHA256 2463e564cdaadc128abac81050b73735a75213049fc4fd0ed45a5b802f994095
MD5 c095beeaeb1a085804ce5cab37905491
SHA1 0c62183261f3d4bea3e3d60de5f2b5b160bd85a1
SHA512 85554768981a9a3b45e4fba6a36e0132aa564a3b45e58f7c7eb952bba30b389b6e48c32e42427520856d6922d0e1e7b45aa326ebcdfe76a047af64a20d899a6e
MD5 SHA1 SHA512

Submit Download

xc1v93Hoh1.bat

Path C:\Users\Admin\AppData\Local\Temp\xc1v93Hoh1.bat
Size 238B
SHA256 847b654c4a6b0d9f14dc6a0b5390a910fe97f59c848ac04ae54e92975bb5807b
MD5 77ac9b76f50b1133d86c7f53d0a9fdac
SHA1 6474da79755c188a8cb8aabe18aca893a6fa3368
SHA512 79de0df2ff5571b0d3af2283af2f618d103373d750a2013354a22bfc2dceb0da970dfa1f625024d34f54a8190752410403a2407ee878f18f5b2160db850df4a0
MD5 SHA1 SHA512

Submit Download

zY3yp8Lh1n.bat

Path C:\Users\Admin\AppData\Local\Temp\zY3yp8Lh1n.bat
Size 238B
SHA256 322cc0ef033035d6f5141c2f2e8f371f86ec4ca7bda2afffb16ce59cc204e02e
MD5 e1055468fc6093a9a461cc4ed3036826
SHA1 e7f23a7462f225599d6835b5c8366053f829c733
SHA512 84bce5596798947ac1515bdc28772b9685f2a9eafcc01d1d652dbf2ca9138138127a08fbda196640da69aaea1bea4f30069d392a7fe6e9071de534e266ddb4f4
MD5 SHA1 SHA512

Submit Download

1zu9dW.bat

Path C:\providercommon\1zu9dW.bat
Size 36B
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
MD5 SHA1 SHA512

Submit Download

DllCommonsvc.exe

Path C:\providercommon\DllCommonsvc.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

yTUdeXjbLOhnrN32dgrxVg.vbe

Path C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
Size 197B
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478
MD5 SHA1 SHA512

Submit Download

memory/1032-174-0x0000000002BA0000-0x0000000002BB2000-memory.dmp

Download

memory/1400-108-0x0000000002C60000-0x0000000002C72000-memory.dmp

Download

memory/1624-36-0x000002198D640000-0x000002198D662000-memory.dmp

Download

memory/1896-92-0x0000000001010000-0x0000000001022000-memory.dmp

Download

memory/2280-162-0x000000001C4B0000-0x000000001C551000-memory.dmp

Download

memory/2280-163-0x000000001C560000-0x000000001C709000-memory.dmp

Download

memory/2292-172-0x000000001C4D0000-0x000000001C679000-memory.dmp

Download

memory/2292-166-0x0000000002B90000-0x0000000002BA2000-memory.dmp

Download

memory/2660-101-0x0000000001070000-0x0000000001082000-memory.dmp

Download

memory/2660-17-0x000000001BDB0000-0x000000001BDBC000-memory.dmp

Download

memory/2660-16-0x000000001BDA0000-0x000000001BDAC000-memory.dmp

Download

memory/2660-13-0x0000000000960000-0x0000000000A70000-memory.dmp

Download

memory/2660-14-0x000000001B570000-0x000000001B582000-memory.dmp

Download

memory/2660-12-0x00007FFE6CEC3000-0x00007FFE6CEC5000-memory.dmp

Download

memory/2660-15-0x000000001BD90000-0x000000001BD9C000-memory.dmp

Download

memory/3304-138-0x000000001C9D0000-0x000000001CA71000-memory.dmp

Download

memory/3304-139-0x000000001CA80000-0x000000001CC29000-memory.dmp

Download

memory/4212-115-0x0000000002470000-0x0000000002482000-memory.dmp

Download

memory/4460-147-0x000000001C750000-0x000000001C8F9000-memory.dmp

Download

memory/4460-146-0x000000001C6A0000-0x000000001C741000-memory.dmp

Download

memory/4780-155-0x000000001BE30000-0x000000001BFD9000-memory.dmp

Download

memory/4780-154-0x000000001BD80000-0x000000001BE21000-memory.dmp

Download