dcrat | a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2024, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22.exe
Size 1.3MB
Sample241230-bp4ccasrfs
SHA256 a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22
MD5 5e862691c8c302de13412a955785cfef
SHA1 921755e7a3daaa35af8b837f05b5496a00718a18
SHA512 cae5d2699dc61fb565048d1b9ff49d8e54081772792ddd149caa3a6144191f36d643325a7e5325bec86e3b5c36d75ca913fef21cb2d0a8952a9898ccd9693176
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	2492	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2492	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023ba8-10.dat	dcrat
behavioral2/memory/1232-13-0x0000000000050000-0x0000000000160000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
632	powershell.exe
3008	powershell.exe
2428	powershell.exe
2144	powershell.exe
3296	powershell.exe
4080	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	JaffaCakes118_a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 14 IoCs

pid	Process
1232	DllCommonsvc.exe
2236	RuntimeBroker.exe
3004	RuntimeBroker.exe
1920	RuntimeBroker.exe
1012	RuntimeBroker.exe
460	RuntimeBroker.exe
3296	RuntimeBroker.exe
524	RuntimeBroker.exe
2340	RuntimeBroker.exe
2728	RuntimeBroker.exe
3076	RuntimeBroker.exe
2120	RuntimeBroker.exe
2772	RuntimeBroker.exe
3504	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
41	raw.githubusercontent.com
42	raw.githubusercontent.com
47	raw.githubusercontent.com
49	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
34	raw.githubusercontent.com
50	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com
17	raw.githubusercontent.com
37	raw.githubusercontent.com
38	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\XPSViewer\fr-FR\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\SysWOW64\XPSViewer\fr-FR\cc11b995f2a76d	DllCommonsvc.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\csrss.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	JaffaCakes118_a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4580	schtasks.exe
4484	schtasks.exe
3088	schtasks.exe
2012	schtasks.exe
780	schtasks.exe
3624	schtasks.exe
5020	schtasks.exe
2960	schtasks.exe
2396	schtasks.exe
2516	schtasks.exe
4456	schtasks.exe
2280	schtasks.exe
5012	schtasks.exe
3500	schtasks.exe
4604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1232	DllCommonsvc.exe
1232	DllCommonsvc.exe
1232	DllCommonsvc.exe
1232	DllCommonsvc.exe
1232	DllCommonsvc.exe
3008	powershell.exe
2144	powershell.exe
632	powershell.exe
2428	powershell.exe
3008	powershell.exe
4080	powershell.exe
3296	powershell.exe
2236	RuntimeBroker.exe
632	powershell.exe
2428	powershell.exe
2144	powershell.exe
4080	powershell.exe
3296	powershell.exe
3004	RuntimeBroker.exe
1920	RuntimeBroker.exe
1012	RuntimeBroker.exe
460	RuntimeBroker.exe
3296	RuntimeBroker.exe
524	RuntimeBroker.exe
2340	RuntimeBroker.exe
2728	RuntimeBroker.exe
3076	RuntimeBroker.exe
2120	RuntimeBroker.exe
2772	RuntimeBroker.exe
3504	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	DllCommonsvc.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	2236	RuntimeBroker.exe
Token: SeDebugPrivilege	3004	RuntimeBroker.exe
Token: SeDebugPrivilege	1920	RuntimeBroker.exe
Token: SeDebugPrivilege	1012	RuntimeBroker.exe
Token: SeDebugPrivilege	460	RuntimeBroker.exe
Token: SeDebugPrivilege	3296	RuntimeBroker.exe
Token: SeDebugPrivilege	524	RuntimeBroker.exe
Token: SeDebugPrivilege	2340	RuntimeBroker.exe
Token: SeDebugPrivilege	2728	RuntimeBroker.exe
Token: SeDebugPrivilege	3076	RuntimeBroker.exe
Token: SeDebugPrivilege	2120	RuntimeBroker.exe
Token: SeDebugPrivilege	2772	RuntimeBroker.exe
Token: SeDebugPrivilege	3504	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 624	1204	JaffaCakes118_a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22.exe	82
PID 1204 wrote to memory of 624	1204	JaffaCakes118_a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22.exe	82
PID 1204 wrote to memory of 624	1204	JaffaCakes118_a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22.exe	82
PID 624 wrote to memory of 4740	624	WScript.exe	83
PID 624 wrote to memory of 4740	624	WScript.exe	83
PID 624 wrote to memory of 4740	624	WScript.exe	83
PID 4740 wrote to memory of 1232	4740	cmd.exe	85
PID 4740 wrote to memory of 1232	4740	cmd.exe	85
PID 1232 wrote to memory of 4080	1232	DllCommonsvc.exe	102
PID 1232 wrote to memory of 4080	1232	DllCommonsvc.exe	102
PID 1232 wrote to memory of 632	1232	DllCommonsvc.exe	103
PID 1232 wrote to memory of 632	1232	DllCommonsvc.exe	103
PID 1232 wrote to memory of 3008	1232	DllCommonsvc.exe	104
PID 1232 wrote to memory of 3008	1232	DllCommonsvc.exe	104
PID 1232 wrote to memory of 2428	1232	DllCommonsvc.exe	105
PID 1232 wrote to memory of 2428	1232	DllCommonsvc.exe	105
PID 1232 wrote to memory of 2144	1232	DllCommonsvc.exe	106
PID 1232 wrote to memory of 2144	1232	DllCommonsvc.exe	106
PID 1232 wrote to memory of 3296	1232	DllCommonsvc.exe	107
PID 1232 wrote to memory of 3296	1232	DllCommonsvc.exe	107
PID 1232 wrote to memory of 2236	1232	DllCommonsvc.exe	113
PID 1232 wrote to memory of 2236	1232	DllCommonsvc.exe	113
PID 2236 wrote to memory of 4948	2236	RuntimeBroker.exe	118
PID 2236 wrote to memory of 4948	2236	RuntimeBroker.exe	118
PID 4948 wrote to memory of 2172	4948	cmd.exe	120
PID 4948 wrote to memory of 2172	4948	cmd.exe	120
PID 4948 wrote to memory of 3004	4948	cmd.exe	122
PID 4948 wrote to memory of 3004	4948	cmd.exe	122
PID 3004 wrote to memory of 4884	3004	RuntimeBroker.exe	125
PID 3004 wrote to memory of 4884	3004	RuntimeBroker.exe	125
PID 4884 wrote to memory of 2412	4884	cmd.exe	127
PID 4884 wrote to memory of 2412	4884	cmd.exe	127
PID 4884 wrote to memory of 1920	4884	cmd.exe	129
PID 4884 wrote to memory of 1920	4884	cmd.exe	129
PID 1920 wrote to memory of 4112	1920	RuntimeBroker.exe	130
PID 1920 wrote to memory of 4112	1920	RuntimeBroker.exe	130
PID 4112 wrote to memory of 3804	4112	cmd.exe	132
PID 4112 wrote to memory of 3804	4112	cmd.exe	132
PID 4112 wrote to memory of 1012	4112	cmd.exe	134
PID 4112 wrote to memory of 1012	4112	cmd.exe	134
PID 1012 wrote to memory of 4260	1012	RuntimeBroker.exe	135
PID 1012 wrote to memory of 4260	1012	RuntimeBroker.exe	135
PID 4260 wrote to memory of 4720	4260	cmd.exe	137
PID 4260 wrote to memory of 4720	4260	cmd.exe	137
PID 4260 wrote to memory of 460	4260	cmd.exe	138
PID 4260 wrote to memory of 460	4260	cmd.exe	138
PID 460 wrote to memory of 3560	460	RuntimeBroker.exe	139
PID 460 wrote to memory of 3560	460	RuntimeBroker.exe	139
PID 3560 wrote to memory of 1136	3560	cmd.exe	141
PID 3560 wrote to memory of 1136	3560	cmd.exe	141
PID 3560 wrote to memory of 3296	3560	cmd.exe	142
PID 3560 wrote to memory of 3296	3560	cmd.exe	142
PID 3296 wrote to memory of 2428	3296	RuntimeBroker.exe	143
PID 3296 wrote to memory of 2428	3296	RuntimeBroker.exe	143
PID 2428 wrote to memory of 916	2428	cmd.exe	145
PID 2428 wrote to memory of 916	2428	cmd.exe	145
PID 2428 wrote to memory of 524	2428	cmd.exe	146
PID 2428 wrote to memory of 524	2428	cmd.exe	146
PID 524 wrote to memory of 4856	524	RuntimeBroker.exe	147
PID 524 wrote to memory of 4856	524	RuntimeBroker.exe	147
PID 4856 wrote to memory of 2928	4856	cmd.exe	149
PID 4856 wrote to memory of 2928	4856	cmd.exe	149
PID 4856 wrote to memory of 2340	4856	cmd.exe	150
PID 4856 wrote to memory of 2340	4856	cmd.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a73f3615f7057573f73d5958744943b48cd3ca94e7a778903e058d85cf4c4c22.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\XPSViewer\fr-FR\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
    - - C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2236
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tiHtiEmsSK.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2172
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TA6UjH3MJQ.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2412
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J6LEBq1ChC.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3804
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NDsGBfOUR3.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4720
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vkfoWdc5zM.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1136
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5Yw7RONjUI.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:916
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2XkxZsmkwh.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2928
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tiHtiEmsSK.bat"
        20⤵
        
        PID:5000
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2232
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat"
        22⤵
        
        PID:4140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1256
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BHs9KC1JDp.bat"
        24⤵
        
        PID:756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3332
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LBVLNHYHv1.bat"
        26⤵
        
        PID:1476
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4064
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2Odt5WJZ2f.bat"
        28⤵
        
        PID:1864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4732
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        29⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\providercommon\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\SysWOW64\XPSViewer\fr-FR\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SysWOW64\XPSViewer\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\SysWOW64\XPSViewer\fr-FR\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
MD5 59d97011e091004eaffb9816aa0b9abd
SHA1 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA512 d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 104B
SHA256 f885ed3233268176df05722e3d81cce3b5c594dbc7f6b902aabb04c81e491a5a
MD5 0aaff343cf9a55dbf6898f1ce6541b1e
SHA1 7c94bf5e1a013257f78e575801b79f59e1c30961
SHA512 7f479938d99f9dddc3ff84ac2c0b4db192b3d1c345259c6258bdc776960c3a3a81b379c250e73fae7e691512b90d8d6d00db5784b7a8c1e7195b2536b188bc9e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

2Odt5WJZ2f.bat

Path C:\Users\Admin\AppData\Local\Temp\2Odt5WJZ2f.bat
Size 200B
SHA256 ab0ebd18d1a06d5ecdb1fa6600bad07b0230def59aba49764fe67838ce4ba308
MD5 56b6740c2c2264529f458808adf3d1cf
SHA1 e374a30fcdd833d5f032ef6a369358c33d01c7c7
SHA512 433df1696d4212eb9454eb45473684cf77957026125a5852af823c01e62653b69ac9be7737b2ca042cf9babd0a5a39847889ca6b286e075fccff3e18feaba67f
MD5 SHA1 SHA512

Submit Download

2XkxZsmkwh.bat

Path C:\Users\Admin\AppData\Local\Temp\2XkxZsmkwh.bat
Size 200B
SHA256 9d3432896c899f94248c09615245d1d82fb3992b93bad9f5dd185da578d3888a
MD5 d332b0291bcbcbff590c015b3c563008
SHA1 d479933a3c1ebf0de16c69294121f885d43e1b4d
SHA512 6f678850823a1e86554f8871e0ebc6bf7d1573b827de82f8a436510c5ce12af09a6c3b6940ee75e04e1fca123ae7f380d73e68e9baa286baee7c09f51a70f2c8
MD5 SHA1 SHA512

Submit Download

5Yw7RONjUI.bat

Path C:\Users\Admin\AppData\Local\Temp\5Yw7RONjUI.bat
Size 200B
SHA256 000062f6df69fd2157e263b9e09dd9295bd379bf88fa3f95f9d171330f3cd524
MD5 9debf7fcfee462fbfdb25802c043ec0a
SHA1 a15dc2f306432c6ca314ef5c032b98cd5173b46d
SHA512 4bd9690fc5d5b3f06ca101f9ccaa65591bbbbf4f26c86ef179b5d904b204f00189578333a55276c3d5e0aeb5d765c4ca8169aecb93900f9df7fff1f11a715955
MD5 SHA1 SHA512

Submit Download

BHs9KC1JDp.bat

Path C:\Users\Admin\AppData\Local\Temp\BHs9KC1JDp.bat
Size 200B
SHA256 3ef3fc9ff214c1b7b16292ace23b0409e72a79660401152f9c279466d2977085
MD5 5b9a94567ec4a29bb42ab14e80a93148
SHA1 567e81492e38807f620c29d6e528bc5ea6dc6c19
SHA512 0a78609b646ecef90403a499f23f4d07bee10b18067f13c79d763a1b35deb785256f6cd3a7dd81df666fd6e32a93579dfd8fcd992de93df5faf57464dbd5053e
MD5 SHA1 SHA512

Submit Download

J6LEBq1ChC.bat

Path C:\Users\Admin\AppData\Local\Temp\J6LEBq1ChC.bat
Size 200B
SHA256 452dc735f21c9d9bea3f4251816bd0c1bf19646cd3977f0fb6db556714a4286c
MD5 6991805e076abcb77adf7ec319a4eb12
SHA1 5f07040caa8164bea4925b69df9dec16a6a51309
SHA512 92f1aaa836d59abaeac51788def5cc9fd55c698e5e53579c172a19646050adb217f827c0f181695b089a361cb94cd5142e397a7dcb1cd332bf581b6ac4c06a3e
MD5 SHA1 SHA512

Submit Download

LBVLNHYHv1.bat

Path C:\Users\Admin\AppData\Local\Temp\LBVLNHYHv1.bat
Size 200B
SHA256 fe3d3c3ee2346cb1ab3f328ad8e90aed76dd57471ff2438e1ddfd59ec96c5814
MD5 6aca10bd561bb72012a19349fd348b25
SHA1 7086a999d3aa94e91b0dae90e7c97fac2549689f
SHA512 cacf212434ff96eced753b13f6a12604b2609f6120f5917df6688ee339875ed303a0978d2e57cb996554052ab84df02779a870a97d86a1a9cf4fba765d64260e
MD5 SHA1 SHA512

Submit Download

NDsGBfOUR3.bat

Path C:\Users\Admin\AppData\Local\Temp\NDsGBfOUR3.bat
Size 200B
SHA256 bd006656f9a3fc19bd332ac42e75c02206dc56f8b6b524a244464d215e1e7490
MD5 2cf0fba24f1ac3b8b050c0e8307c0d91
SHA1 e219b4635fa3a721ca8bbab9b7a2431bba1b303b
SHA512 d577fa2eaee8c295fd5d8a4130c7bd07afbc351c6500cae1e26381901b9734d8809df6c3bfbf7c28740311e8fa63279f82df22a04505ed33e59970c7f86e2904
MD5 SHA1 SHA512

Submit Download

TA6UjH3MJQ.bat

Path C:\Users\Admin\AppData\Local\Temp\TA6UjH3MJQ.bat
Size 200B
SHA256 4483aa8fc8340d3e6e7565593d7142db80f52188fb0d33a79b40f4b081380df4
MD5 5ad00f880a53b2a69889ca9fd9226dc2
SHA1 84b965c1bd814e7dc3d134168f8f3d6030877ee2
SHA512 cf22f1779fc6cd6edd70bd55351597e6fb613715dcd66c827198dc0bb64e0caafbb5d0eec49e43745c2414f2afc8571632c75ed1500d34ca5f2524dcf6545152
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_l1vdkq3u.2we.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1vdkq3u.2we.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tiHtiEmsSK.bat

Path C:\Users\Admin\AppData\Local\Temp\tiHtiEmsSK.bat
Size 200B
SHA256 16662358d8ad6658c5db2c713990766f73bc8cfd882f9ef375f464a36af4e005
MD5 c9596f7540fd03650ceb8bd0e4f87180
SHA1 f605feddd4cbd12d1c7e80d1623dfda144823184
SHA512 c4cd25996d9f37afd91a156f8b9fb34090140379cbd471baa426aee3535169fa20c4663cc2dc0cdfe342126829767d0d2012af02cc618c8fbf7a04635fdb2a33
MD5 SHA1 SHA512

Submit Download

vkfoWdc5zM.bat

Path C:\Users\Admin\AppData\Local\Temp\vkfoWdc5zM.bat
Size 200B
SHA256 cf919ecdf05dad115da0767543c341f7329b5f5ce0ac2fcae1a34e467459deca
MD5 06814c6b15455ad66fa4f7d8c16dae27
SHA1 b1f62eacd2aa2bbc5e5f357428934f212ac3d938
SHA512 7d5c188f77ad50592be03f64cb3842b39eae322645f2726738b1d7a4a08986c4114ce90620efed876d05b4cff45f44df8e18228f1555f9058df6b6532d8b192c
MD5 SHA1 SHA512

Submit Download

xghrCifyI9.bat

Path C:\Users\Admin\AppData\Local\Temp\xghrCifyI9.bat
Size 200B
SHA256 f4f3a51b6816f33e2a60fa2b15ff99977ccea29611afeb7bb3471a73b1c3638d
MD5 08e7c6c46a4139d002b054c7eff5c9c0
SHA1 36213fcbfcfbe8bc72674823e1a84a74632baab5
SHA512 0cc160a550d1eda6c2e9110e3eec5d130bc32863b1b89fccfb735e4a913402c8eb94a181aaa2af0d286e3b58af3870a99c50acf2e0b332b594d716821f04ebb3
MD5 SHA1 SHA512

Submit Download

1zu9dW.bat

Path C:\providercommon\1zu9dW.bat
Size 36B
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
MD5 SHA1 SHA512

Submit Download

DllCommonsvc.exe

Path C:\providercommon\DllCommonsvc.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

yTUdeXjbLOhnrN32dgrxVg.vbe

Path C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
Size 197B
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478
MD5 SHA1 SHA512

Submit Download

memory/1232-14-0x0000000002370000-0x0000000002382000-memory.dmp

Download

memory/1232-13-0x0000000000050000-0x0000000000160000-memory.dmp

Download

memory/1232-12-0x00007FFAA25B3000-0x00007FFAA25B5000-memory.dmp

Download

memory/1232-15-0x00000000023A0000-0x00000000023AC000-memory.dmp

Download

memory/1232-16-0x0000000002380000-0x000000000238C000-memory.dmp

Download

memory/1232-17-0x0000000002390000-0x000000000239C000-memory.dmp

Download

memory/1920-126-0x000000001D080000-0x000000001D229000-memory.dmp

Download

memory/2340-153-0x000000001ADF0000-0x000000001AE02000-memory.dmp

Download

memory/3004-119-0x000000001DE90000-0x000000001E039000-memory.dmp

Download

memory/3008-44-0x000001DCF40D0000-0x000001DCF40F2000-memory.dmp

Download