dcrat | 504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4.exe
Size

1.3MB
MD5

ee2939e6b43088446c1cea11b1d260b4
SHA1

6ec0bbd3429a763f74a412c1ada9b87a931a31ac
SHA256

504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4
SHA512

34eae169d468692c5c7971eb99b6f00f6943e0122ada5c37f820abf4c4872de903e93810081e3f4adc357b29e7da9d13a1962de423ead5d98d1a3b734d69fadc
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCz:UbA30GnzV/q+DnsXgl

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	1060	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	1060	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cbe-10.dat	dcrat
behavioral2/memory/3992-13-0x0000000000D80000-0x0000000000E90000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1548	powershell.exe
4900	powershell.exe
4384	powershell.exe
1048	powershell.exe
1248	powershell.exe
2716	powershell.exe
3368	powershell.exe
1512	powershell.exe

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sihost.exe

Executes dropped EXE 17 IoCs

pid	Process
3992	DllCommonsvc.exe
4144	sihost.exe
3688	sihost.exe
4164	sihost.exe
1512	sihost.exe
3044	sihost.exe
2836	sihost.exe
4408	sihost.exe
1396	sihost.exe
2980	sihost.exe
4776	sihost.exe
3532	sihost.exe
3696	sihost.exe
2992	sihost.exe
4144	sihost.exe
3056	sihost.exe
512	sihost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
40	raw.githubusercontent.com
49	raw.githubusercontent.com
56	raw.githubusercontent.com
58	raw.githubusercontent.com
60	raw.githubusercontent.com
15	raw.githubusercontent.com
34	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
46	raw.githubusercontent.com
59	raw.githubusercontent.com
21	raw.githubusercontent.com
47	raw.githubusercontent.com
48	raw.githubusercontent.com
57	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	sihost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1192	schtasks.exe
4580	schtasks.exe
4896	schtasks.exe
4556	schtasks.exe
4200	schtasks.exe
1748	schtasks.exe
1052	schtasks.exe
2628	schtasks.exe
4056	schtasks.exe
4264	schtasks.exe
4144	schtasks.exe
1444	schtasks.exe
4884	schtasks.exe
864	schtasks.exe
3976	schtasks.exe
3516	schtasks.exe
2288	schtasks.exe
4768	schtasks.exe
5116	schtasks.exe
4876	schtasks.exe
1860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3992	DllCommonsvc.exe
3992	DllCommonsvc.exe
3992	DllCommonsvc.exe
2716	powershell.exe
1248	powershell.exe
1248	powershell.exe
4384	powershell.exe
4384	powershell.exe
4900	powershell.exe
4900	powershell.exe
1048	powershell.exe
1048	powershell.exe
1548	powershell.exe
1548	powershell.exe
3368	powershell.exe
3368	powershell.exe
1048	powershell.exe
1512	powershell.exe
1512	powershell.exe
1512	powershell.exe
2716	powershell.exe
2716	powershell.exe
1248	powershell.exe
4384	powershell.exe
1548	powershell.exe
4900	powershell.exe
3368	powershell.exe
4144	sihost.exe
3688	sihost.exe
4164	sihost.exe
1512	sihost.exe
3044	sihost.exe
2836	sihost.exe
4408	sihost.exe
1396	sihost.exe
2980	sihost.exe
4776	sihost.exe
3532	sihost.exe
3696	sihost.exe
2992	sihost.exe
4144	sihost.exe
3056	sihost.exe
512	sihost.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3992	DllCommonsvc.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	4144	sihost.exe
Token: SeDebugPrivilege	3688	sihost.exe
Token: SeDebugPrivilege	4164	sihost.exe
Token: SeDebugPrivilege	1512	sihost.exe
Token: SeDebugPrivilege	3044	sihost.exe
Token: SeDebugPrivilege	2836	sihost.exe
Token: SeDebugPrivilege	4408	sihost.exe
Token: SeDebugPrivilege	1396	sihost.exe
Token: SeDebugPrivilege	2980	sihost.exe
Token: SeDebugPrivilege	4776	sihost.exe
Token: SeDebugPrivilege	3532	sihost.exe
Token: SeDebugPrivilege	3696	sihost.exe
Token: SeDebugPrivilege	2992	sihost.exe
Token: SeDebugPrivilege	4144	sihost.exe
Token: SeDebugPrivilege	3056	sihost.exe
Token: SeDebugPrivilege	512	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 4940	32	504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4.exe	84
PID 32 wrote to memory of 4940	32	504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4.exe	84
PID 32 wrote to memory of 4940	32	504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4.exe	84
PID 4940 wrote to memory of 2316	4940	WScript.exe	85
PID 4940 wrote to memory of 2316	4940	WScript.exe	85
PID 4940 wrote to memory of 2316	4940	WScript.exe	85
PID 2316 wrote to memory of 3992	2316	cmd.exe	87
PID 2316 wrote to memory of 3992	2316	cmd.exe	87
PID 3992 wrote to memory of 4900	3992	DllCommonsvc.exe	110
PID 3992 wrote to memory of 4900	3992	DllCommonsvc.exe	110
PID 3992 wrote to memory of 4384	3992	DllCommonsvc.exe	111
PID 3992 wrote to memory of 4384	3992	DllCommonsvc.exe	111
PID 3992 wrote to memory of 1048	3992	DllCommonsvc.exe	112
PID 3992 wrote to memory of 1048	3992	DllCommonsvc.exe	112
PID 3992 wrote to memory of 1248	3992	DllCommonsvc.exe	113
PID 3992 wrote to memory of 1248	3992	DllCommonsvc.exe	113
PID 3992 wrote to memory of 2716	3992	DllCommonsvc.exe	114
PID 3992 wrote to memory of 2716	3992	DllCommonsvc.exe	114
PID 3992 wrote to memory of 3368	3992	DllCommonsvc.exe	115
PID 3992 wrote to memory of 3368	3992	DllCommonsvc.exe	115
PID 3992 wrote to memory of 1512	3992	DllCommonsvc.exe	116
PID 3992 wrote to memory of 1512	3992	DllCommonsvc.exe	116
PID 3992 wrote to memory of 1548	3992	DllCommonsvc.exe	117
PID 3992 wrote to memory of 1548	3992	DllCommonsvc.exe	117
PID 3992 wrote to memory of 1996	3992	DllCommonsvc.exe	126
PID 3992 wrote to memory of 1996	3992	DllCommonsvc.exe	126
PID 1996 wrote to memory of 640	1996	cmd.exe	128
PID 1996 wrote to memory of 640	1996	cmd.exe	128
PID 1996 wrote to memory of 4144	1996	cmd.exe	129
PID 1996 wrote to memory of 4144	1996	cmd.exe	129
PID 4144 wrote to memory of 3388	4144	sihost.exe	130
PID 4144 wrote to memory of 3388	4144	sihost.exe	130
PID 3388 wrote to memory of 768	3388	cmd.exe	132
PID 3388 wrote to memory of 768	3388	cmd.exe	132
PID 3388 wrote to memory of 3688	3388	cmd.exe	133
PID 3388 wrote to memory of 3688	3388	cmd.exe	133
PID 3688 wrote to memory of 512	3688	sihost.exe	137
PID 3688 wrote to memory of 512	3688	sihost.exe	137
PID 512 wrote to memory of 1712	512	cmd.exe	139
PID 512 wrote to memory of 1712	512	cmd.exe	139
PID 512 wrote to memory of 4164	512	cmd.exe	144
PID 512 wrote to memory of 4164	512	cmd.exe	144
PID 4164 wrote to memory of 4432	4164	sihost.exe	145
PID 4164 wrote to memory of 4432	4164	sihost.exe	145
PID 4432 wrote to memory of 2168	4432	cmd.exe	147
PID 4432 wrote to memory of 2168	4432	cmd.exe	147
PID 4432 wrote to memory of 1512	4432	cmd.exe	149
PID 4432 wrote to memory of 1512	4432	cmd.exe	149
PID 1512 wrote to memory of 3020	1512	sihost.exe	150
PID 1512 wrote to memory of 3020	1512	sihost.exe	150
PID 3020 wrote to memory of 3456	3020	cmd.exe	152
PID 3020 wrote to memory of 3456	3020	cmd.exe	152
PID 3020 wrote to memory of 3044	3020	cmd.exe	153
PID 3020 wrote to memory of 3044	3020	cmd.exe	153
PID 3044 wrote to memory of 4368	3044	sihost.exe	154
PID 3044 wrote to memory of 4368	3044	sihost.exe	154
PID 4368 wrote to memory of 2120	4368	cmd.exe	156
PID 4368 wrote to memory of 2120	4368	cmd.exe	156
PID 4368 wrote to memory of 2836	4368	cmd.exe	157
PID 4368 wrote to memory of 2836	4368	cmd.exe	157
PID 2836 wrote to memory of 4876	2836	sihost.exe	158
PID 2836 wrote to memory of 4876	2836	sihost.exe	158
PID 4876 wrote to memory of 2140	4876	cmd.exe	160
PID 4876 wrote to memory of 2140	4876	cmd.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4.exe
"C:\Users\Admin\AppData\Local\Temp\504d5f8b0b7e318681bf1abc35ae32cfcb3e880499fba0950fd5d26c1bdb45b4.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:32
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\de-DE\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LY8zxwcBxN.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1996
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:640
      - C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:768
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:512
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1712
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ww4YVzclJm.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2168
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ys6bB5gfdY.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3456
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3j9hYFnRH7.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2120
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5fBkFKqKat.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2140
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FaowIOOII5.bat"
        19⤵
        
        PID:2356
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1804
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat"
        21⤵
        
        PID:3940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4548
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5fBkFKqKat.bat"
        23⤵
        
        PID:2460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2716
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat"
        25⤵
        
        PID:5044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1660
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0xFiNVDkrN.bat"
        27⤵
        
        PID:3684
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4944
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EVfp7xrD4G.bat"
        29⤵
        
        PID:4308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:2332
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dCyIaH4v8D.bat"
        31⤵
        
        PID:4876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:1860
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ww4YVzclJm.bat"
        33⤵
        
        PID:944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:3592
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat"
        35⤵
        
        PID:3940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        36⤵
        
        PID:940
        
        C:\Users\Public\sihost.exe
        
        "C:\Users\Public\sihost.exe"
        36⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Users\Public\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Users\Public\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\All Users\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\0xFiNVDkrN.bat

Filesize
191B

MD5
538a0f49ce14870229745a444e780b40

SHA1
3205c5ea9b62deea61176db1f65c0bf0f4bc5532

SHA256
d6e5b4112b658e81ec422c27f2b08351a0bbe013788e8bb2bfe2974c37679543

SHA512
feb57f56db082b6510d8515314b54f00c116860f36b68c97b5c4fb3c81be9def1e0ce3b453fa55a85b2d5ccdbba09ae5a0e718bd050b03efdbe21e8627eed107

Download Submit
C:\Users\Admin\AppData\Local\Temp\3j9hYFnRH7.bat

Filesize
191B

MD5
768f74b61b2598c498699ea50fe400e3

SHA1
3c964ebce567574c559c6436656765e220c72257

SHA256
699ac9da9642e712ef811b71d9cfe189041f6e5f8bae0a88063e92d124d61afc

SHA512
eada0312738c80aba03fb3a839bb67579e90a07250b8d63af3f41fc7dc831c9f2bb09e8cb83f44152c015d4e6332b672f8b0c618e54ac7dc1929ef5cd40c23ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fBkFKqKat.bat

Filesize
191B

MD5
219628a77d2951e3d1a213d64b3790a3

SHA1
4f6e3dd9f72f8a8458f8db9a50ead8af51385be3

SHA256
3ae1443eb25f6fbe75c00e3ece60e30b87d3c23c2eed55aa38535da8d99e0d83

SHA512
1914b886b0cfbbfd49fdbc19e1e1f7562fde2f71febadef46f03e6fa2cc789d05beb572280aca60a797ac5a1cc0b45396e4d305df9c819a785fc4fef50a88287

Download Submit
C:\Users\Admin\AppData\Local\Temp\EVfp7xrD4G.bat

Filesize
191B

MD5
4df52c568d44f95c77f8759f66e80c37

SHA1
fd2f4cd8c218f06a5756a54acaaf26e4aafb2de7

SHA256
76d5ba18d38a96137f5c8dfb026020f01641d84730b9adf8e128016dfb06bee8

SHA512
a87e32a503478d80d6b94b9d3d2bffc8c0be880f91f82e9b6ecce2ee8e231b3e4e7496fb14dd30fb203a061475248d970a13a3cf8ba3c3c2aacc35da5c0cf79a

Download Submit
C:\Users\Admin\AppData\Local\Temp\FaowIOOII5.bat

Filesize
191B

MD5
120cd634d83aa5180949343d8d253522

SHA1
48d1fb5937ac9e5b60f61796bc69138cdb0ac944

SHA256
4643e910fd1847e0fa256d3359aec02006207b698b4b04afd53baedaddf40b2c

SHA512
3d6b566a3aa8e52abe5367199017e1ac3f119515a7d09221cd49e14b19489ec7885c7d907ddb350185faa871ac95907fe00e55398209e273ff85158543e35fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\LY8zxwcBxN.bat

Filesize
191B

MD5
ffdadc2fa1d4e95ec501345c366ad492

SHA1
88b63665d594acf1a30782d3f17dc3e6c21a6b88

SHA256
8a83110bbb4aa76742e6803d74faa4b1530b79f836b1a211318f2c1f3db9b6e2

SHA512
7630587bea108800bd313eaed7062ea7998692313e50c26d5bfa4f9902b6d8bbd78e647136fe1067fe15071437ac9b28d74d1099466a09bfc357a19827fc7e73

Download Submit
C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat

Filesize
191B

MD5
8babe8be75a0a82c4a068228253e1d7c

SHA1
6f85c547e69297b8c463441701cc8c59d0c27e71

SHA256
51c6b57940aa3dae00d6feb4172419f558aafdd4ccee4fa55ec62bc0cc804280

SHA512
b7a75cdeca8a1f88eba162acfd8dab4f6853a826464aee1d69dcd970a5a8f16df71dd1564339c2c806816233520f65c0345637f68c3f276a0acc9ba01f39b26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ox0zm5jq.olx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dCyIaH4v8D.bat

Filesize
191B

MD5
e6d586499d4b0cb01eaf3272a0792df4

SHA1
1514e4a3d957e069a10025cd43545fd2b882c4d5

SHA256
9a52888f210faab46e29a4631c0d559156aa715e134f018a0aac96240fedec9d

SHA512
41571fc5588a6f1c342f1115c26d7b1620fbb79c528737c344910cc121bac505c4d8ea216c856f73e3092a8ea186c2345b928356b86386d99b9c456bbb5b9d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat

Filesize
191B

MD5
35e07dcd71837a070252bbc33f5efd63

SHA1
10a82cf8328d67e66a271b58df84e0a100b7798c

SHA256
7f1a4d01ae54f8b82437da1af4c592682c0d3dd88889765523fa741b60668e99

SHA512
c509947903775109d7ee0a539035ab743d6321d9f7f763fa04d0167f9a81248c01952ed6a71a557470b3431f5cd19cf8850d89e8f845aa65c21984528ba2c05f

Download Submit
C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat

Filesize
191B

MD5
2628411535f87dc5e9b53e8435b8ce6e

SHA1
d8371b3aedacd67710fa5f8dbad2d213ad09a5f9

SHA256
3d2bedd7b4f61d55c04ce9c2cd77e605c5789e99509d71abefb3dcf139f2ab84

SHA512
436cd4444c53446b731a89ac682df0dac3ba3cf09a16f6f491b743e0768144e4db758a46c2521f638a21707d61be2d32a3fcafa2471b4a90257f9d4bbf4f7bf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat

Filesize
191B

MD5
595ba5027d3058fed7cc760326e2caf9

SHA1
7c9bc2f89787a2f038331217f01628839eabdaa1

SHA256
fbba828cf385aeeeab2c5d9243cc5b556c4a590cdc8f9dfc2ec08d0eeff5c07a

SHA512
8f6dd7132a03f3df643623118e8e60220e5bef6db6514744bb47aadde2ae55e766d55ba4d1bc1befd92a5d89da83deddc1f0489d093dbeba88de93020158ff38

Download Submit
C:\Users\Admin\AppData\Local\Temp\ww4YVzclJm.bat

Filesize
191B

MD5
4c4200c889798c59e81ed4bd3a4e7cc2

SHA1
3ebba61179489eafca51e7c31f7f20d827a1264f

SHA256
97a0e018ebffa17b4db16d1324837e558011bb7da0a37b427e802a68fb6f54a0

SHA512
06e26dd96557457f2b7773299ed6ae323a95121eba7aa1bb39e6a22eae992546482f8700829e7c378ab54690a0a2448156ca213290de80fc834141742a222385

Download Submit
C:\Users\Admin\AppData\Local\Temp\ys6bB5gfdY.bat

Filesize
191B

MD5
3665b96b06684a49673c194c44f2dd17

SHA1
a616c5234d4552a72960f23daba16ae84ea8569c

SHA256
2f56bfa493bb31b8ebb6ca33dbc9b29720ce8867c3309b7929eb6387183c5810

SHA512
3329b2c1e60763a75cfefc7f382b969b37b83782d83f7a0d3e3f9c3c0e8ba6e3c28eb80e1e2b6f451cd51d3283c0a2084555e2044699aa091ac60c5911c11c22

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1248-48-0x000001A929240000-0x000001A929262000-memory.dmp

Filesize
136KB

Download
memory/1512-153-0x0000000001640000-0x0000000001652000-memory.dmp

Filesize
72KB

Download
memory/2836-167-0x0000000001020000-0x0000000001032000-memory.dmp

Filesize
72KB

Download
memory/2980-187-0x0000000001700000-0x0000000001712000-memory.dmp

Filesize
72KB

Download
memory/3044-160-0x0000000000A20000-0x0000000000A32000-memory.dmp

Filesize
72KB

Download
memory/3532-200-0x0000000002C50000-0x0000000002C62000-memory.dmp

Filesize
72KB

Download
memory/3688-144-0x000000001C3A0000-0x000000001C441000-memory.dmp

Filesize
644KB

Download
memory/3992-17-0x0000000002FF0000-0x0000000002FFC000-memory.dmp

Filesize
48KB

Download
memory/3992-16-0x0000000002FE0000-0x0000000002FEC000-memory.dmp

Filesize
48KB

Download
memory/3992-15-0x0000000002FD0000-0x0000000002FDC000-memory.dmp

Filesize
48KB

Download
memory/3992-14-0x0000000002FC0000-0x0000000002FD2000-memory.dmp

Filesize
72KB

Download
memory/3992-13-0x0000000000D80000-0x0000000000E90000-memory.dmp

Filesize
1.1MB

Download
memory/3992-12-0x00007FFBC4C43000-0x00007FFBC4C45000-memory.dmp

Filesize
8KB

Download
memory/4144-136-0x000000001BB20000-0x000000001BC22000-memory.dmp

Filesize
1.0MB

Download
memory/4408-174-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download