dcrat | 88414350df955ae0d1c3e062ee97a4da79361ec71711c4c40273fa70a4ccce53

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe
Size

2.2MB
MD5

92d29106be881759ef6f045a3415137d
SHA1

9b307b4b98851c4325a1f2746c7827a0d14c7e36
SHA256

b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0
SHA512

43b526bd521ac72688dc7670c9c9ce323b39675620a0bf202d783906ac650fdc1bbefeb5876f97c5fcf525e6c5d39cc4b29ffd43acd4560baf0745126c5eec8e
SSDEEP

49152:IBJ+h0kcmcdp/caMMlawkBXRInaKYRouPbWGQ2L:yQhbcmcfM/N1RSavoujWHk

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\winlogon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\", \"C:\\msproviderBrokerMonitornet\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\", \"C:\\msproviderBrokerMonitornet\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Mail\\explorer.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\", \"C:\\msproviderBrokerMonitornet\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows Mail\\explorer.exe\", \"C:\\msproviderBrokerMonitornet\\WinPerfcommon.exe\""	WinPerfcommon.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	1192	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1192	schtasks.exe	35

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1152	powershell.exe
864	powershell.exe
2044	powershell.exe
2964	powershell.exe
1640	powershell.exe
1868	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2336	WinPerfcommon.exe
2856	dllhost.exe
1280	dllhost.exe
1872	dllhost.exe
1344	dllhost.exe
2324	dllhost.exe
2920	dllhost.exe
2972	dllhost.exe
1532	dllhost.exe
2448	dllhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2872	cmd.exe
2872	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\msproviderBrokerMonitornet\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\msproviderBrokerMonitornet\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\msproviderBrokerMonitornet\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\winlogon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\winlogon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Mail\\explorer.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Mail\\explorer.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\msproviderBrokerMonitornet\\WinPerfcommon.exe\""	WinPerfcommon.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCA2475810A1E40AD8EDF5EF124F5228.TMP	csc.exe
File created	\??\c:\Windows\System32\_f1q_j.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\explorer.exe	WinPerfcommon.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\explorer.exe	WinPerfcommon.exe
File created	C:\Program Files (x86)\Windows Mail\7a0fd90576e088	WinPerfcommon.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe	WinPerfcommon.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\6cb0b6c459d5d3	WinPerfcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
592	PING.EXE
1980	PING.EXE
2688	PING.EXE
1936	PING.EXE
3012	PING.EXE
1364	PING.EXE

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
2688	PING.EXE
1936	PING.EXE
3012	PING.EXE
1364	PING.EXE
592	PING.EXE
1980	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
444	schtasks.exe
1300	schtasks.exe
2224	schtasks.exe
1952	schtasks.exe
2952	schtasks.exe
1872	schtasks.exe
2296	schtasks.exe
2636	schtasks.exe
1600	schtasks.exe
2456	schtasks.exe
2012	schtasks.exe
1144	schtasks.exe
1904	schtasks.exe
2076	schtasks.exe
1080	schtasks.exe
2052	schtasks.exe
1340	schtasks.exe
1648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe
2336	WinPerfcommon.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	WinPerfcommon.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	2856	dllhost.exe
Token: SeDebugPrivilege	1280	dllhost.exe
Token: SeDebugPrivilege	1872	dllhost.exe
Token: SeDebugPrivilege	1344	dllhost.exe
Token: SeDebugPrivilege	2324	dllhost.exe
Token: SeDebugPrivilege	2920	dllhost.exe
Token: SeDebugPrivilege	2972	dllhost.exe
Token: SeDebugPrivilege	1532	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2384	2380	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe	30
PID 2380 wrote to memory of 2384	2380	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe	30
PID 2380 wrote to memory of 2384	2380	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe	30
PID 2380 wrote to memory of 2384	2380	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe	30
PID 2384 wrote to memory of 2872	2384	WScript.exe	32
PID 2384 wrote to memory of 2872	2384	WScript.exe	32
PID 2384 wrote to memory of 2872	2384	WScript.exe	32
PID 2384 wrote to memory of 2872	2384	WScript.exe	32
PID 2872 wrote to memory of 2336	2872	cmd.exe	34
PID 2872 wrote to memory of 2336	2872	cmd.exe	34
PID 2872 wrote to memory of 2336	2872	cmd.exe	34
PID 2872 wrote to memory of 2336	2872	cmd.exe	34
PID 2336 wrote to memory of 1936	2336	WinPerfcommon.exe	39
PID 2336 wrote to memory of 1936	2336	WinPerfcommon.exe	39
PID 2336 wrote to memory of 1936	2336	WinPerfcommon.exe	39
PID 1936 wrote to memory of 1632	1936	csc.exe	41
PID 1936 wrote to memory of 1632	1936	csc.exe	41
PID 1936 wrote to memory of 1632	1936	csc.exe	41
PID 2336 wrote to memory of 1868	2336	WinPerfcommon.exe	57
PID 2336 wrote to memory of 1868	2336	WinPerfcommon.exe	57
PID 2336 wrote to memory of 1868	2336	WinPerfcommon.exe	57
PID 2336 wrote to memory of 1152	2336	WinPerfcommon.exe	58
PID 2336 wrote to memory of 1152	2336	WinPerfcommon.exe	58
PID 2336 wrote to memory of 1152	2336	WinPerfcommon.exe	58
PID 2336 wrote to memory of 1640	2336	WinPerfcommon.exe	59
PID 2336 wrote to memory of 1640	2336	WinPerfcommon.exe	59
PID 2336 wrote to memory of 1640	2336	WinPerfcommon.exe	59
PID 2336 wrote to memory of 2964	2336	WinPerfcommon.exe	60
PID 2336 wrote to memory of 2964	2336	WinPerfcommon.exe	60
PID 2336 wrote to memory of 2964	2336	WinPerfcommon.exe	60
PID 2336 wrote to memory of 2044	2336	WinPerfcommon.exe	61
PID 2336 wrote to memory of 2044	2336	WinPerfcommon.exe	61
PID 2336 wrote to memory of 2044	2336	WinPerfcommon.exe	61
PID 2336 wrote to memory of 864	2336	WinPerfcommon.exe	62
PID 2336 wrote to memory of 864	2336	WinPerfcommon.exe	62
PID 2336 wrote to memory of 864	2336	WinPerfcommon.exe	62
PID 2336 wrote to memory of 3020	2336	WinPerfcommon.exe	69
PID 2336 wrote to memory of 3020	2336	WinPerfcommon.exe	69
PID 2336 wrote to memory of 3020	2336	WinPerfcommon.exe	69
PID 3020 wrote to memory of 2448	3020	cmd.exe	71
PID 3020 wrote to memory of 2448	3020	cmd.exe	71
PID 3020 wrote to memory of 2448	3020	cmd.exe	71
PID 3020 wrote to memory of 592	3020	cmd.exe	72
PID 3020 wrote to memory of 592	3020	cmd.exe	72
PID 3020 wrote to memory of 592	3020	cmd.exe	72
PID 3020 wrote to memory of 2856	3020	cmd.exe	73
PID 3020 wrote to memory of 2856	3020	cmd.exe	73
PID 3020 wrote to memory of 2856	3020	cmd.exe	73
PID 2856 wrote to memory of 1820	2856	dllhost.exe	74
PID 2856 wrote to memory of 1820	2856	dllhost.exe	74
PID 2856 wrote to memory of 1820	2856	dllhost.exe	74
PID 1820 wrote to memory of 308	1820	cmd.exe	76
PID 1820 wrote to memory of 308	1820	cmd.exe	76
PID 1820 wrote to memory of 308	1820	cmd.exe	76
PID 1820 wrote to memory of 1980	1820	cmd.exe	77
PID 1820 wrote to memory of 1980	1820	cmd.exe	77
PID 1820 wrote to memory of 1980	1820	cmd.exe	77
PID 1820 wrote to memory of 1280	1820	cmd.exe	78
PID 1820 wrote to memory of 1280	1820	cmd.exe	78
PID 1820 wrote to memory of 1280	1820	cmd.exe	78
PID 1280 wrote to memory of 1624	1280	dllhost.exe	79
PID 1280 wrote to memory of 1624	1280	dllhost.exe	79
PID 1280 wrote to memory of 1624	1280	dllhost.exe	79
PID 1624 wrote to memory of 2228	1624	cmd.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe
"C:\Users\Admin\AppData\Local\Temp\b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\msproviderBrokerMonitornet\qGDN1Ee4B98z7IBsvEaYenHfp3i4NGluh1QU7ALIT.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\msproviderBrokerMonitornet\rS0XRrLecpgQD85mPzoGJptpB8S2GwiBTdu9z4xSSrCX90wlqwqwnpzpgY0I.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\msproviderBrokerMonitornet\WinPerfcommon.exe
      "C:\msproviderBrokerMonitornet/WinPerfcommon.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qokc0paz\qokc0paz.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1936
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FA8.tmp" "c:\Windows\System32\CSCA2475810A1E40AD8EDF5EF124F5228.TMP"
        6⤵
        
        PID:1632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\msproviderBrokerMonitornet\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\msproviderBrokerMonitornet\WinPerfcommon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhapUayLwp.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3020
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2448
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:592
      - C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6ODIA3Zf31.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:308
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1980
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8MPHA9c1U6.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2228
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2216
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ECvQfnJznV.bat"
        11⤵
        
        PID:1056
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2932
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2688
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gtOlnDcdUa.bat"
        13⤵
        
        PID:2964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2352
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2508
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sMcwJl1juU.bat"
        15⤵
        
        PID:2376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:584
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4op7oIQpKO.bat"
        17⤵
        
        PID:1908
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1700
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1936
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HSh65PBXsw.bat"
        19⤵
        
        PID:2216
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3044
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3012
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SrnQwv5hL3.bat"
        21⤵
        
        PID:924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2960
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1364
        
        C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe
        
        "C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe"
        22⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2rRAYV41jN.bat"
        23⤵
        
        PID:1080
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2352
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\msproviderBrokerMonitornet\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\msproviderBrokerMonitornet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\msproviderBrokerMonitornet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 7 /tr "'C:\msproviderBrokerMonitornet\WinPerfcommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommon" /sc ONLOGON /tr "'C:\msproviderBrokerMonitornet\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 11 /tr "'C:\msproviderBrokerMonitornet\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4op7oIQpKO.bat

Filesize
188B

MD5
fd0834aad287b7cbc8f626219ca0a83c

SHA1
5d634247abc2a86cb92693829ecbc06514d4d4c8

SHA256
fb6f6501d3e6a132e5df4f71fab051754cb3520abb580580727ccf826cb17c7b

SHA512
2471d7ff20dd79447a4e554c4d015d73140311e0c955f2df030888485c7e47942ca8b02cbc50f409e0b3c10be2bca0656d2d40342c033a432f10914322c7ef7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ODIA3Zf31.bat

Filesize
188B

MD5
ccae64bc8131cec9d42314e3c58b4706

SHA1
58eca524b259d9982b2dfd18e17eefd11a7fd714

SHA256
cec787ba9682380a8586adedc30cb2a720a9dd0ca2628bbd712f7118a1659839

SHA512
db5b4dd177a160a721ad465b03cc001fb504f0504428f192c6f9a5ced3105a9ba744b509f31c8cf9469dd85debd6d1bf3577130c643873b1b079e2a5773c1491

Download Submit
C:\Users\Admin\AppData\Local\Temp\8MPHA9c1U6.bat

Filesize
236B

MD5
ee03636924cda6aa43eecfbb8a607143

SHA1
b1677be3c34e8819bf4f04e1d02932b7369c81f1

SHA256
aff89e6a76a78036c5676e6085acc21158bc3f72a9744911fc310f5209609971

SHA512
f586c7a4821533b535e7093bf2cbd29dda0e0042becd6f2a8baa027cd9fa63da7d05de8a4a7ee3e12ab8f1939bd470682b9dc1e9c7969967b370c743359d0e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\ECvQfnJznV.bat

Filesize
188B

MD5
10d1514f86b10bf0d67a18440ba384d2

SHA1
58c9954745505691705c858123f130d1c2dc9886

SHA256
4974e540f89b26c02a58dd06f1640c081286701ea8c87da950eae08e346770e4

SHA512
437f829c91495486818d949541b17fceada71f5ab03bb2a10b14f66f882f34fe9e543946b59d327a4aaf7747e230ce2d4a07e8dae69e7ec3d937075946632efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HSh65PBXsw.bat

Filesize
188B

MD5
5ea9b4df31f9ef76b4af47dbe64c4b63

SHA1
ef2bad8f4921e8855478f8b24264a9f38c11d8cb

SHA256
88664411c353f2d63c7a72fa7e91bba809e26c7ed98e42ad84e021dda95ad46d

SHA512
99b677f75e0c7b70fd0c55c56ce82f3c696fd0084a50c77c3c5da82883cd198cae3fc83041926ab0cd9fb839f9b8993ab2086302cfa8f06c5b8652dc9cca3c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2FA8.tmp

Filesize
1KB

MD5
837bfd695fe395f74ce67d91276a3b90

SHA1
538326e5691d7e7112ba886a5c447b49b7243fde

SHA256
4a9036d338a32cbcec5d5e26b410191ec39e2a504e40e0264cef6a064f631cb7

SHA512
0c5f6fbd3b83228b970fc5ad70c661cd215319151fcafc4e5e244b1eccc22dca3784906310de57a997dc7e10e4bf530152a40be01ec5b60263b340e24a8b84e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SrnQwv5hL3.bat

Filesize
188B

MD5
8efe429fa4d9e006d46763addc5cbcf9

SHA1
4a04ffc22ce3c6583bef511c50f4ca2eb3d4817f

SHA256
811d7f25378bbe1c4e9a703741b02010cf6193da7c1ea0e46f0172cfee35259a

SHA512
2fac22ee247896e912da4847cd941853d5ee8db65924f4f4fe4f8425c5e6e834c7553e7046acb14dfd17ec3ae9de1627130dd8e290f64fec5dca17dac7a0b094

Download Submit
C:\Users\Admin\AppData\Local\Temp\gtOlnDcdUa.bat

Filesize
236B

MD5
c92499ade13922ec0ebf9ecaf2568c61

SHA1
befa95a759ef27999e49a2c8cade93686dca561a

SHA256
df8f1737957fe63917ca38c8dda25eae466a5cddaaee0964c8b57f9d0cc88cb2

SHA512
88c981cf79366fd480898f78649363e7fca6ee38efb3fbf1734eb26750a5d011c14c930d9318a9f9d9d89621143d7be1a6b70233755c389e84d4deae6ab98913

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhapUayLwp.bat

Filesize
188B

MD5
9bc7938eca68a8f6280155e82fd1aa2a

SHA1
26a58707716af093f5627dc69c934b4be6876863

SHA256
9abd38cc60623229f6b4bc667fad149cffacc9e5d975697ede52b73e0582b06e

SHA512
79a11416f24b3ab7b3930b866e16287b2bc37a762ffb32505933aedff347436232dab919ed23fc60545f9dc8a9c5b353fa8a2a8516fd09cb382c86ba5ee3ba6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\sMcwJl1juU.bat

Filesize
236B

MD5
65b0374da683190104516db0a6f58432

SHA1
0d9774b79af4d20f12be6d158a35aa40a6b74dca

SHA256
1aaca0bcf74fbb1a21fe04d60884d11d69d119dbcc705a902cfb6ef29befa10f

SHA512
e1343324600399cf87bf149bd301fb8f994e9b432bb9734d2974ae703732fc271ae07d55317617b9b3d516b9cacc310995063f9160543f67c365d7c1fa6e8411

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ab60fdcc7eba3a78bbe7c934dbc1a669

SHA1
ebdcf193360842191c41048c23328c2bf4ec05a0

SHA256
5e97f25ec60d340e1e216d813fbb44d1224f215886b632d3b1d31181477d89f3

SHA512
8b0d8093258e06fc439afc05a2a9d7ed880616aa2175b96ce642014ddcee0cb95d72e661bb348589a5236b83858f1efb2a52764972b5bc9d5dd82bbae4a3e887

Download Submit
C:\msproviderBrokerMonitornet\WinPerfcommon.exe

Filesize
1.9MB

MD5
6b9554367a439d39a00a0dff9a08b123

SHA1
e1d22cde90c297c10f4fcba5b3980e5d551eb0b3

SHA256
3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

SHA512
72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720

Download Submit
C:\msproviderBrokerMonitornet\qGDN1Ee4B98z7IBsvEaYenHfp3i4NGluh1QU7ALIT.vbe

Filesize
265B

MD5
f8b56b683c6faa5b9eb7f37f01af8c29

SHA1
89e4357ccde76fe35aa3cbac952bb68d691ae9cd

SHA256
bd73b65e256773c9cf879c504b7d426573587b5c7b03bec2d6fccfddaccf1721

SHA512
321b6a63d3dca1e52a65a47ab3d3a83d0d7ee59b28f29274b128d9b7f5c49f2cfaac4f70d3981ee55821cbbdc3234bf4d721cbe3f64a888250ac4c297eb9f768

Download Submit
C:\msproviderBrokerMonitornet\rS0XRrLecpgQD85mPzoGJptpB8S2GwiBTdu9z4xSSrCX90wlqwqwnpzpgY0I.bat

Filesize
103B

MD5
a1c6e7d957b0b22c92c7b314d10e894d

SHA1
0f20c6fa17a304e0a20947d6e6f368406a19fc25

SHA256
bf06f59116a3066353fe51051b9701fb34dda96e7b80f24d8e6fc6b18bd01723

SHA512
20985dacbb86ac9862da8483978b579c0ccdb3dff4f23aee019b006669fd1230a684b2bd12fb43ab489343ad7aff1fd0a8228890135e1854f9e2a106b7514e02

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qokc0paz\qokc0paz.0.cs

Filesize
389B

MD5
321057e95678e5d2ab7d2c5ff01a7256

SHA1
5d07ee6841f0b6962aa41d93b3df5c9c6ad14b05

SHA256
01cc23c9361892c381d933c6be707b8f35ab75207dd045ef5e0b0b1e9569610c

SHA512
b003c455b082fe8386557576dccee0d8f96d7f4c7560c36490c5ff7247f1c0d6f15201b8b177fb8081f78e055f5129e70626350942f6cf45e146b1a1780e8b5f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qokc0paz\qokc0paz.cmdline

Filesize
235B

MD5
0476b381399ba8fe9a6b20de7a33244e

SHA1
4a7207789e7cf6cf26ee5c8ea422f2fc1e439e77

SHA256
1d8cb6ad4a1ca6b8c0a149222012a58276378bdbbb0005e58b4df5fd87845700

SHA512
ba531e49d97b2f7ec1d517d38b951ab3bbd5f4eb59ece1d630bd943731a83e61e36458105a8794a2d269f0d695c4d4c488c1aa4380a22a9ebef2617dccb44113

Download Submit
\??\c:\Windows\System32\CSCA2475810A1E40AD8EDF5EF124F5228.TMP

Filesize
1KB

MD5
fccbcfaf29fdccaabada579f7aaf3ae7

SHA1
f9b179b6aab6b96908d89b35aab3f503478a956d

SHA256
e70bc8ad14a70d490fe92ed86e79c40fc133a64428a2781e14514b16d83a9b02

SHA512
ac047b4ba060e72e224c1afdebbdafecbfd705a67cb8f0cd5c82bf7980c2baa23bdb5bf5d821836bc0c426069a61d8e112b45239887d2d81b8a6d4fa839c1e10

Download Submit
memory/1280-103-0x00000000011D0000-0x00000000013C4000-memory.dmp

Filesize
2.0MB

Download
memory/1344-131-0x0000000000070000-0x0000000000264000-memory.dmp

Filesize
2.0MB

Download
memory/1532-188-0x0000000000F80000-0x0000000001174000-memory.dmp

Filesize
2.0MB

Download
memory/1868-69-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download
memory/2324-145-0x0000000000C00000-0x0000000000DF4000-memory.dmp

Filesize
2.0MB

Download
memory/2336-21-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/2336-27-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2336-25-0x00000000003C0000-0x00000000003CE000-memory.dmp

Filesize
56KB

Download
memory/2336-23-0x00000000002A0000-0x00000000002AC000-memory.dmp

Filesize
48KB

Download
memory/2336-19-0x0000000000510000-0x0000000000528000-memory.dmp

Filesize
96KB

Download
memory/2336-17-0x0000000000450000-0x000000000046C000-memory.dmp

Filesize
112KB

Download
memory/2336-15-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/2336-13-0x0000000000F10000-0x0000000001104000-memory.dmp

Filesize
2.0MB

Download
memory/2856-89-0x0000000000010000-0x0000000000204000-memory.dmp

Filesize
2.0MB

Download
memory/2920-159-0x0000000000CD0000-0x0000000000EC4000-memory.dmp

Filesize
2.0MB

Download
memory/2964-70-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2972-174-0x0000000000100000-0x00000000002F4000-memory.dmp

Filesize
2.0MB

Download