dcrat | 1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5

Analysis

max time kernel
145s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OneDriveStandaloneUpdater.exe
Size

829KB
MD5

c1f1bea182f1c3477c2f133c3ac26930
SHA1

2145c09d2c3279ac83e844c4d80e7aa219e99b8d
SHA256

1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5
SHA512

6af6336782b29bdab906e4d289cb5c2c8500ba8a20dee53def21960e62afc28ec6756b746b4e4036a30726984a60b656b3d529b4abc119953267e91be4992a4d
SSDEEP

12288:P6TnOzi5kaag8hpT77JJMA+XSpW3Ari4VVyZC0+1cw2jINof7+vEnkdsOZ6:P6TnYa+T7dJMA+i3iE0nHfW6

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\WmiPrvSE.exe\", \"C:\\Users\\Default\\Cookies\\OSPPSVC.exe\", \"C:\\Recovery\\18fc4542-69f6-11ef-a46c-62cb582c238c\\explorer.exe\", \"C:\\Program Files\\Windows Mail\\fr-FR\\System.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\WmiPrvSE.exe\", \"C:\\Users\\Default\\Cookies\\OSPPSVC.exe\", \"C:\\Recovery\\18fc4542-69f6-11ef-a46c-62cb582c238c\\explorer.exe\", \"C:\\Program Files\\Windows Mail\\fr-FR\\System.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\OneDriveStandaloneUpdater.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Start Menu\\csrss.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\WmiPrvSE.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\WmiPrvSE.exe\", \"C:\\Users\\Default\\Cookies\\OSPPSVC.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\WmiPrvSE.exe\", \"C:\\Users\\Default\\Cookies\\OSPPSVC.exe\", \"C:\\Recovery\\18fc4542-69f6-11ef-a46c-62cb582c238c\\explorer.exe\""	OneDriveStandaloneUpdater.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2740	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2740	schtasks.exe	30

DCRat payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/352-1-0x00000000011A0000-0x0000000001276000-memory.dmp	family_dcrat_v2
behavioral1/files/0x00050000000194fc-31.dat	family_dcrat_v2
behavioral1/memory/2492-84-0x0000000000E50000-0x0000000000F26000-memory.dmp	family_dcrat_v2
behavioral1/memory/1276-133-0x00000000010D0000-0x00000000011A6000-memory.dmp	family_dcrat_v2
behavioral1/memory/2252-158-0x00000000012F0000-0x00000000013C6000-memory.dmp	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3048	powershell.exe
2912	powershell.exe
2928	powershell.exe
2952	powershell.exe
2964	powershell.exe
1612	powershell.exe

Executes dropped EXE 14 IoCs

pid	Process
2492	OSPPSVC.exe
2280	OSPPSVC.exe
768	OSPPSVC.exe
3068	OSPPSVC.exe
1276	OSPPSVC.exe
408	OSPPSVC.exe
2252	OSPPSVC.exe
3056	OSPPSVC.exe
2976	OSPPSVC.exe
2676	OSPPSVC.exe
2628	OSPPSVC.exe
1752	OSPPSVC.exe
2220	OSPPSVC.exe
1628	OSPPSVC.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Windows Mail\\fr-FR\\System.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveStandaloneUpdater = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OneDriveStandaloneUpdater.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Start Menu\\csrss.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\WmiPrvSE.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\WmiPrvSE.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\18fc4542-69f6-11ef-a46c-62cb582c238c\\explorer.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\18fc4542-69f6-11ef-a46c-62cb582c238c\\explorer.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Start Menu\\csrss.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Users\\Default\\Cookies\\OSPPSVC.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Users\\Default\\Cookies\\OSPPSVC.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Windows Mail\\fr-FR\\System.exe\""	OneDriveStandaloneUpdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveStandaloneUpdater = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OneDriveStandaloneUpdater.exe\""	OneDriveStandaloneUpdater.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC90C81094D7ED453980B0B8D421611D7B.TMP	csc.exe
File created	\??\c:\Windows\System32\gxbog2.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\fr-FR\System.exe	OneDriveStandaloneUpdater.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\System.exe	OneDriveStandaloneUpdater.exe
File created	C:\Program Files\Windows Mail\fr-FR\27d1bcfc3c54e0	OneDriveStandaloneUpdater.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\WmiPrvSE.exe	OneDriveStandaloneUpdater.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\24dbde2999530e	OneDriveStandaloneUpdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2276	PING.EXE
2036	PING.EXE
1652	PING.EXE
1472	PING.EXE
2592	PING.EXE
952	PING.EXE
3012	PING.EXE

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
2276	PING.EXE
2036	PING.EXE
1652	PING.EXE
1472	PING.EXE
2592	PING.EXE
952	PING.EXE
3012	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2716	schtasks.exe
1852	schtasks.exe
1528	schtasks.exe
2596	schtasks.exe
1588	schtasks.exe
2908	schtasks.exe
2284	schtasks.exe
2988	schtasks.exe
2684	schtasks.exe
2704	schtasks.exe
2632	schtasks.exe
2592	schtasks.exe
2972	schtasks.exe
2832	schtasks.exe
2224	schtasks.exe
1736	schtasks.exe
2800	schtasks.exe
1744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe
352	OneDriveStandaloneUpdater.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	352	OneDriveStandaloneUpdater.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2492	OSPPSVC.exe
Token: SeDebugPrivilege	2280	OSPPSVC.exe
Token: SeDebugPrivilege	768	OSPPSVC.exe
Token: SeDebugPrivilege	3068	OSPPSVC.exe
Token: SeDebugPrivilege	1276	OSPPSVC.exe
Token: SeDebugPrivilege	408	OSPPSVC.exe
Token: SeDebugPrivilege	2252	OSPPSVC.exe
Token: SeDebugPrivilege	3056	OSPPSVC.exe
Token: SeDebugPrivilege	2976	OSPPSVC.exe
Token: SeDebugPrivilege	2676	OSPPSVC.exe
Token: SeDebugPrivilege	2628	OSPPSVC.exe
Token: SeDebugPrivilege	1752	OSPPSVC.exe
Token: SeDebugPrivilege	2220	OSPPSVC.exe
Token: SeDebugPrivilege	1628	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 2568	352	OneDriveStandaloneUpdater.exe	34
PID 352 wrote to memory of 2568	352	OneDriveStandaloneUpdater.exe	34
PID 352 wrote to memory of 2568	352	OneDriveStandaloneUpdater.exe	34
PID 2568 wrote to memory of 1972	2568	csc.exe	36
PID 2568 wrote to memory of 1972	2568	csc.exe	36
PID 2568 wrote to memory of 1972	2568	csc.exe	36
PID 352 wrote to memory of 2964	352	OneDriveStandaloneUpdater.exe	52
PID 352 wrote to memory of 2964	352	OneDriveStandaloneUpdater.exe	52
PID 352 wrote to memory of 2964	352	OneDriveStandaloneUpdater.exe	52
PID 352 wrote to memory of 2952	352	OneDriveStandaloneUpdater.exe	53
PID 352 wrote to memory of 2952	352	OneDriveStandaloneUpdater.exe	53
PID 352 wrote to memory of 2952	352	OneDriveStandaloneUpdater.exe	53
PID 352 wrote to memory of 2928	352	OneDriveStandaloneUpdater.exe	54
PID 352 wrote to memory of 2928	352	OneDriveStandaloneUpdater.exe	54
PID 352 wrote to memory of 2928	352	OneDriveStandaloneUpdater.exe	54
PID 352 wrote to memory of 2912	352	OneDriveStandaloneUpdater.exe	55
PID 352 wrote to memory of 2912	352	OneDriveStandaloneUpdater.exe	55
PID 352 wrote to memory of 2912	352	OneDriveStandaloneUpdater.exe	55
PID 352 wrote to memory of 3048	352	OneDriveStandaloneUpdater.exe	58
PID 352 wrote to memory of 3048	352	OneDriveStandaloneUpdater.exe	58
PID 352 wrote to memory of 3048	352	OneDriveStandaloneUpdater.exe	58
PID 352 wrote to memory of 1612	352	OneDriveStandaloneUpdater.exe	59
PID 352 wrote to memory of 1612	352	OneDriveStandaloneUpdater.exe	59
PID 352 wrote to memory of 1612	352	OneDriveStandaloneUpdater.exe	59
PID 352 wrote to memory of 3064	352	OneDriveStandaloneUpdater.exe	64
PID 352 wrote to memory of 3064	352	OneDriveStandaloneUpdater.exe	64
PID 352 wrote to memory of 3064	352	OneDriveStandaloneUpdater.exe	64
PID 3064 wrote to memory of 2124	3064	cmd.exe	66
PID 3064 wrote to memory of 2124	3064	cmd.exe	66
PID 3064 wrote to memory of 2124	3064	cmd.exe	66
PID 3064 wrote to memory of 1496	3064	cmd.exe	67
PID 3064 wrote to memory of 1496	3064	cmd.exe	67
PID 3064 wrote to memory of 1496	3064	cmd.exe	67
PID 3064 wrote to memory of 2492	3064	cmd.exe	69
PID 3064 wrote to memory of 2492	3064	cmd.exe	69
PID 3064 wrote to memory of 2492	3064	cmd.exe	69
PID 2492 wrote to memory of 2156	2492	OSPPSVC.exe	70
PID 2492 wrote to memory of 2156	2492	OSPPSVC.exe	70
PID 2492 wrote to memory of 2156	2492	OSPPSVC.exe	70
PID 2156 wrote to memory of 2868	2156	cmd.exe	72
PID 2156 wrote to memory of 2868	2156	cmd.exe	72
PID 2156 wrote to memory of 2868	2156	cmd.exe	72
PID 2156 wrote to memory of 2276	2156	cmd.exe	73
PID 2156 wrote to memory of 2276	2156	cmd.exe	73
PID 2156 wrote to memory of 2276	2156	cmd.exe	73
PID 2156 wrote to memory of 2280	2156	cmd.exe	74
PID 2156 wrote to memory of 2280	2156	cmd.exe	74
PID 2156 wrote to memory of 2280	2156	cmd.exe	74
PID 2280 wrote to memory of 1328	2280	OSPPSVC.exe	75
PID 2280 wrote to memory of 1328	2280	OSPPSVC.exe	75
PID 2280 wrote to memory of 1328	2280	OSPPSVC.exe	75
PID 1328 wrote to memory of 2224	1328	cmd.exe	77
PID 1328 wrote to memory of 2224	1328	cmd.exe	77
PID 1328 wrote to memory of 2224	1328	cmd.exe	77
PID 1328 wrote to memory of 2036	1328	cmd.exe	78
PID 1328 wrote to memory of 2036	1328	cmd.exe	78
PID 1328 wrote to memory of 2036	1328	cmd.exe	78
PID 1328 wrote to memory of 768	1328	cmd.exe	79
PID 1328 wrote to memory of 768	1328	cmd.exe	79
PID 1328 wrote to memory of 768	1328	cmd.exe	79
PID 768 wrote to memory of 1288	768	OSPPSVC.exe	80
PID 768 wrote to memory of 1288	768	OSPPSVC.exe	80
PID 768 wrote to memory of 1288	768	OSPPSVC.exe	80
PID 1288 wrote to memory of 2372	1288	cmd.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OneDriveStandaloneUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\OneDriveStandaloneUpdater.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2ksm21f3\2ksm21f3.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB72F.tmp" "c:\Windows\System32\CSC90C81094D7ED453980B0B8D421611D7B.TMP"
    3⤵
    PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\fr-FR\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDriveStandaloneUpdater.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EmfJ94X6Jc.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2124
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1496
- - C:\Users\Default\Cookies\OSPPSVC.exe
    "C:\Users\Default\Cookies\OSPPSVC.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\szcAPjpm25.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2868
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2276
    - - C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2280
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\alQR4bHbbG.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2224
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2036
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0EsgTYIxwU.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2372
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1896
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\riciCmDgnt.bat"
        10⤵
        
        PID:1332
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2708
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1624
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iPELUvEZwh.bat"
        12⤵
        
        PID:2948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2452
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2076
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aRcytkisn9.bat"
        14⤵
        
        PID:1416
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:992
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1652
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pFxSEGDzP3.bat"
        16⤵
        
        PID:2168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1556
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1944
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JanKBv1Gj5.bat"
        18⤵
        
        PID:1444
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:2620
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2108
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6EJ44dmIex.bat"
        20⤵
        
        PID:2580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:1952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1636
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EEIicgEf1j.bat"
        22⤵
        
        PID:2896
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:2584
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1472
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OBULCoiNqa.bat"
        24⤵
        
        PID:1528
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:3068
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2592
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiOMBGhh72.bat"
        26⤵
        
        PID:2452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:1664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2948
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MGTgtuIFSm.bat"
        28⤵
        
        PID:2316
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:3028
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:952
        
        C:\Users\Default\Cookies\OSPPSVC.exe
        
        "C:\Users\Default\Cookies\OSPPSVC.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Vg1jnREOGb.bat"
        30⤵
        
        PID:2012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:1856
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        31⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Start Menu\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Start Menu\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Cookies\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default\Cookies\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Cookies\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\fr-FR\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fr-FR\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\fr-FR\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OneDriveStandaloneUpdaterO" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\OneDriveStandaloneUpdater.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OneDriveStandaloneUpdater" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\OneDriveStandaloneUpdater.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OneDriveStandaloneUpdaterO" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\OneDriveStandaloneUpdater.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0EsgTYIxwU.bat

Filesize
212B

MD5
82eb56f10f98767a8759cf90b18bd38f

SHA1
41230114b77ae5000cb6e33035a170e459976669

SHA256
fe36d1e12ab2345973602cca33501c86c619510ed91025807e406efcb0ed72aa

SHA512
9cd5b91c6669525373ba95413237e3198a4f77e288ad170a259d8770bd8a25cd35d06eee066c3d26881e4465ffe03168b9c4ce311b9a440e4cc434bf3bd4578c

Download Submit
C:\Users\Admin\AppData\Local\Temp\6EJ44dmIex.bat

Filesize
212B

MD5
ac7ca9387d2bd837326dd6781086021c

SHA1
86a752fc8d4d9858b939d33ee3ea0d50ba895b11

SHA256
e97944979ff5bd46433a577f2b2ef57d92b3dfd05953fb2e61ee25b433ce5ba3

SHA512
f8e446bd37a407efb0b95d31af80c539994bb5d357bd0006cfdb5071a6395b4bc3b740f0889d9a1914c40486c229d5e0a4eaa17337b42a7e5bb57da8da0913e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEIicgEf1j.bat

Filesize
164B

MD5
6651b24a2d73f5b558fd77fb2e9b36e1

SHA1
bf406cc562c36d9162929326df0e87b37e519050

SHA256
329eaf2a5e3b490c213b6dc694fda59bb14562e99440edccef6e936cfb0b8764

SHA512
2748cc3650e0fb52ad03dcb584860e19003c9d9eb4376dac4d668e348b3ff7b67a0a44f6f423853115cfabb05efb19362e2f05a5edf8fb6121687412d1cf0e78

Download Submit
C:\Users\Admin\AppData\Local\Temp\EmfJ94X6Jc.bat

Filesize
212B

MD5
9ac453d4c973c3291c1816f7b93b920a

SHA1
0b6da4784e0d689aa60540337a4ba9408714b1f9

SHA256
f38caf7f7834e465d78f96ccd9472111a6cb5ec2c219f2a386644c85e3fc378c

SHA512
7e10fc5c4f59e4a238289e7af1efc21b3040cc3475c9efca3b321eddb663b1012fdfae204e74d50db6cce3a1b094a0cade92d491f4e746b34c02f740cbb09833

Download Submit
C:\Users\Admin\AppData\Local\Temp\JanKBv1Gj5.bat

Filesize
212B

MD5
4e1b1b2db43a129adff5f587181b0ec4

SHA1
aab4a4b722369395abc813ccbbd6ba7cc862da30

SHA256
a393da9af5d67015507f268c5407fe757a9d7e48e6c890f4d8d16953f5e9cda5

SHA512
c5510cb10e94fbc9ad0e34190bc704910206f7a0d3441e475a54243b8d8a6a411a3f45c9b5a011019756037eb3cf69d978dd840faa6012decdf11b05de8f18a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MGTgtuIFSm.bat

Filesize
164B

MD5
75165a92ed715e9da00b69c7814bc42e

SHA1
4ecc23fb5a6f38aeaee4960d4522fff3b2fe9525

SHA256
fde24c6d199230b10a240027519809efaa311134e4fd0df6233231c3bcb8c86b

SHA512
8d88800cf636bf1c85d71dbf88a7d4642eab714e8e5e28ecd2f57ea8ec29598b0d5bbbd28cd121b4d0600505fbd4f34210091c599d6893f4def41517ec0f86e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\NiOMBGhh72.bat

Filesize
212B

MD5
6073cdb361f036a96de26cd8e046b88b

SHA1
e218d112b14e2f83e7ea8c1ec5543023ba6ee66c

SHA256
68686fc8eb41306c082e4ad9bd57ad09c07c115e4a8420ed3ccc744bf92053df

SHA512
ed7018ccfac017f770eac27ba0b40df5da483536d9cf757ec2521ae79206e651d15f26ba7b4f9eb12d9edd983863c139fffbfff42de3241f47d9874a12cd95f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\OBULCoiNqa.bat

Filesize
164B

MD5
c9a46093ef92bc110dd1f09cb1c23264

SHA1
3764ed4283a4e09ddfc71d6906fcafdcba960273

SHA256
f5bbb9d8f541ea068f2c81c177c3087824ffce72b8ac103e7bcb873ec589874a

SHA512
835b38524df5e93dc02d6edcd33e345b6a24bc323d929fd9c168f7c4b1c4674983dc464500d77d392de703e3dafe8f17f1b933d3a55c6edc8f2d5cb2d5f29b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB72F.tmp

Filesize
1KB

MD5
b8def24d56066ca4ac58f30117e2a0dd

SHA1
afb21576344c34d1730ea7a85ecfdc8746396503

SHA256
f9e93c7a7bd191d03b5363f060230e0e13e9dcac61a6061a14916dca90e65085

SHA512
6fca7b143a7d0cc05641f9e1fd67439cb9bfa68a2e0ee53e3e2b37d2e491bd905820c9e86ff3249f3d8c7643a88f7a99cee6e2971ffc202514d700b135ee8ba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vg1jnREOGb.bat

Filesize
164B

MD5
ae6d7dd02c63e50a941aebaa95674256

SHA1
0d44e1971d27cd2bb6cf24e079b729704d0e176a

SHA256
6889305d507be5462a139746eaf371e2359c4db1e285900f36762c7c77ace284

SHA512
e91235c5ca04abb7a441885b4df22b5c3cfaafafde6772e907e7ebd70b0131660bd0a7b51703155d840b5be7ed509bfb429dbbdc4ba9659e082f296229220daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\aRcytkisn9.bat

Filesize
164B

MD5
2cd50c4d9e0f3751e70ee07502e88dd3

SHA1
f85004d7f5f7654e57294d426542c32baac86f3a

SHA256
fc7a4304be58c04735e8f12d619baeebb9c37d5f1078e0b583e7ad9b9fed6aa5

SHA512
fcd17e3f7eb600ad59ed1fe2e9e4ef120609904135fce1554a4effb8e7a0ccd65d95034998ed62576a5855cb05e61485ef010a7052f90475d07a7d714bc59e43

Download Submit
C:\Users\Admin\AppData\Local\Temp\alQR4bHbbG.bat

Filesize
164B

MD5
f87251eb9847069b30e126338040dafa

SHA1
7ec9af05d4d24cfd8c36d8bf5171507ff272c06e

SHA256
a6b797f39e1dbe946b5162c60def14bd3f0bc53d785ce443cee04851811ce385

SHA512
c43b8534ae5e680515f4667226b23573632dd4833fadb5340c6e32feb85137a09d525c39840d3e3c73c432debe61517c22fb00357a21cbe8133da203cd610cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\iPELUvEZwh.bat

Filesize
212B

MD5
901fcd10c16bab2c629e0b7f063c8869

SHA1
e8b737e5c0e770d54809da5519e0e6e9d544d2cc

SHA256
3a30662659eccedc90d5218da266d8c99ec92aa104b65584556fd2bd1a82455e

SHA512
b8a754b0281f43ff1e87e21bcd57021202c81e0d0a8818a85e9ea041a09c23587375865e99a9ceabec150db288bfb9c35648fd60c4bc66981ea24d18880693ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\pFxSEGDzP3.bat

Filesize
212B

MD5
0d3c0325401640080d9dd9c2774ea1a8

SHA1
0f24c937e32f6cbafd6a1c7bc801407f283a9472

SHA256
2148484089a2e901fb25de10401f54350336fde62dd2d818ee94648cd367b105

SHA512
f735d00b4715b37d16f759d6a1e60438781afd2401bea4e5911951f9160e939a8f82ce1904c8d381e8c41385db92075713ef0df2a44787618136e9d0304455bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\riciCmDgnt.bat

Filesize
212B

MD5
1e01b2d205208fb915bf044ea99e0d9b

SHA1
f581c0bfd202263114be9b78a7e1f662a09af87a

SHA256
5012c33edaeffb9c0db56540ab7aa7fe2b4b0df0b245d0dc95640a38b929eab6

SHA512
9c4210ab2a250309bbf068f89aa13f72b75239718c6bd2ad60e03a44988a0ff83f445b0cb8fd57dd78deed3b4c2e2bbf21a690a666191a4009c15ca5dad3d45a

Download Submit
C:\Users\Admin\AppData\Local\Temp\szcAPjpm25.bat

Filesize
164B

MD5
21c2f7e53656dbf52562565e16e1a2d4

SHA1
0f1853a1c5591d74200342815df7a079563dd275

SHA256
80b35f437f6cb12a0c5e6f1554088e4eaa0c5ea5419c884c5ccb7dae4a507def

SHA512
8df5a71a5a69494ced84eb00e96287f94362e54cf4f4708822ff2d56b79b49bba46f3ed56c03249e8a31e063bf18146588fdaf88b25b447221b3cb022ed9ce0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W3H5A1YVH2AQSYMW95BI.temp

Filesize
7KB

MD5
542d7af73913bc1252e73115a1c14827

SHA1
f9e9e6c5945ab39c60b9fb96e65058e4fbe9e1f7

SHA256
1f3fd56495d3de017f4a7ebaf8a082948e9ccf54c3fccd3997a84de7486e6a24

SHA512
6644b109dea6f683e36272ce640a2b8bee8335f7ec9eb8bb18eb48d4e175ef4f58e1c670c36c62d2a8c7d3c0a8324f1a4d390f306c2951294177bef267ef45b1

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\csrss.exe

Filesize
829KB

MD5
c1f1bea182f1c3477c2f133c3ac26930

SHA1
2145c09d2c3279ac83e844c4d80e7aa219e99b8d

SHA256
1054af5e9206aa0cb650a4e58900bcd369a554e64eaa89f56cb35cd105386eb5

SHA512
6af6336782b29bdab906e4d289cb5c2c8500ba8a20dee53def21960e62afc28ec6756b746b4e4036a30726984a60b656b3d529b4abc119953267e91be4992a4d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2ksm21f3\2ksm21f3.0.cs

Filesize
369B

MD5
f75f8dbdb8d0bd2750d6ec87fef66a14

SHA1
38a11da574d8a3207f151ebe261fb201226ddcd4

SHA256
c34feb67192b8a9de3be6969e151449998307ac2a28de6983dadfde9748a4e9f

SHA512
f8df3b60574f95570eeddc29f9a59d92e362e1bd0dd819f27cf3891716f341abeebe0fbb6c61c582d9ff8fa724398c11df785abe27f196c836c391e112f62dc9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2ksm21f3\2ksm21f3.cmdline

Filesize
235B

MD5
091263443fb35f371510887d8225abe3

SHA1
0a632d3e8eae177346a4df88abb5fd5f957433a8

SHA256
e11dfcc116ad85ebca56ebc11aa72a0b3757fba5e8b8545c287efc474434d477

SHA512
5c2f3e98f74345a3f2a5887cb01397a30425132fe24240f583b2ee33d6a244c1b9b86c5d5831b77ef9299268c59d896204800d3e2f5c4575cafe86da2c480f5e

Download Submit
\??\c:\Windows\System32\CSC90C81094D7ED453980B0B8D421611D7B.TMP

Filesize
1KB

MD5
dbb2cd021b80875d9c777c705ef845c8

SHA1
3ed0cde3b4f4d8267c3cddd37dd4ede100b5ecce

SHA256
a4d8c8c391bc1975510bdea24653db0f578d998dead4ce7f8a85eb8fbb3ec829

SHA512
a8076e4d1b1641e189d2066050809ce0cce557e23c110fba77c2cfb7448b5915252b2e2f4d3443f708941277b947b951cfba6c191980a09b8c7710589c766c8e

Download Submit
memory/352-11-0x0000000000380000-0x000000000038E000-memory.dmp

Filesize
56KB

Download
memory/352-18-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/352-1-0x00000000011A0000-0x0000000001276000-memory.dmp

Filesize
856KB

Download
memory/352-80-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/352-21-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/352-2-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/352-19-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/352-20-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/352-17-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/352-0-0x000007FEF6083000-0x000007FEF6084000-memory.dmp

Filesize
4KB

Download
memory/352-4-0x0000000000370000-0x000000000037E000-memory.dmp

Filesize
56KB

Download
memory/352-6-0x00000000003A0000-0x00000000003BC000-memory.dmp

Filesize
112KB

Download
memory/352-15-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/352-7-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/352-9-0x00000000003C0000-0x00000000003D8000-memory.dmp

Filesize
96KB

Download
memory/352-14-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/352-12-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/1276-133-0x00000000010D0000-0x00000000011A6000-memory.dmp

Filesize
856KB

Download
memory/2252-158-0x00000000012F0000-0x00000000013C6000-memory.dmp

Filesize
856KB

Download
memory/2492-84-0x0000000000E50000-0x0000000000F26000-memory.dmp

Filesize
856KB

Download
memory/2928-79-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download
memory/2964-78-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download