dcrat | 595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SPISOK_DENEG.exe
Size

1.1MB
MD5

490aa1e56fab47858d780a9fdbafb5bf
SHA1

337d8c93caf41a62f0720ae1f0c02d262ac0a274
SHA256

595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595
SHA512

7ff8f6983c789f78f67063745fef92040bb5cb88463e82f6a9f05ba0b48021bd2c541cec6e06726748547f0800abd14dd52fe798feddcb1427a46b87619a4f00
SSDEEP

24576:2TbBv5rUyXV0VTney9cyQJMA+b3iE0nHA6E:IBJgTney9clmA+b3KHe

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\cmd.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\OSPPSVC.exe\", \"C:\\ProviderserverruntimeperfSvc\\cmd.exe\", \"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\sppsvc.exe\", \"C:\\ProviderserverruntimeperfSvc\\ChainPortsurrogate.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\cmd.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\cmd.exe\", \"C:\\Users\\All Users\\services.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\cmd.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\OSPPSVC.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\cmd.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\OSPPSVC.exe\", \"C:\\ProviderserverruntimeperfSvc\\cmd.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\cmd.exe\", \"C:\\Users\\All Users\\services.exe\", \"C:\\MSOCache\\All Users\\OSPPSVC.exe\", \"C:\\ProviderserverruntimeperfSvc\\cmd.exe\", \"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\sppsvc.exe\""	ChainPortsurrogate.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2096	schtasks.exe	34

DCRat payload 12 IoCs

rat

resource	yara_rule
behavioral1/files/0x000a000000017530-12.dat	family_dcrat_v2
behavioral1/memory/2804-13-0x00000000008A0000-0x0000000000974000-memory.dmp	family_dcrat_v2
behavioral1/memory/2496-54-0x0000000000320000-0x00000000003F4000-memory.dmp	family_dcrat_v2
behavioral1/memory/1108-66-0x0000000001050000-0x0000000001124000-memory.dmp	family_dcrat_v2
behavioral1/memory/2832-78-0x00000000000F0000-0x00000000001C4000-memory.dmp	family_dcrat_v2
behavioral1/memory/2148-90-0x00000000000A0000-0x0000000000174000-memory.dmp	family_dcrat_v2
behavioral1/memory/936-102-0x00000000012E0000-0x00000000013B4000-memory.dmp	family_dcrat_v2
behavioral1/memory/2160-125-0x0000000000FE0000-0x00000000010B4000-memory.dmp	family_dcrat_v2
behavioral1/memory/1900-159-0x0000000000140000-0x0000000000214000-memory.dmp	family_dcrat_v2
behavioral1/memory/2624-171-0x0000000000DA0000-0x0000000000E74000-memory.dmp	family_dcrat_v2
behavioral1/memory/820-183-0x0000000001040000-0x0000000001114000-memory.dmp	family_dcrat_v2
behavioral1/memory/2160-195-0x0000000001330000-0x0000000001404000-memory.dmp	family_dcrat_v2

Executes dropped EXE 14 IoCs

pid	Process
2804	ChainPortsurrogate.exe
2496	cmd.exe
1108	cmd.exe
2832	cmd.exe
2148	cmd.exe
936	cmd.exe
2740	cmd.exe
2160	cmd.exe
2824	cmd.exe
1996	cmd.exe
1900	cmd.exe
2624	cmd.exe
820	cmd.exe
2160	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2972	cmd.exe
2972	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\MSOCache\\All Users\\OSPPSVC.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\MSOCache\\All Users\\OSPPSVC.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\sppsvc.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChainPortsurrogate = "\"C:\\ProviderserverruntimeperfSvc\\ChainPortsurrogate.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\services.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Windows Portable Devices\\cmd.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\services.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\ProviderserverruntimeperfSvc\\cmd.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\ProviderserverruntimeperfSvc\\cmd.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\3a99bb82-4e15-11ef-8354-cae67966b5f6\\sppsvc.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChainPortsurrogate = "\"C:\\ProviderserverruntimeperfSvc\\ChainPortsurrogate.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Windows Portable Devices\\cmd.exe\""	ChainPortsurrogate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC88A88480C1CA404C9BD6D976FC56D118.TMP	csc.exe
File created	\??\c:\Windows\System32\qrosn9.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\cmd.exe	ChainPortsurrogate.exe
File created	C:\Program Files (x86)\Windows Portable Devices\ebf1f9fa8afd6d	ChainPortsurrogate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SPISOK_DENEG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2376	PING.EXE
2504	PING.EXE
1720	PING.EXE
2832	PING.EXE
2912	PING.EXE

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
2376	PING.EXE
2504	PING.EXE
1720	PING.EXE
2832	PING.EXE
2912	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2944	schtasks.exe
2952	schtasks.exe
2260	schtasks.exe
1192	schtasks.exe
2392	schtasks.exe
1964	schtasks.exe
2272	schtasks.exe
2056	schtasks.exe
2560	schtasks.exe
2424	schtasks.exe
536	schtasks.exe
2428	schtasks.exe
2388	schtasks.exe
2024	schtasks.exe
2372	schtasks.exe
2036	schtasks.exe
2244	schtasks.exe
584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe
2804	ChainPortsurrogate.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	ChainPortsurrogate.exe
Token: SeDebugPrivilege	2496	cmd.exe
Token: SeDebugPrivilege	1108	cmd.exe
Token: SeDebugPrivilege	2832	cmd.exe
Token: SeDebugPrivilege	2148	cmd.exe
Token: SeDebugPrivilege	936	cmd.exe
Token: SeDebugPrivilege	2740	cmd.exe
Token: SeDebugPrivilege	2160	cmd.exe
Token: SeDebugPrivilege	2824	cmd.exe
Token: SeDebugPrivilege	1996	cmd.exe
Token: SeDebugPrivilege	1900	cmd.exe
Token: SeDebugPrivilege	2624	cmd.exe
Token: SeDebugPrivilege	820	cmd.exe
Token: SeDebugPrivilege	2160	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2716	2216	SPISOK_DENEG.exe	30
PID 2216 wrote to memory of 2716	2216	SPISOK_DENEG.exe	30
PID 2216 wrote to memory of 2716	2216	SPISOK_DENEG.exe	30
PID 2216 wrote to memory of 2716	2216	SPISOK_DENEG.exe	30
PID 2716 wrote to memory of 2972	2716	WScript.exe	31
PID 2716 wrote to memory of 2972	2716	WScript.exe	31
PID 2716 wrote to memory of 2972	2716	WScript.exe	31
PID 2716 wrote to memory of 2972	2716	WScript.exe	31
PID 2972 wrote to memory of 2804	2972	cmd.exe	33
PID 2972 wrote to memory of 2804	2972	cmd.exe	33
PID 2972 wrote to memory of 2804	2972	cmd.exe	33
PID 2972 wrote to memory of 2804	2972	cmd.exe	33
PID 2804 wrote to memory of 1456	2804	ChainPortsurrogate.exe	38
PID 2804 wrote to memory of 1456	2804	ChainPortsurrogate.exe	38
PID 2804 wrote to memory of 1456	2804	ChainPortsurrogate.exe	38
PID 1456 wrote to memory of 2988	1456	csc.exe	40
PID 1456 wrote to memory of 2988	1456	csc.exe	40
PID 1456 wrote to memory of 2988	1456	csc.exe	40
PID 2804 wrote to memory of 628	2804	ChainPortsurrogate.exe	56
PID 2804 wrote to memory of 628	2804	ChainPortsurrogate.exe	56
PID 2804 wrote to memory of 628	2804	ChainPortsurrogate.exe	56
PID 628 wrote to memory of 768	628	cmd.exe	58
PID 628 wrote to memory of 768	628	cmd.exe	58
PID 628 wrote to memory of 768	628	cmd.exe	58
PID 628 wrote to memory of 1636	628	cmd.exe	59
PID 628 wrote to memory of 1636	628	cmd.exe	59
PID 628 wrote to memory of 1636	628	cmd.exe	59
PID 628 wrote to memory of 2496	628	cmd.exe	60
PID 628 wrote to memory of 2496	628	cmd.exe	60
PID 628 wrote to memory of 2496	628	cmd.exe	60
PID 2496 wrote to memory of 2012	2496	cmd.exe	61
PID 2496 wrote to memory of 2012	2496	cmd.exe	61
PID 2496 wrote to memory of 2012	2496	cmd.exe	61
PID 2012 wrote to memory of 2160	2012	cmd.exe	63
PID 2012 wrote to memory of 2160	2012	cmd.exe	63
PID 2012 wrote to memory of 2160	2012	cmd.exe	63
PID 2012 wrote to memory of 1592	2012	cmd.exe	64
PID 2012 wrote to memory of 1592	2012	cmd.exe	64
PID 2012 wrote to memory of 1592	2012	cmd.exe	64
PID 2012 wrote to memory of 1108	2012	cmd.exe	65
PID 2012 wrote to memory of 1108	2012	cmd.exe	65
PID 2012 wrote to memory of 1108	2012	cmd.exe	65
PID 1108 wrote to memory of 1580	1108	cmd.exe	66
PID 1108 wrote to memory of 1580	1108	cmd.exe	66
PID 1108 wrote to memory of 1580	1108	cmd.exe	66
PID 1580 wrote to memory of 2748	1580	cmd.exe	68
PID 1580 wrote to memory of 2748	1580	cmd.exe	68
PID 1580 wrote to memory of 2748	1580	cmd.exe	68
PID 1580 wrote to memory of 2064	1580	cmd.exe	69
PID 1580 wrote to memory of 2064	1580	cmd.exe	69
PID 1580 wrote to memory of 2064	1580	cmd.exe	69
PID 1580 wrote to memory of 2832	1580	cmd.exe	70
PID 1580 wrote to memory of 2832	1580	cmd.exe	70
PID 1580 wrote to memory of 2832	1580	cmd.exe	70
PID 2832 wrote to memory of 320	2832	cmd.exe	71
PID 2832 wrote to memory of 320	2832	cmd.exe	71
PID 2832 wrote to memory of 320	2832	cmd.exe	71
PID 320 wrote to memory of 1260	320	cmd.exe	73
PID 320 wrote to memory of 1260	320	cmd.exe	73
PID 320 wrote to memory of 1260	320	cmd.exe	73
PID 320 wrote to memory of 2584	320	cmd.exe	74
PID 320 wrote to memory of 2584	320	cmd.exe	74
PID 320 wrote to memory of 2584	320	cmd.exe	74
PID 320 wrote to memory of 2148	320	cmd.exe	75

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SPISOK_DENEG.exe
"C:\Users\Admin\AppData\Local\Temp\SPISOK_DENEG.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProviderserverruntimeperfSvc\4oe8qKx4BC4jNir9oLrOplwqP.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\ProviderserverruntimeperfSvc\wnVkTofZircZrFhWJh5AKDNhgeSRpsYNieNXBbC85wZu.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe
      "C:\ProviderserverruntimeperfSvc/ChainPortsurrogate.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\af3wvvir\af3wvvir.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1456
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC34F.tmp" "c:\Windows\System32\CSC88A88480C1CA404C9BD6D976FC56D118.TMP"
        6⤵
        
        PID:2988
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\N6n2aD9MXM.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:628
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:768
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1636
      - C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\psxgKE21Xe.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1592
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oyk3mdJSzu.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2064
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\thAzAlBiSC.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:320
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2584
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Vg1jnREOGb.bat"
        13⤵
        
        PID:2416
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2888
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2376
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HGbZHomwPb.bat"
        15⤵
        
        PID:2668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2436
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2804
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nNv9Oq8evb.bat"
        17⤵
        
        PID:1704
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2132
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2504
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R64HSi6Xsg.bat"
        19⤵
        
        PID:1968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2696
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1720
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2ERwRXGzbm.bat"
        21⤵
        
        PID:2716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2568
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2832
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CjHAhHKHQf.bat"
        23⤵
        
        PID:2260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1248
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1276
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AcAxalUZZX.bat"
        25⤵
        
        PID:752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1804
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2912
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tOMWzubzd4.bat"
        27⤵
        
        PID:1684
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2120
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:400
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiOMBGhh72.bat"
        29⤵
        
        PID:1724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:1592
        
        C:\Program Files (x86)\Windows Portable Devices\cmd.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\cmd.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\ProviderserverruntimeperfSvc\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\ProviderserverruntimeperfSvc\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\ProviderserverruntimeperfSvc\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainPortsurrogateC" /sc MINUTE /mo 6 /tr "'C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainPortsurrogate" /sc ONLOGON /tr "'C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainPortsurrogateC" /sc MINUTE /mo 10 /tr "'C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProviderserverruntimeperfSvc\4oe8qKx4BC4jNir9oLrOplwqP.vbe

Filesize
250B

MD5
d8776d21a414703fcf32711bb7ecdfb4

SHA1
1c6820ca5097513a2be072a3b43eff1fc8403184

SHA256
bb5a09775dcaeb1c3c4d3cdd4c207c96f1a153aa23fed7512367eca6a3a0c22d

SHA512
ad33ca536cc149301ba111280388a9a6295ddd7c2be76fa3eefba8cab1f2727a4effc57b24adbf0be8f10c2d13872c215f9512dd470990541b39e2d2681595a9

Download Submit
C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe

Filesize
825KB

MD5
ce09db6adeeca051ff01abd8cf2e400d

SHA1
14e60e202c180152757a89d13d9989ec35e1f5a2

SHA256
ad372edd698062a90f4744da16f88cc5bb45ca9b1cb70fc7350673d293f2bc16

SHA512
e80449cde93d19790e64c1fe24af1aeb00a3c392b4d57a529205a2339bbaa675b6ee21d2d068d65ef21c37d23d2f1b8b458706068ffe850410dc290c4d5c0ce3

Download Submit
C:\ProviderserverruntimeperfSvc\wnVkTofZircZrFhWJh5AKDNhgeSRpsYNieNXBbC85wZu.bat

Filesize
110B

MD5
9c91fe8e1765ddf30eda4052cbecbf48

SHA1
8acec401bdec034d55ead6804c69505c1d680e67

SHA256
9420d7930ae9f2040d5b46bc120da24e920fccf6882e69b74269f71e75cc0718

SHA512
e72ec080ae8fc66a5f712e3a525f0013d406b587523b3b6ff8dc80f12f12af183fc77b578293808f07e916a8b6f2252206b3c899200d0f70540cb70de467ea87

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ERwRXGzbm.bat

Filesize
183B

MD5
488336bdcb4302f8a896462ec848150b

SHA1
ecb6475dc786485d27eed75f16378f185a76c001

SHA256
e40c90d9af647b44b9a4d257484d19c07d2331f234c0597ba58eb7a200ae09f7

SHA512
a8bfd4966de12c109ded94d2dbf3ca719eefc82ce7d27a7801190608606d3e545b4b9b7fd1ed071a3aa5d35f0420f74b50789ab93d8647d64ccf0e561abcdfc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\AcAxalUZZX.bat

Filesize
183B

MD5
18d352b5c5a68f25bd5a9a5aefe60f48

SHA1
fb802ac62d1690fca013e2c2f821e66a4021203b

SHA256
ef332d7ba92295a6854ccf1ed7ad5d445a992dce7daf3b247aaf4f3bb352faab

SHA512
7e579aac26932126d7930a9ad9d702d2eae66d6a3a40a60d9898ca82ae4e78254a2c449fca9a88af8b13eb3a6e65574bcf0e2b71b007f108598b8b95b9423171

Download Submit
C:\Users\Admin\AppData\Local\Temp\CjHAhHKHQf.bat

Filesize
231B

MD5
95fa6ec3c0733016b9386feca461ebf4

SHA1
ea9a4e3180dea2967883f2b6abd1a3e44748443c

SHA256
36fc02bf31e5cdf07a29afceb6f9faedce2d85f7056fc9e31fa051775b5303bf

SHA512
c62413a083b9c007ead3ae257b51b84eb04da436531bd04949446a2cba829524821a464069261c1f5748fd45dace11c19b9459557804c5c79aa1940e8e4f08fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\HGbZHomwPb.bat

Filesize
231B

MD5
2edcc0e3ca02d1b7b410d5cc214d7359

SHA1
5cd658cf5fdcb2c8547d3211ec27705142e89759

SHA256
b4a47e4486577ca9565bb91f65d1c77a8720f20277d7a5a5f780dbe0797ce994

SHA512
5918a3f9795075db0bc9a0cb1561e1bea2be6edca99815657320a3205d2e24ba697311c5427cd475aca1a507dfc3f0924609f36ec2ad7f2f1846e29d73122245

Download Submit
C:\Users\Admin\AppData\Local\Temp\N6n2aD9MXM.bat

Filesize
231B

MD5
68d053d1d8587d9c6bf5351549a55ab0

SHA1
d6bd57a6e7b2e569e601a1a0e3f824809c280b10

SHA256
c671725fef35146d5929c2f5c3ff79aa4d813109e943e40c9c8626e7ea5e1a37

SHA512
82f2cc42bf54908716354938f52f9b9ea2947634a115088840056b56511c5f2fe98cc806ae086df43c626088e737e780a22ee4834eaa658996f5589b3bb6bee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\NiOMBGhh72.bat

Filesize
231B

MD5
3a45575cbbfe6964f9e966290cc388a8

SHA1
205d69226e3bed8c1d7fc49490f334cf670869c2

SHA256
1c9807d3a995f17df251043f3bef41101f2e78994879f6ba62adcf8c7fd0e31b

SHA512
1f5221b5974e53fae28a4bf0008769e4bc288fed06379457971e78d90a3885181727bb7e70cdcdbbc840ea376cc8d5f7ba1370de1f7c1cccec7765e0213f8ef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\R64HSi6Xsg.bat

Filesize
183B

MD5
1dce97c977d9186c5a3a5a880af97ebb

SHA1
17186bed371be70226d0ec18dfdfe741206fe1b1

SHA256
ce4275b18a9d6002a84ff84f9973d1e4011ce751380742e7b10f3ebd224be556

SHA512
c9c61e7eb68c2b571b26025b72b23e7ec428b83821e3795f2f496de4bce95027dca9c3aa9a3109f0dbcd6e6fbc41990e56f811b88db70fa869b8ec1034fa0fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC34F.tmp

Filesize
1KB

MD5
b81eacf5395ef65ed26c850cf6cd3ba9

SHA1
5c505d9ebe173bd6ca19418dcf073c275f922833

SHA256
a4308721c5123029ca73a369bf27114551c7362e555e4ed75956cb45d2ccb119

SHA512
274c80b4c015dff20dcb2448000353ba8349dc78d6d57240f917c27e6e4334b74b3edd42708e80ccc0e675bff3fe835d51a3c725faed4122a191d9f8b583f3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vg1jnREOGb.bat

Filesize
183B

MD5
6116e4259371757e23feba2a46442553

SHA1
e360eebb8c7e532e9fbab866960644cacfbda37e

SHA256
e64ada7b48813273d2725a8fd1879ada0297e57c95483131c1c14b61907fa476

SHA512
bb86283cb7069262c140441baba1f0c3845ebe3aec2a87a66dd143a434f7195d34e0fbed64ab7d652ab0fd6ba1555f7fe06df3919f03dd3225e9829109017b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\nNv9Oq8evb.bat

Filesize
183B

MD5
54ab32d89365d2f2c57c1546a994a6dd

SHA1
3a9ad94890bcc507924d695856bbff2cc916dcca

SHA256
f0869b340e8e5e141e3bc940e457618657d92d556d072d2b0b600c94d8b36f34

SHA512
67c1b248b53411cd99e60219ab5f635dec3e4444e681068a1b507a60735c7807695758531351fb4ea8f78a34e240c7349bb953a12369abc1280be416e87b1abf

Download Submit
C:\Users\Admin\AppData\Local\Temp\oyk3mdJSzu.bat

Filesize
231B

MD5
e67d6cd37aa9b6c90eabdec01ea17262

SHA1
0325520a5b06c70e1beed4b672c5e3d2d32dbf16

SHA256
47ddd68f1b9c2d64a0e8507421323f4047ee589169b523adf83682a65bf7cae2

SHA512
fff32ac68c701dbe784c9153bec223df5491435ad0f9f8d45d2bca5603c3b9f7a021a81aba75bcab957821b269ab7b560bf5bca677fd34f32d685d9668ff804e

Download Submit
C:\Users\Admin\AppData\Local\Temp\psxgKE21Xe.bat

Filesize
231B

MD5
2b2bd3981849a7a5259d878fefa4080a

SHA1
d631377fa85af4c3693f748f3e5c469fbe01ced1

SHA256
7398b744b5648defe412a954e6d1699b24c0ec73a4b99c3c9700363b2eb8c26f

SHA512
aaa04f354dd7df383680afacf11f53ed1d7ae53841946c07bb16a38e92bffc6ac2395a23d06c20af724b0692bd3c45a6c4e7181e1cbaaa80bd57968999af89d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tOMWzubzd4.bat

Filesize
231B

MD5
ba6cbd0e99bc927c87dc8d3b2a9834ca

SHA1
e632907a38229978747d613a01560fffc412106d

SHA256
817dd3319b4f8389ce07b2a3c74aaee67e7880cf4ca101e3d0f989fb2b4dc3b4

SHA512
b30b5384b1a228c71ff9d7770ac9970a8aa70834586c11159545c209ce078930062781ec64dd793253fe7cd32dab08d2636dbdf323fad3ed923d90357d88bea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\thAzAlBiSC.bat

Filesize
231B

MD5
2920baa4b3592f60adcf36c6acadb8fb

SHA1
6f61a94b4814ee060adc3e67bea1d208ad7a51b8

SHA256
8085ffb800c800c4cbda7d22d4bd080008bf2c99f8680c3d21f640bb4eb71950

SHA512
26e6dae7a360c0aec8a3360e85f589f5bdfc12aea2688d744f7f3d1d94941faa8b0dd576377ba8ebb7a8720d096e4b4ef0d91139cb4e07dc9f4674fe121cb4c5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\af3wvvir\af3wvvir.0.cs

Filesize
387B

MD5
c371a4f04056f77e10b8702ac0740857

SHA1
59b6a476b51c49b708c85b264fa0dd7893494d83

SHA256
b752c26e1a0a47f3122f97cd32ffbc3e1c74eb4ea19d8615e2be8a7bf56821b7

SHA512
dfe581b38821bec57c5fcf82cd1c87f7b258304742547df0d5446e53a692952bd326fab0dbcca3ec777103c30c8dbba0e02833ccc057824f3eef132e53287908

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\af3wvvir\af3wvvir.cmdline

Filesize
235B

MD5
c7afa016b23774e649380ef7004157ed

SHA1
ad31819af71f60cbbbb495b6e3c629ea8f0a87b2

SHA256
e74ad7599f3e3e3e0d1b44c379377b148944d79d2b406af2b0f68cff4499e874

SHA512
ac38c08e41d1bbe9a4497fa4868eb66f41d112cb4e7ee6ceb32ec15ef5172e8231b16f5148e96c71893b1d4f4d3159cc812aae3afaf3d954ada9d94baa9ba67e

Download Submit
\??\c:\Windows\System32\CSC88A88480C1CA404C9BD6D976FC56D118.TMP

Filesize
1KB

MD5
332eb1c3dc41d312a6495d9ea0a81166

SHA1
1d5c1b68be781b14620d9e98183506f8651f4afd

SHA256
bab20fa8251fcee3c944e76bdc082850ae4a32fd2eff761fec3bc445f58d11f2

SHA512
2c5ae1de2d4cb7f1e1540b455f7876eb1f494cda57bfb8e78a81aa01f3f453c5488b986cd170d6dc96bf684874c54257bfd0335a78764cc3fa43fe310a0cf440

Download Submit
memory/820-183-0x0000000001040000-0x0000000001114000-memory.dmp

Filesize
848KB

Download
memory/936-102-0x00000000012E0000-0x00000000013B4000-memory.dmp

Filesize
848KB

Download
memory/1108-66-0x0000000001050000-0x0000000001124000-memory.dmp

Filesize
848KB

Download
memory/1900-159-0x0000000000140000-0x0000000000214000-memory.dmp

Filesize
848KB

Download
memory/2148-90-0x00000000000A0000-0x0000000000174000-memory.dmp

Filesize
848KB

Download
memory/2160-125-0x0000000000FE0000-0x00000000010B4000-memory.dmp

Filesize
848KB

Download
memory/2160-195-0x0000000001330000-0x0000000001404000-memory.dmp

Filesize
848KB

Download
memory/2496-54-0x0000000000320000-0x00000000003F4000-memory.dmp

Filesize
848KB

Download
memory/2624-171-0x0000000000DA0000-0x0000000000E74000-memory.dmp

Filesize
848KB

Download
memory/2804-19-0x0000000000800000-0x0000000000818000-memory.dmp

Filesize
96KB

Download
memory/2804-17-0x00000000007E0000-0x00000000007FC000-memory.dmp

Filesize
112KB

Download
memory/2804-15-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/2804-21-0x0000000000610000-0x000000000061E000-memory.dmp

Filesize
56KB

Download
memory/2804-13-0x00000000008A0000-0x0000000000974000-memory.dmp

Filesize
848KB

Download
memory/2804-23-0x0000000000620000-0x000000000062E000-memory.dmp

Filesize
56KB

Download
memory/2832-78-0x00000000000F0000-0x00000000001C4000-memory.dmp

Filesize
848KB

Download