dcrat | 3e60ac6ac6c4fc9f90b87dde23d1261ac236782de1b00cca97bdf950019ee3a3

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bridgenet.exe.bin.exe
Size

1.6MB
MD5

13a9fe232c423531f428e7ebf5bcc3ce
SHA1

7940d3296d943f8f54e6d2e58982812de6f66a79
SHA256

3e60ac6ac6c4fc9f90b87dde23d1261ac236782de1b00cca97bdf950019ee3a3
SHA512

ed6f68b31f034c49b6ef9a79a793d5ba46d6a8cffca33f1f5cdbb3db51ac6ae9ea5aa39ea7dede138c832b2a47c9f484441f549b163254bdbf5566a4590042f5
SSDEEP

24576:Dl2UpmjCMYU6XtQCBRSybXZgRRNsSSzUcYUHcAtRTjeXRE7QSvMllsWH4Xsmnobb:BdtdQCBRZX3HYUPtRTjmcQSTWH4Xshb

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1876	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	1876	schtasks.exe	82

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	bridgenet.exe.bin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 17 IoCs

pid	Process
3388	fontdrvhost.exe
844	fontdrvhost.exe
2004	fontdrvhost.exe
1976	fontdrvhost.exe
2052	fontdrvhost.exe
4368	fontdrvhost.exe
4740	fontdrvhost.exe
2032	fontdrvhost.exe
4924	fontdrvhost.exe
2932	fontdrvhost.exe
1724	fontdrvhost.exe
4368	fontdrvhost.exe
112	fontdrvhost.exe
2032	fontdrvhost.exe
3456	fontdrvhost.exe
528	fontdrvhost.exe
3256	fontdrvhost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\Speech\Common\fr-FR\taskhostw.exe	bridgenet.exe.bin.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\de-DE\Idle.exe	bridgenet.exe.bin.exe
File created	C:\Windows\de-DE\6ccacd8608530f	bridgenet.exe.bin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3724	PING.EXE
1016	PING.EXE
4444	PING.EXE
2220	PING.EXE
528	PING.EXE
2288	PING.EXE

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	bridgenet.exe.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	fontdrvhost.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
528	PING.EXE
2288	PING.EXE
3724	PING.EXE
1016	PING.EXE
4444	PING.EXE
2220	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3724	schtasks.exe
4460	schtasks.exe
3972	schtasks.exe
4936	schtasks.exe
2836	schtasks.exe
2920	schtasks.exe
2440	schtasks.exe
5068	schtasks.exe
2476	schtasks.exe
4636	schtasks.exe
8	schtasks.exe
2040	schtasks.exe
3768	schtasks.exe
452	schtasks.exe
3300	schtasks.exe
2404	schtasks.exe
3720	schtasks.exe
1648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
2156	bridgenet.exe.bin.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
3388	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
844	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
2004	fontdrvhost.exe
1976	fontdrvhost.exe
1976	fontdrvhost.exe
1976	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	bridgenet.exe.bin.exe
Token: SeDebugPrivilege	3388	fontdrvhost.exe
Token: SeDebugPrivilege	844	fontdrvhost.exe
Token: SeDebugPrivilege	2004	fontdrvhost.exe
Token: SeDebugPrivilege	1976	fontdrvhost.exe
Token: SeDebugPrivilege	2052	fontdrvhost.exe
Token: SeDebugPrivilege	4368	fontdrvhost.exe
Token: SeDebugPrivilege	4740	fontdrvhost.exe
Token: SeDebugPrivilege	2032	fontdrvhost.exe
Token: SeDebugPrivilege	4924	fontdrvhost.exe
Token: SeDebugPrivilege	2932	fontdrvhost.exe
Token: SeDebugPrivilege	1724	fontdrvhost.exe
Token: SeDebugPrivilege	4368	fontdrvhost.exe
Token: SeDebugPrivilege	112	fontdrvhost.exe
Token: SeDebugPrivilege	2032	fontdrvhost.exe
Token: SeDebugPrivilege	3456	fontdrvhost.exe
Token: SeDebugPrivilege	528	fontdrvhost.exe
Token: SeDebugPrivilege	3256	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1068	2156	bridgenet.exe.bin.exe	101
PID 2156 wrote to memory of 1068	2156	bridgenet.exe.bin.exe	101
PID 1068 wrote to memory of 3380	1068	cmd.exe	104
PID 1068 wrote to memory of 3380	1068	cmd.exe	104
PID 1068 wrote to memory of 528	1068	cmd.exe	105
PID 1068 wrote to memory of 528	1068	cmd.exe	105
PID 1068 wrote to memory of 3388	1068	cmd.exe	113
PID 1068 wrote to memory of 3388	1068	cmd.exe	113
PID 3388 wrote to memory of 2168	3388	fontdrvhost.exe	115
PID 3388 wrote to memory of 2168	3388	fontdrvhost.exe	115
PID 2168 wrote to memory of 4088	2168	cmd.exe	117
PID 2168 wrote to memory of 4088	2168	cmd.exe	117
PID 2168 wrote to memory of 2288	2168	cmd.exe	118
PID 2168 wrote to memory of 2288	2168	cmd.exe	118
PID 2168 wrote to memory of 844	2168	cmd.exe	124
PID 2168 wrote to memory of 844	2168	cmd.exe	124
PID 844 wrote to memory of 3288	844	fontdrvhost.exe	126
PID 844 wrote to memory of 3288	844	fontdrvhost.exe	126
PID 3288 wrote to memory of 4544	3288	cmd.exe	128
PID 3288 wrote to memory of 4544	3288	cmd.exe	128
PID 3288 wrote to memory of 3396	3288	cmd.exe	129
PID 3288 wrote to memory of 3396	3288	cmd.exe	129
PID 3288 wrote to memory of 2004	3288	cmd.exe	133
PID 3288 wrote to memory of 2004	3288	cmd.exe	133
PID 2004 wrote to memory of 3880	2004	fontdrvhost.exe	135
PID 2004 wrote to memory of 3880	2004	fontdrvhost.exe	135
PID 3880 wrote to memory of 1648	3880	cmd.exe	137
PID 3880 wrote to memory of 1648	3880	cmd.exe	137
PID 3880 wrote to memory of 3724	3880	cmd.exe	138
PID 3880 wrote to memory of 3724	3880	cmd.exe	138
PID 3880 wrote to memory of 1976	3880	cmd.exe	141
PID 3880 wrote to memory of 1976	3880	cmd.exe	141
PID 1976 wrote to memory of 4100	1976	fontdrvhost.exe	143
PID 1976 wrote to memory of 4100	1976	fontdrvhost.exe	143
PID 4100 wrote to memory of 1464	4100	cmd.exe	145
PID 4100 wrote to memory of 1464	4100	cmd.exe	145
PID 4100 wrote to memory of 4632	4100	cmd.exe	146
PID 4100 wrote to memory of 4632	4100	cmd.exe	146
PID 4100 wrote to memory of 2052	4100	cmd.exe	148
PID 4100 wrote to memory of 2052	4100	cmd.exe	148
PID 2052 wrote to memory of 2676	2052	fontdrvhost.exe	150
PID 2052 wrote to memory of 2676	2052	fontdrvhost.exe	150
PID 2676 wrote to memory of 5116	2676	cmd.exe	152
PID 2676 wrote to memory of 5116	2676	cmd.exe	152
PID 2676 wrote to memory of 4288	2676	cmd.exe	153
PID 2676 wrote to memory of 4288	2676	cmd.exe	153
PID 2676 wrote to memory of 4368	2676	cmd.exe	155
PID 2676 wrote to memory of 4368	2676	cmd.exe	155
PID 4368 wrote to memory of 3016	4368	fontdrvhost.exe	157
PID 4368 wrote to memory of 3016	4368	fontdrvhost.exe	157
PID 3016 wrote to memory of 2556	3016	cmd.exe	159
PID 3016 wrote to memory of 2556	3016	cmd.exe	159
PID 3016 wrote to memory of 4184	3016	cmd.exe	160
PID 3016 wrote to memory of 4184	3016	cmd.exe	160
PID 3016 wrote to memory of 4740	3016	cmd.exe	163
PID 3016 wrote to memory of 4740	3016	cmd.exe	163
PID 4740 wrote to memory of 4892	4740	fontdrvhost.exe	165
PID 4740 wrote to memory of 4892	4740	fontdrvhost.exe	165
PID 4892 wrote to memory of 8	4892	cmd.exe	167
PID 4892 wrote to memory of 8	4892	cmd.exe	167
PID 4892 wrote to memory of 3396	4892	cmd.exe	168
PID 4892 wrote to memory of 3396	4892	cmd.exe	168
PID 4892 wrote to memory of 2032	4892	cmd.exe	170
PID 4892 wrote to memory of 2032	4892	cmd.exe	170

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bridgenet.exe.bin.exe
"C:\Users\Admin\AppData\Local\Temp\bridgenet.exe.bin.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0YZOWgMQdt.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3380
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:528
- - C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
    "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oe8YqT2ALj.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4088
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2288
    - - C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:844
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sMcwJl1juU.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3396
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IB3ybkF286.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3724
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X8rw0eVXoN.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1464
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4632
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fDDEz4CMJh.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:5116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4288
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\psxgKE21Xe.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2556
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4184
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Vs6Gb3dzjw.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:8
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3396
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ndC0udATSD.bat"
        18⤵
        
        PID:4072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2836
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ETZZ9TGUYL.bat"
        20⤵
        
        PID:4548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:2760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1016
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NnkzcdwAFb.bat"
        22⤵
        
        PID:4604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2052
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eyO6VICV7m.bat"
        24⤵
        
        PID:3912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4372
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4444
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Qwmke0eayG.bat"
        26⤵
        
        PID:1496
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:3168
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:436
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Vs6Gb3dzjw.bat"
        28⤵
        
        PID:4968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:4892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:4156
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IqQTfaxkTv.bat"
        30⤵
        
        PID:1684
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:3780
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:2836
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SPR0cWdHM6.bat"
        32⤵
        
        PID:2572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:3688
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        33⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2220
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        33⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\psxgKE21Xe.bat"
        34⤵
        
        PID:4596
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:3388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        35⤵
        
        PID:1652
        
        C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe
        
        "C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe"
        35⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jvhcSLBvsS.bat"
        36⤵
        
        PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Downloads\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default\Downloads\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Downloads\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bridgenet.exe.binb" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\bridgenet.exe.bin.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bridgenet.exe.bin" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\bridgenet.exe.bin.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bridgenet.exe.binb" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\bridgenet.exe.bin.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Filesize
1KB

MD5
11aa02596ceccef38b448c52a899f470

SHA1
6da94dc9579e969d39d5e65c066af3a5251e39b4

SHA256
e778ec777a79a1a9c9a3b605ab9681558395d2f3ef46f6c34dca1e00dcd771fd

SHA512
5de4fd51ae76cce8de25c5257ee873a71668acdf407bc3351410f9f840a9b074099d4c018657d2cc8f33273e6fd03e4365165e4834ba12c052d735212bf5d0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\0YZOWgMQdt.bat

Filesize
201B

MD5
75981fb4131fc48a86124dbd55f54b9e

SHA1
3f8a36f18de75b966729376b7335bb35e400059a

SHA256
b0f4e252005c8d231092e8792018e90e87a37306cccf9f8338ef0a6d2f9193f8

SHA512
0da67c6386361a289b2e4b15f90bfad94f7e01b146db1add49ee5c920f91d59d9cd4aa1b791e788d9ca41916c03de0d35ad00625a95bb681537cf79c73cad90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ETZZ9TGUYL.bat

Filesize
201B

MD5
1388738230c8fd099df0553c83987418

SHA1
f39c173496bc7a5fd38dbdfdcfacf711c73ccb96

SHA256
0db7c239de578a413edd2332cc2c80400c09bc812df7700100864de751688ade

SHA512
1566a14415c8b56cdd4b5e11fe48fd252a5cfc192ba7646265d6c9ac7f69bc66af072197410db78f5fbb6c4e1d66bc41e5b0d9f6755ae5f6e296fbbda34e2cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IB3ybkF286.bat

Filesize
201B

MD5
79c307125c965b007a85975de0f4b44a

SHA1
500488b5e8e707be8d7406d90981f8ae0e976e5f

SHA256
5e42558f8df065d24ab765c9ab14525253c084233dd87bf917a243b115dc54f4

SHA512
6c8769aac3b08590b8a1e0d2609faf732c41308bee4476b437570168c6d2f094187ad4858c7c56c3eb88230cdcfe05cec3d3a2558bfca85308dab024e9a7ef01

Download Submit
C:\Users\Admin\AppData\Local\Temp\IqQTfaxkTv.bat

Filesize
249B

MD5
c42622cccaad166f4839f5e9db341c39

SHA1
f36c2b7abc847b03e46ffa3342207940486a8b15

SHA256
6bb8ab499a27a6ea689bc91486b4f33ad9c364c5c64afff44b537b151f144a1b

SHA512
79c6171ec835f6ec54b42cae3fcb226c1582e72669c842238765d00f883377788b004991a58731c1964f68740c5d5dcf22b79af521773bb98cebca20b92df567

Download Submit
C:\Users\Admin\AppData\Local\Temp\NnkzcdwAFb.bat

Filesize
249B

MD5
e95186250a76d510d773020c22138103

SHA1
dd832eebdc2c9ea3ac67ef7b7c6bb1e3aa587912

SHA256
017decdb2a13df07d9adbe7bf126af877de461a63fec52d615121b919ad4b7be

SHA512
f9671077c43b5dde46df8c0b2cbf4948d7d0a2178f0344b78e0458dd38332f7320e8eb81b6037bb6f6492792b577f46c2d854310dd45353fa1033e4aa49c9100

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qwmke0eayG.bat

Filesize
249B

MD5
83bb62b0fa0896d42734e9cc1096a17b

SHA1
b54d44ab47fa15a875e07e893e43bb8fdc9cdf77

SHA256
d2c5bcfa2dab418d94c32ac3747e13c526cc0e6e597eaff050c2e0de728bfbc6

SHA512
f3a5cdadc5f0e0a5c43cc96ba861a74dacaef4427cb8a6529a2f98f0fefcfe9f258802fec4bd2abdf8f0aca0851390a0e1d85078f5ef159a5a928df27b15a07d

Download Submit
C:\Users\Admin\AppData\Local\Temp\SPR0cWdHM6.bat

Filesize
201B

MD5
d9cf1e90a970e4a3c0c3e79af0e0e5b5

SHA1
6d6a7ac2d72ab134bf8951dc59f9adbacd7e9714

SHA256
f52e2a620df67a4152d86a8e5deeed0bf90a7963118ddbae54e968f3ae9d6ab5

SHA512
a9c89f2cdcadbe2ec9b41cb398da4fd9b80f3ebe20511e2d5dad0cd4c4e0661b3d2ced6dc6c71c6dcb459fab9ddf994f423dedd184b4de01c7e4ead122d7ae0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vs6Gb3dzjw.bat

Filesize
249B

MD5
1fb9fc228f6dfc2e2b2e1787f39dd94e

SHA1
2c2e2ee518cb85c5404e66328593997f9548bb6c

SHA256
433313d289b867e0554e7ff860ffb1e8386681aa52de8ad094188a63b8bfcf57

SHA512
91ebffa02cdd87240ae54c24403a276da828e444985aa8e242d61bf46003e0865449714bb3486e2c5889143fe42d25eca535d22afaa429125d99e6a086a68e32

Download Submit
C:\Users\Admin\AppData\Local\Temp\X8rw0eVXoN.bat

Filesize
249B

MD5
0b859cc73a5c9e77879baac4c135c8f9

SHA1
f9ae5c8015d55849f5eec67fcc14a50dfd67d653

SHA256
c26378abd07580a76d572676e397fb8d944f16bae7022a8a30ce08da30a15f18

SHA512
11735b124a2206b354bba3f04d83838fbc538f19c685a979602a7fc396cd0b0b0af4bc292d24716903ad14ec95d2023225e2ddcedfc293b0e7416f104ed1cf7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\eyO6VICV7m.bat

Filesize
201B

MD5
19773f88dbafd311e97c670f83b144e5

SHA1
801e45b0a532d5144f90a048a984dfaf73b1d1b7

SHA256
f8d912448f7ce2551fe4961e9068082abc26432f86ea2e65804560f96563317a

SHA512
6d91c100c0b67d3dcb4fa05a06cfd7e7b121e71a766f2364630e2da0a25017c1494852b6c5c6cffda5bc42977711ef590616ad06b9e45544de5be1ac713db14e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fDDEz4CMJh.bat

Filesize
249B

MD5
13dff4db9a80eaf967f7b4cba3099594

SHA1
486c3cadbc46cbbffb398dfa5d43f6ad55c76ce3

SHA256
fbed63ab688e70092bd91783cd72971a2fdef3fa6518656a3e1020a42e3b4574

SHA512
725e21bd7f52fb4bc658c606a9ec863f1aa3ac6a3c8bbb5c09970fb13149241f178861bb630812d6898ed69266bd1f1e80993efba423960dfb2edcda23cf5a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndC0udATSD.bat

Filesize
249B

MD5
5d7919ee070555f7bafa56adf6baa500

SHA1
188ba2ac61b4469294968cf816508e2aaad51769

SHA256
5d27f95a688b5cc117f7f8e2e6ee30a4cf0dbd76d3cb742cec571f827a5cb758

SHA512
5ad5ac60940cae19e6deb8ad63e8ad2bb3cd392769e070b6efe8ae3e44fed8ffc5b64f60f17374e667045f3a7cd8d187c832424444ffa86c9904b69e8ed0831a

Download Submit
C:\Users\Admin\AppData\Local\Temp\oe8YqT2ALj.bat

Filesize
201B

MD5
eb0b4ac153a3fe9580672ac866028213

SHA1
5a3f19cfe0cd4373885c80fad907f0808424e613

SHA256
fc1e2e13f0820a1252adcdd1486972e3b70fca25f89421e2cf6b5eb99d2efb88

SHA512
e22e436436bfa71aaaa7d3a68f5ebf5ca017f6b654e560c2afda43141a0a464bb80131e1e47085680135427e8dfba142dd26ec9c10bbfe63c2292afe0aa8c2d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\psxgKE21Xe.bat

Filesize
249B

MD5
a5cc5de0bbcf1d02f39b524721ba6ed5

SHA1
9deb08846056b9e75b379cb2694f101fbf3c8bd5

SHA256
e3e5c48f8e36611703d46151d08c45edeb00bf2b040881233378856d8b0069f5

SHA512
4a6e93b51912e8ac457fd2e8e4e812164671a53c8da93d2c8d631052eb62b0373fc39e0f4fdf57136283fc7803fc876e142ea534ab639307834dc07602c064a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\sMcwJl1juU.bat

Filesize
249B

MD5
c066a8efe6d607068694dcc6a864aa0b

SHA1
ee1b6cdace2545a61838ecb324a7d96c82f2c452

SHA256
5d0b6b92929528c5748eccc91355419fa29620e403c6fd610b4c700cfbab0482

SHA512
bc1d868906e0f1b61dc0c9865b855ddba90acdf71480fa640ed185128f3f891323fca86dde0e91770fb46ab4d7d5893dbd7d9c4d60653e95b1a6ae9e32576b89

Download Submit
C:\Users\Default\Downloads\backgroundTaskHost.exe

Filesize
1.6MB

MD5
13a9fe232c423531f428e7ebf5bcc3ce

SHA1
7940d3296d943f8f54e6d2e58982812de6f66a79

SHA256
3e60ac6ac6c4fc9f90b87dde23d1261ac236782de1b00cca97bdf950019ee3a3

SHA512
ed6f68b31f034c49b6ef9a79a793d5ba46d6a8cffca33f1f5cdbb3db51ac6ae9ea5aa39ea7dede138c832b2a47c9f484441f549b163254bdbf5566a4590042f5

Download Submit
memory/844-46-0x000000001C7E0000-0x000000001C989000-memory.dmp

Filesize
1.7MB

Download
memory/2004-54-0x000000001C0F0000-0x000000001C299000-memory.dmp

Filesize
1.7MB

Download
memory/2156-0-0x00007FF8563B3000-0x00007FF8563B5000-memory.dmp

Filesize
8KB

Download
memory/2156-20-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download
memory/2156-21-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download
memory/2156-19-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download
memory/2156-27-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download
memory/2156-8-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download
memory/2156-6-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download
memory/2156-5-0x00000000026F0000-0x00000000026FE000-memory.dmp

Filesize
56KB

Download
memory/2156-3-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download
memory/2156-2-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

Filesize
10.8MB

Download
memory/2156-1-0x0000000000440000-0x00000000005E2000-memory.dmp

Filesize
1.6MB

Download