dcrat | 595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595.exe
Size

1.1MB
MD5

490aa1e56fab47858d780a9fdbafb5bf
SHA1

337d8c93caf41a62f0720ae1f0c02d262ac0a274
SHA256

595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595
SHA512

7ff8f6983c789f78f67063745fef92040bb5cb88463e82f6a9f05ba0b48021bd2c541cec6e06726748547f0800abd14dd52fe798feddcb1427a46b87619a4f00
SSDEEP

24576:2TbBv5rUyXV0VTney9cyQJMA+b3iE0nHA6E:IBJgTney9clmA+b3KHe

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Office14\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\audiodg.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Office14\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\audiodg.exe\", \"C:\\Program Files\\Java\\jdk1.7.0_80\\include\\win32\\bridge\\explorer.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Office14\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\audiodg.exe\", \"C:\\Program Files\\Java\\jdk1.7.0_80\\include\\win32\\bridge\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Office14\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\audiodg.exe\", \"C:\\Program Files\\Java\\jdk1.7.0_80\\include\\win32\\bridge\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\", \"C:\\ProviderserverruntimeperfSvc\\ChainPortsurrogate.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\dllhost.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Office14\\explorer.exe\""	ChainPortsurrogate.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	1900	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	1900	schtasks.exe	35

DCRat payload 10 IoCs

rat

resource	yara_rule
behavioral1/files/0x0009000000015d41-12.dat	family_dcrat_v2
behavioral1/memory/2332-13-0x00000000003E0000-0x00000000004B4000-memory.dmp	family_dcrat_v2
behavioral1/memory/1328-54-0x0000000000D00000-0x0000000000DD4000-memory.dmp	family_dcrat_v2
behavioral1/memory/2908-66-0x00000000000B0000-0x0000000000184000-memory.dmp	family_dcrat_v2
behavioral1/memory/536-78-0x0000000000920000-0x00000000009F4000-memory.dmp	family_dcrat_v2
behavioral1/memory/2932-90-0x0000000000090000-0x0000000000164000-memory.dmp	family_dcrat_v2
behavioral1/memory/2516-102-0x0000000000A30000-0x0000000000B04000-memory.dmp	family_dcrat_v2
behavioral1/memory/2228-114-0x00000000000D0000-0x00000000001A4000-memory.dmp	family_dcrat_v2
behavioral1/memory/1504-126-0x00000000011C0000-0x0000000001294000-memory.dmp	family_dcrat_v2
behavioral1/memory/992-149-0x0000000001290000-0x0000000001364000-memory.dmp	family_dcrat_v2

Executes dropped EXE 13 IoCs

pid	Process
2332	ChainPortsurrogate.exe
1328	explorer.exe
2908	explorer.exe
536	explorer.exe
2932	explorer.exe
2516	explorer.exe
2228	explorer.exe
1504	explorer.exe
2092	explorer.exe
992	explorer.exe
2492	explorer.exe
2556	explorer.exe
2520	explorer.exe

Loads dropped DLL 2 IoCs

pid	Process
856	cmd.exe
856	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\audiodg.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChainPortsurrogate = "\"C:\\ProviderserverruntimeperfSvc\\ChainPortsurrogate.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\explorer.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\dllhost.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\explorer.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\audiodg.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Java\\jdk1.7.0_80\\include\\win32\\bridge\\explorer.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Java\\jdk1.7.0_80\\include\\win32\\bridge\\explorer.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\WMIADAP.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\dllhost.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChainPortsurrogate = "\"C:\\ProviderserverruntimeperfSvc\\ChainPortsurrogate.exe\""	ChainPortsurrogate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCF3A47637B1B4A69993D9F281FDDC6.TMP	csc.exe
File created	\??\c:\Windows\System32\gxbog2.exe	csc.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe	ChainPortsurrogate.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\7a0fd90576e088	ChainPortsurrogate.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\dllhost.exe	ChainPortsurrogate.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\5940a34987c991	ChainPortsurrogate.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\explorer.exe	ChainPortsurrogate.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\7a0fd90576e088	ChainPortsurrogate.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\audiodg.exe	ChainPortsurrogate.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\42af1c969fbb7b	ChainPortsurrogate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1940	PING.EXE
1196	PING.EXE
1804	PING.EXE
1884	PING.EXE
2068	PING.EXE
2148	PING.EXE

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
1196	PING.EXE
1804	PING.EXE
1884	PING.EXE
2068	PING.EXE
2148	PING.EXE
1940	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2068	schtasks.exe
872	schtasks.exe
2044	schtasks.exe
2956	schtasks.exe
2280	schtasks.exe
1804	schtasks.exe
1436	schtasks.exe
2632	schtasks.exe
1132	schtasks.exe
1564	schtasks.exe
340	schtasks.exe
1732	schtasks.exe
2216	schtasks.exe
2052	schtasks.exe
3052	schtasks.exe
2132	schtasks.exe
2480	schtasks.exe
1320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe
2332	ChainPortsurrogate.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	ChainPortsurrogate.exe
Token: SeDebugPrivilege	1328	explorer.exe
Token: SeDebugPrivilege	2908	explorer.exe
Token: SeDebugPrivilege	536	explorer.exe
Token: SeDebugPrivilege	2932	explorer.exe
Token: SeDebugPrivilege	2516	explorer.exe
Token: SeDebugPrivilege	2228	explorer.exe
Token: SeDebugPrivilege	1504	explorer.exe
Token: SeDebugPrivilege	2092	explorer.exe
Token: SeDebugPrivilege	992	explorer.exe
Token: SeDebugPrivilege	2492	explorer.exe
Token: SeDebugPrivilege	2556	explorer.exe
Token: SeDebugPrivilege	2520	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 536	1692	595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595.exe	30
PID 1692 wrote to memory of 536	1692	595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595.exe	30
PID 1692 wrote to memory of 536	1692	595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595.exe	30
PID 1692 wrote to memory of 536	1692	595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595.exe	30
PID 536 wrote to memory of 856	536	WScript.exe	32
PID 536 wrote to memory of 856	536	WScript.exe	32
PID 536 wrote to memory of 856	536	WScript.exe	32
PID 536 wrote to memory of 856	536	WScript.exe	32
PID 856 wrote to memory of 2332	856	cmd.exe	34
PID 856 wrote to memory of 2332	856	cmd.exe	34
PID 856 wrote to memory of 2332	856	cmd.exe	34
PID 856 wrote to memory of 2332	856	cmd.exe	34
PID 2332 wrote to memory of 2232	2332	ChainPortsurrogate.exe	39
PID 2332 wrote to memory of 2232	2332	ChainPortsurrogate.exe	39
PID 2332 wrote to memory of 2232	2332	ChainPortsurrogate.exe	39
PID 2232 wrote to memory of 1880	2232	csc.exe	41
PID 2232 wrote to memory of 1880	2232	csc.exe	41
PID 2232 wrote to memory of 1880	2232	csc.exe	41
PID 2332 wrote to memory of 1032	2332	ChainPortsurrogate.exe	57
PID 2332 wrote to memory of 1032	2332	ChainPortsurrogate.exe	57
PID 2332 wrote to memory of 1032	2332	ChainPortsurrogate.exe	57
PID 1032 wrote to memory of 844	1032	cmd.exe	59
PID 1032 wrote to memory of 844	1032	cmd.exe	59
PID 1032 wrote to memory of 844	1032	cmd.exe	59
PID 1032 wrote to memory of 1508	1032	cmd.exe	60
PID 1032 wrote to memory of 1508	1032	cmd.exe	60
PID 1032 wrote to memory of 1508	1032	cmd.exe	60
PID 1032 wrote to memory of 1328	1032	cmd.exe	61
PID 1032 wrote to memory of 1328	1032	cmd.exe	61
PID 1032 wrote to memory of 1328	1032	cmd.exe	61
PID 1328 wrote to memory of 568	1328	explorer.exe	62
PID 1328 wrote to memory of 568	1328	explorer.exe	62
PID 1328 wrote to memory of 568	1328	explorer.exe	62
PID 568 wrote to memory of 1420	568	cmd.exe	64
PID 568 wrote to memory of 1420	568	cmd.exe	64
PID 568 wrote to memory of 1420	568	cmd.exe	64
PID 568 wrote to memory of 1196	568	cmd.exe	65
PID 568 wrote to memory of 1196	568	cmd.exe	65
PID 568 wrote to memory of 1196	568	cmd.exe	65
PID 568 wrote to memory of 2908	568	cmd.exe	66
PID 568 wrote to memory of 2908	568	cmd.exe	66
PID 568 wrote to memory of 2908	568	cmd.exe	66
PID 2908 wrote to memory of 1672	2908	explorer.exe	67
PID 2908 wrote to memory of 1672	2908	explorer.exe	67
PID 2908 wrote to memory of 1672	2908	explorer.exe	67
PID 1672 wrote to memory of 2292	1672	cmd.exe	69
PID 1672 wrote to memory of 2292	1672	cmd.exe	69
PID 1672 wrote to memory of 2292	1672	cmd.exe	69
PID 1672 wrote to memory of 1696	1672	cmd.exe	70
PID 1672 wrote to memory of 1696	1672	cmd.exe	70
PID 1672 wrote to memory of 1696	1672	cmd.exe	70
PID 1672 wrote to memory of 536	1672	cmd.exe	71
PID 1672 wrote to memory of 536	1672	cmd.exe	71
PID 1672 wrote to memory of 536	1672	cmd.exe	71
PID 536 wrote to memory of 2684	536	explorer.exe	72
PID 536 wrote to memory of 2684	536	explorer.exe	72
PID 536 wrote to memory of 2684	536	explorer.exe	72
PID 2684 wrote to memory of 1880	2684	cmd.exe	74
PID 2684 wrote to memory of 1880	2684	cmd.exe	74
PID 2684 wrote to memory of 1880	2684	cmd.exe	74
PID 2684 wrote to memory of 1656	2684	cmd.exe	75
PID 2684 wrote to memory of 1656	2684	cmd.exe	75
PID 2684 wrote to memory of 1656	2684	cmd.exe	75
PID 2684 wrote to memory of 2932	2684	cmd.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595.exe
"C:\Users\Admin\AppData\Local\Temp\595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProviderserverruntimeperfSvc\4oe8qKx4BC4jNir9oLrOplwqP.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\ProviderserverruntimeperfSvc\wnVkTofZircZrFhWJh5AKDNhgeSRpsYNieNXBbC85wZu.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe
      "C:\ProviderserverruntimeperfSvc/ChainPortsurrogate.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2332
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dbzs2cwc\dbzs2cwc.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2232
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD623.tmp" "c:\Windows\System32\CSCF3A47637B1B4A69993D9F281FDDC6.TMP"
        6⤵
        
        PID:1880
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MB4uhozTNr.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1032
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:844
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1508
      - C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Cg5rz6h3MO.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1420
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1196
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7vUbsmDZqq.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2292
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1696
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qWxuQCq4fF.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1656
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CyX2D4M7wI.bat"
        13⤵
        
        PID:2500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2148
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1804
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\e1ZPDUpkB4.bat"
        15⤵
        
        PID:2124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1856
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1884
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fYqjwDText.bat"
        17⤵
        
        PID:2144
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2580
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1912
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r7mooz1sjZ.bat"
        19⤵
        
        PID:884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2084
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aw9hvKlXqO.bat"
        21⤵
        
        PID:3068
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2856
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2068
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sJRdaZOVrD.bat"
        23⤵
        
        PID:1800
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2932
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2148
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LoBiefy8ZI.bat"
        25⤵
        
        PID:2876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2264
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:316
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kg5VX99QjA.bat"
        27⤵
        
        PID:1388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:640
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1940
        
        C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BXcMvhxfI2.bat"
        29⤵
        
        PID:1004
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Office\Office14\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainPortsurrogateC" /sc MINUTE /mo 8 /tr "'C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainPortsurrogate" /sc ONLOGON /tr "'C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainPortsurrogateC" /sc MINUTE /mo 12 /tr "'C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProviderserverruntimeperfSvc\4oe8qKx4BC4jNir9oLrOplwqP.vbe

Filesize
250B

MD5
d8776d21a414703fcf32711bb7ecdfb4

SHA1
1c6820ca5097513a2be072a3b43eff1fc8403184

SHA256
bb5a09775dcaeb1c3c4d3cdd4c207c96f1a153aa23fed7512367eca6a3a0c22d

SHA512
ad33ca536cc149301ba111280388a9a6295ddd7c2be76fa3eefba8cab1f2727a4effc57b24adbf0be8f10c2d13872c215f9512dd470990541b39e2d2681595a9

Download Submit
C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe

Filesize
825KB

MD5
ce09db6adeeca051ff01abd8cf2e400d

SHA1
14e60e202c180152757a89d13d9989ec35e1f5a2

SHA256
ad372edd698062a90f4744da16f88cc5bb45ca9b1cb70fc7350673d293f2bc16

SHA512
e80449cde93d19790e64c1fe24af1aeb00a3c392b4d57a529205a2339bbaa675b6ee21d2d068d65ef21c37d23d2f1b8b458706068ffe850410dc290c4d5c0ce3

Download Submit
C:\ProviderserverruntimeperfSvc\wnVkTofZircZrFhWJh5AKDNhgeSRpsYNieNXBbC85wZu.bat

Filesize
110B

MD5
9c91fe8e1765ddf30eda4052cbecbf48

SHA1
8acec401bdec034d55ead6804c69505c1d680e67

SHA256
9420d7930ae9f2040d5b46bc120da24e920fccf6882e69b74269f71e75cc0718

SHA512
e72ec080ae8fc66a5f712e3a525f0013d406b587523b3b6ff8dc80f12f12af183fc77b578293808f07e916a8b6f2252206b3c899200d0f70540cb70de467ea87

Download Submit
C:\Users\Admin\AppData\Local\Temp\7vUbsmDZqq.bat

Filesize
237B

MD5
df0dc3b8f10709727b4faebcb33558e1

SHA1
72a194f4236f81ef0875e7c4ddfa239d22434069

SHA256
d763dbfc99605fb54f11649db0024acfd08125aa8e674ceeecccbb662dc1c436

SHA512
30afcdd0d2b0298276368b108419f808199442be8c2d01f4fa82cf87e236d1ad8acc55bca9416a200d439b0a2bbeaf2de8f38faa4e65933c328ab3f15da6cd0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\BXcMvhxfI2.bat

Filesize
237B

MD5
01dda5915f2f84c126bbf1ec49885a4e

SHA1
89a3ec9f76ba5b811f2e9edf2ca7ea013b5ec99a

SHA256
c2a3f8ebb866c8a80e73dfe842e472e271bab17bfe8fe182c6a141cecb4f33ee

SHA512
69494cc3a36b33a44f043934728360eb9387976155a8599d506f91ce8081590d48cac1052615a0463b75e4fd64519c0b4730d2c38b4070fa59541481efc7c7e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cg5rz6h3MO.bat

Filesize
189B

MD5
62af7315927137773318a95d25ba3435

SHA1
7cd8ec7db6ecf1623bf7bb132245f975f9a24ba7

SHA256
fc4c29d3d4ab01e094ab83ea048130a3668b3e0cd7e7323d85d8fd76993aca72

SHA512
9c6e946002780cc4842a6ef578be001bae9a894e309f5234d3a518620e4deed477e8ea5803aeed504f404e361d0359b483754397e7d5845485a61aa32c5dbb60

Download Submit
C:\Users\Admin\AppData\Local\Temp\CyX2D4M7wI.bat

Filesize
189B

MD5
d6fb5d7d1944a17b2323839b6c32ee49

SHA1
374d0e434aa001734dac3c4c6b570acb149875fd

SHA256
27b2eea04375527494c93a613a215ead4cf7a3cbdb15f91d31cc03f84d5d6304

SHA512
f5506a4c9f7060795ee1ec5e0925e16d96280ce8c1b7d9b3c8ab5df654d7c40b407b8d994beda4e4a81ed747dfa788116971e5a043981dad027e871d045bca3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kg5VX99QjA.bat

Filesize
189B

MD5
ffeb6640275eb2fcdf1bc524fc87e95d

SHA1
5d75fe02b511f709992379d62e15377b2ae658f7

SHA256
6129b631fda5b5454ffecd6eb5ece8639a2bec7c24b113508315f24185150cec

SHA512
388ca29ce45c7926dc5276369ff5ebbe4b085debdb7a9f5d934fb376125037d9abeba69ece0f9a393a1b3fd23537c9183388d9ce73d83be9562aaf593c7a39b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\LoBiefy8ZI.bat

Filesize
237B

MD5
147a6b771713d1837cd294a5da5a1716

SHA1
718978c656bbdda866e735d2f3d5eb1ae6f42de1

SHA256
d62e4440b1659365530a8cf9a12666991e1361dbdc48a6439f46ef1852fac7be

SHA512
536c89d6ac93c39f17d848966a6ae1aeafb0dc55cde90c93d171c1676da7fe6250aa5c54f3cba120e344dc8a9f6aeb154d83aef398327c29fdcac603129c5844

Download Submit
C:\Users\Admin\AppData\Local\Temp\MB4uhozTNr.bat

Filesize
237B

MD5
6f5a63fd771bbe42b27e0d52eb5b4c44

SHA1
647df9df0b474146b7c63d26130aa61ae887eadb

SHA256
bb1d8aa17f5e86d65d4578cd17171fc02344ff33b320caa265a491a3d4c73254

SHA512
6e064fe6d30d390f785d63c2d16cfc72ea98ae75508b4eb623e6d0fa8d539e7fba2c7a73497b61079caa0ac1d390bdfcdfaebe59bc03ac8ac3307dd080004d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD623.tmp

Filesize
1KB

MD5
d9021c974fcd82c4d893a493ba3a9747

SHA1
7adbebbe25b9f66bd6efb4e9b23695b36cee5b90

SHA256
ddc4407bb809f6bd79f407f5c1c1f67d53827fbc73074addd7da52a77ff0a901

SHA512
278373e37e895220e0e78af0957884c3fcdbf427a71117c35113d1c5c1905e17921c882f71cea41af72c1556eb5a4556e1ed67420f6b9cde13dbc26b4c601110

Download Submit
C:\Users\Admin\AppData\Local\Temp\aw9hvKlXqO.bat

Filesize
189B

MD5
723a68d48b27bf8293728e8ec5b729ce

SHA1
e8603231ee7dea1e296e2c1e96a363a727a9fcb6

SHA256
0a08eb736fc103e5197d9ba1f1bb3c6aafe5d22732817eb4f70d516a9442b028

SHA512
de066bd20eb96383ea79dac399eee11c153b9b6d2ad1e670dbbd2aa804362cce4c4b647bf378298b034f65a402f88781619e9840745d924ab99a51e8c761e7a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\e1ZPDUpkB4.bat

Filesize
189B

MD5
3289fb4efb9f2786522e87cfb389c826

SHA1
de1ed718aded6e5444175daab35b5199972c9903

SHA256
ff3d2fc6985f1e8fe1e5167a8c02c40d24dd83279e0f3a590e86afad4772c4a5

SHA512
b5c4dac47704c2b6253bdbee4dcb2ac038b38776b79a900b16dd04cf556d23b1d4e7c61255520677538293ae83342b1bebc52768a7a0745260bd799237c55ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\fYqjwDText.bat

Filesize
237B

MD5
d4f7702a3d8e5c04bb61b1598f9127f3

SHA1
0d0adeeaa0206b11c9e37ddde0f28db5b37860e4

SHA256
bb4f57707bcbca3c372ce0a24684c25a49e465839c5bcb308a3f6c26caba3e88

SHA512
19e27b4164fa5e7d20dd276b41b61c993f85070508cc968016a56f1a1f5ecc54a010fc723d4ff175fd1814873e8c8917127ebba926555fae33fc2d032be855fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\qWxuQCq4fF.bat

Filesize
237B

MD5
824dc56972c80d37ac0ce9a723abc32d

SHA1
e5ba1dc86882e601ddb8598a058891465c68bb26

SHA256
8a6903c1e0e91ab2c059d4e499cc7c9ea940bea1363516ceedcb787e3026f941

SHA512
9dbb5b2899439938f9f1465e2d3f26b22fa9c1e3da2fd39ccfd597ccb78e59a25a7440da34e53e258a2962132a9d870175eb57df2a9331058a8d51b1ca73aa90

Download Submit
C:\Users\Admin\AppData\Local\Temp\r7mooz1sjZ.bat

Filesize
237B

MD5
0efadcd54b6ebde33ef890bbbdd9d534

SHA1
1b2e6b71fc47d7799857e45c57db77694ed2d3c6

SHA256
c3f166256b73a1331a662f00b508b9731f436da2c662a105d17f17e7bc5c3055

SHA512
c5fb0cdcbd847f589b45485c9bebd1b31537b8f9da4f7138320d1a5b42f5cafc9ecae7baf4a9df849ec56a9a4c6fa32521837afc1919126ee077de89035229e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\sJRdaZOVrD.bat

Filesize
189B

MD5
565d2838d95572508b2f7855c6a3ab01

SHA1
95bf1fbf3b4ef38be277493b00ac3d0f61c398ad

SHA256
b21a30058aabb7bee27f7cd8f03ec73e7939a86ae7c1afdbb8d21ecf46b5c01d

SHA512
e872f49c0bcb36c04b40868c0599733dcf360f98d3171059d17afd76f59840131b0d13c8ca62f700cf3bc3d3799c39bd9fbf20d5b9b98e83acc805bb8bfbe2e6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dbzs2cwc\dbzs2cwc.0.cs

Filesize
393B

MD5
2095bcc18e89c6d54c5b40725513f4f2

SHA1
d8501e12983fd0062e56d581ae9ae40b1573e81b

SHA256
68437084c1b9a318c6ea77a1841183c4150c05562318e6c2d5baeb376504d4d2

SHA512
e52a844b37b31f13d4586626e6a2b51df6ea02c0d2aa30bc60415878dfd32aabc9ca3bcd3afcd3b2953ab2b42fd95460629afe96d6e5d1b6dbd49fff1ddb2a7b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dbzs2cwc\dbzs2cwc.cmdline

Filesize
235B

MD5
edb0acaad01902d9506fd4e9592d1fe3

SHA1
0de410f9b49d0f3149e621a04c4de6f2d6ba7629

SHA256
1290754382bd85538aa86cfe52e5854c2d39cc40c2061478e3b3ff0ec8cbe269

SHA512
ef38b4cac9698d5798e598a87d2229a9c20d9a68611cdb147baffe3938c28230493f86c072f496f842ad74765ea554051c8e1cda9d76cc85e925a450ae987447

Download Submit
\??\c:\Windows\System32\CSCF3A47637B1B4A69993D9F281FDDC6.TMP

Filesize
1KB

MD5
dbb2cd021b80875d9c777c705ef845c8

SHA1
3ed0cde3b4f4d8267c3cddd37dd4ede100b5ecce

SHA256
a4d8c8c391bc1975510bdea24653db0f578d998dead4ce7f8a85eb8fbb3ec829

SHA512
a8076e4d1b1641e189d2066050809ce0cce557e23c110fba77c2cfb7448b5915252b2e2f4d3443f708941277b947b951cfba6c191980a09b8c7710589c766c8e

Download Submit
memory/536-78-0x0000000000920000-0x00000000009F4000-memory.dmp

Filesize
848KB

Download
memory/992-149-0x0000000001290000-0x0000000001364000-memory.dmp

Filesize
848KB

Download
memory/1328-54-0x0000000000D00000-0x0000000000DD4000-memory.dmp

Filesize
848KB

Download
memory/1504-126-0x00000000011C0000-0x0000000001294000-memory.dmp

Filesize
848KB

Download
memory/2228-114-0x00000000000D0000-0x00000000001A4000-memory.dmp

Filesize
848KB

Download
memory/2332-23-0x0000000000760000-0x000000000076E000-memory.dmp

Filesize
56KB

Download
memory/2332-21-0x0000000000750000-0x000000000075E000-memory.dmp

Filesize
56KB

Download
memory/2332-19-0x0000000000790000-0x00000000007A8000-memory.dmp

Filesize
96KB

Download
memory/2332-17-0x0000000000770000-0x000000000078C000-memory.dmp

Filesize
112KB

Download
memory/2332-15-0x0000000000740000-0x000000000074E000-memory.dmp

Filesize
56KB

Download
memory/2332-13-0x00000000003E0000-0x00000000004B4000-memory.dmp

Filesize
848KB

Download
memory/2516-102-0x0000000000A30000-0x0000000000B04000-memory.dmp

Filesize
848KB

Download
memory/2908-66-0x00000000000B0000-0x0000000000184000-memory.dmp

Filesize
848KB

Download
memory/2932-90-0x0000000000090000-0x0000000000164000-memory.dmp

Filesize
848KB

Download