dcrat | a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe
Size

1.3MB
MD5

66fe2500cfcdbbc54c1cab06d5bf90be
SHA1

e6fec893d4c341e2a8ecaa8e970ba22d3ba8afbe
SHA256

a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551
SHA512

4d0308539d8df123d5fa9af2945ef0109b0b06fe4172f63f34ef316343708a1ba6271e2a71a4098d6510aaaa1b7dcbb245505fde13b8a6c81736da90ab89110a
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	328	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2356	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2356	schtasks.exe	35

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000019227-10.dat	dcrat
behavioral1/memory/2584-13-0x0000000000AC0000-0x0000000000BD0000-memory.dmp	dcrat
behavioral1/memory/1912-62-0x0000000000AE0000-0x0000000000BF0000-memory.dmp	dcrat
behavioral1/memory/3024-203-0x0000000000BC0000-0x0000000000CD0000-memory.dmp	dcrat
behavioral1/memory/1528-324-0x0000000001020000-0x0000000001130000-memory.dmp	dcrat
behavioral1/memory/1704-562-0x0000000001390000-0x00000000014A0000-memory.dmp	dcrat
behavioral1/memory/352-740-0x00000000000A0000-0x00000000001B0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2264	powershell.exe
2732	powershell.exe
2312	powershell.exe
1072	powershell.exe
1252	powershell.exe
1580	powershell.exe
1556	powershell.exe
1860	powershell.exe
2040	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2584	DllCommonsvc.exe
1912	sppsvc.exe
2452	sppsvc.exe
3024	sppsvc.exe
1860	sppsvc.exe
1528	sppsvc.exe
876	sppsvc.exe
940	sppsvc.exe
2128	sppsvc.exe
1704	sppsvc.exe
1600	sppsvc.exe
1840	sppsvc.exe
352	sppsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
2348	cmd.exe
2348	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
37	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com
4	raw.githubusercontent.com
12	raw.githubusercontent.com
23	raw.githubusercontent.com
34	raw.githubusercontent.com
41	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ras\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\SysWOW64\ras\6cb0b6c459d5d3	DllCommonsvc.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2912	schtasks.exe
2956	schtasks.exe
2808	schtasks.exe
1232	schtasks.exe
1732	schtasks.exe
1948	schtasks.exe
1552	schtasks.exe
2492	schtasks.exe
2212	schtasks.exe
1660	schtasks.exe
328	schtasks.exe
1688	schtasks.exe
1568	schtasks.exe
2268	schtasks.exe
2712	schtasks.exe
1752	schtasks.exe
1880	schtasks.exe
1792	schtasks.exe
2664	schtasks.exe
2656	schtasks.exe
2600	schtasks.exe
1168	schtasks.exe
2940	schtasks.exe
2824	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 11 IoCs

pid	Process
2452	sppsvc.exe
3024	sppsvc.exe
1860	sppsvc.exe
1528	sppsvc.exe
876	sppsvc.exe
940	sppsvc.exe
2128	sppsvc.exe
1704	sppsvc.exe
1600	sppsvc.exe
1840	sppsvc.exe
352	sppsvc.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2584	DllCommonsvc.exe
2584	DllCommonsvc.exe
2584	DllCommonsvc.exe
1252	powershell.exe
1556	powershell.exe
2312	powershell.exe
1912	sppsvc.exe
2732	powershell.exe
1580	powershell.exe
2040	powershell.exe
2264	powershell.exe
1860	powershell.exe
1072	powershell.exe
2452	sppsvc.exe
3024	sppsvc.exe
1860	sppsvc.exe
1528	sppsvc.exe
876	sppsvc.exe
940	sppsvc.exe
2128	sppsvc.exe
1704	sppsvc.exe
1600	sppsvc.exe
1840	sppsvc.exe
352	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	DllCommonsvc.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	1912	sppsvc.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	2452	sppsvc.exe
Token: SeDebugPrivilege	3024	sppsvc.exe
Token: SeDebugPrivilege	1860	sppsvc.exe
Token: SeDebugPrivilege	1528	sppsvc.exe
Token: SeDebugPrivilege	876	sppsvc.exe
Token: SeDebugPrivilege	940	sppsvc.exe
Token: SeDebugPrivilege	2128	sppsvc.exe
Token: SeDebugPrivilege	1704	sppsvc.exe
Token: SeDebugPrivilege	1600	sppsvc.exe
Token: SeDebugPrivilege	1840	sppsvc.exe
Token: SeDebugPrivilege	352	sppsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2432	2100	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe	30
PID 2100 wrote to memory of 2432	2100	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe	30
PID 2100 wrote to memory of 2432	2100	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe	30
PID 2100 wrote to memory of 2432	2100	a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe	30
PID 2432 wrote to memory of 2348	2432	WScript.exe	32
PID 2432 wrote to memory of 2348	2432	WScript.exe	32
PID 2432 wrote to memory of 2348	2432	WScript.exe	32
PID 2432 wrote to memory of 2348	2432	WScript.exe	32
PID 2348 wrote to memory of 2584	2348	cmd.exe	34
PID 2348 wrote to memory of 2584	2348	cmd.exe	34
PID 2348 wrote to memory of 2584	2348	cmd.exe	34
PID 2348 wrote to memory of 2584	2348	cmd.exe	34
PID 2584 wrote to memory of 2312	2584	DllCommonsvc.exe	60
PID 2584 wrote to memory of 2312	2584	DllCommonsvc.exe	60
PID 2584 wrote to memory of 2312	2584	DllCommonsvc.exe	60
PID 2584 wrote to memory of 2732	2584	DllCommonsvc.exe	61
PID 2584 wrote to memory of 2732	2584	DllCommonsvc.exe	61
PID 2584 wrote to memory of 2732	2584	DllCommonsvc.exe	61
PID 2584 wrote to memory of 1860	2584	DllCommonsvc.exe	62
PID 2584 wrote to memory of 1860	2584	DllCommonsvc.exe	62
PID 2584 wrote to memory of 1860	2584	DllCommonsvc.exe	62
PID 2584 wrote to memory of 1556	2584	DllCommonsvc.exe	63
PID 2584 wrote to memory of 1556	2584	DllCommonsvc.exe	63
PID 2584 wrote to memory of 1556	2584	DllCommonsvc.exe	63
PID 2584 wrote to memory of 2040	2584	DllCommonsvc.exe	64
PID 2584 wrote to memory of 2040	2584	DllCommonsvc.exe	64
PID 2584 wrote to memory of 2040	2584	DllCommonsvc.exe	64
PID 2584 wrote to memory of 1072	2584	DllCommonsvc.exe	66
PID 2584 wrote to memory of 1072	2584	DllCommonsvc.exe	66
PID 2584 wrote to memory of 1072	2584	DllCommonsvc.exe	66
PID 2584 wrote to memory of 1580	2584	DllCommonsvc.exe	67
PID 2584 wrote to memory of 1580	2584	DllCommonsvc.exe	67
PID 2584 wrote to memory of 1580	2584	DllCommonsvc.exe	67
PID 2584 wrote to memory of 1252	2584	DllCommonsvc.exe	69
PID 2584 wrote to memory of 1252	2584	DllCommonsvc.exe	69
PID 2584 wrote to memory of 1252	2584	DllCommonsvc.exe	69
PID 2584 wrote to memory of 2264	2584	DllCommonsvc.exe	70
PID 2584 wrote to memory of 2264	2584	DllCommonsvc.exe	70
PID 2584 wrote to memory of 2264	2584	DllCommonsvc.exe	70
PID 2584 wrote to memory of 1912	2584	DllCommonsvc.exe	78
PID 2584 wrote to memory of 1912	2584	DllCommonsvc.exe	78
PID 2584 wrote to memory of 1912	2584	DllCommonsvc.exe	78
PID 2584 wrote to memory of 1912	2584	DllCommonsvc.exe	78
PID 2584 wrote to memory of 1912	2584	DllCommonsvc.exe	78
PID 1912 wrote to memory of 2196	1912	sppsvc.exe	79
PID 1912 wrote to memory of 2196	1912	sppsvc.exe	79
PID 1912 wrote to memory of 2196	1912	sppsvc.exe	79
PID 2196 wrote to memory of 540	2196	cmd.exe	81
PID 2196 wrote to memory of 540	2196	cmd.exe	81
PID 2196 wrote to memory of 540	2196	cmd.exe	81
PID 2196 wrote to memory of 2452	2196	cmd.exe	82
PID 2196 wrote to memory of 2452	2196	cmd.exe	82
PID 2196 wrote to memory of 2452	2196	cmd.exe	82
PID 2196 wrote to memory of 2452	2196	cmd.exe	82
PID 2196 wrote to memory of 2452	2196	cmd.exe	82
PID 2452 wrote to memory of 2824	2452	sppsvc.exe	83
PID 2452 wrote to memory of 2824	2452	sppsvc.exe	83
PID 2452 wrote to memory of 2824	2452	sppsvc.exe	83
PID 2824 wrote to memory of 2220	2824	cmd.exe	85
PID 2824 wrote to memory of 2220	2824	cmd.exe	85
PID 2824 wrote to memory of 2220	2824	cmd.exe	85
PID 2824 wrote to memory of 3024	2824	cmd.exe	86
PID 2824 wrote to memory of 3024	2824	cmd.exe	86
PID 2824 wrote to memory of 3024	2824	cmd.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe
"C:\Users\Admin\AppData\Local\Temp\a2915812ae39b9faa2a3e2d0b4e94555b0d160d4b468c4a57785cfafff8c5551.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\ras\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
    - - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V68XQM6FdC.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:540
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2220
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V61H6ynXXY.bat"
        10⤵
        
        PID:2932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:896
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GvLkm7sAXX.bat"
        12⤵
        
        PID:2136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:884
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat"
        14⤵
        
        PID:1984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1604
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CTHuJZ10YE.bat"
        16⤵
        
        PID:2924
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2312
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat"
        18⤵
        
        PID:2944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1524
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat"
        20⤵
        
        PID:1520
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2540
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M53DwaTFc6.bat"
        22⤵
        
        PID:2984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:396
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LEBHQwxRW8.bat"
        24⤵
        
        PID:2736
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2772
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat"
        26⤵
        
        PID:2472
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1948
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\SysWOW64\ras\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\SysWOW64\ras\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\SysWOW64\ras\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e7abc81fdd3b5eebdfd50a24c49dc4f

SHA1
fa02171f128ac39e83abd99d486944d32f6d2651

SHA256
e67fba091d9c3518161b9831f3a08468b90f17510b87b91ef4558c5cf36168fa

SHA512
ae78b2e72416ec73b58f2b4e92a0d5f82a46614ea59bbd88382ff58790fa9c39323922ad680b0038e940e97caa15e3af0eba34deb194c40c1d81b84e419efe64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
699ce7dec12dc18956d52e471c0f0299

SHA1
2132f09757f6d7ea5580095a2255adf8dfca725b

SHA256
8b0609f0438c0efef954800f90cbecc76f0d802c3dae953e4edd5086627d5192

SHA512
260707ae21de25ba828882ac47a327621f67451a4f6a118914112931b9bb692ce099de93b739f7a94cd6a9d78538950acc455670c4c3318156df1a3607ed1013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
765d2b74342b50251fee2193778c36ec

SHA1
9fdc77986b11f63bedbc608d05aadb6bf1d1f9cd

SHA256
3cf42d0b43780af67d9b4bf1a6d35edcd4c117bfee65ebda5f9d151be392fb8a

SHA512
b9801c4ab7586038f2a2e602b27b6aaad175c389b7a45c4a6861b316a7905dd3f6d49ed3f9ee7c201717869986fa4aef68f0a047d3cee5c1266ea7f418765224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb547986dac8b0bfc4600379317ad595

SHA1
6e754c936d6af0b65d0909956829fae90b475809

SHA256
15b1fd8b1191a24afe352e9d374dfdb257ec7940848cb6fded9de5bab5126e6a

SHA512
5067b5a0cd120da9cb283568b26dac923ac4775003927fb89a4a0fdd923eb1302dc6e0271c5cbc7d3658bd233da8b3ccadf370cf0dd92c68e86bf5ffc61a644d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0aeb131b06a8efb74fbfc8a80bb6b03

SHA1
38766d684b7582aacfcc40ceb059297d2c7ad576

SHA256
c90bed6130e7683f62cbdd6e7b6b48e78baacd767ddd566821be9ebc00c9361b

SHA512
77bb591cda94a4af1b3c8b6a28f5f8fcc39f590648b2843eb722436a6e233208240d0b02b9549fd04c8a30e448a817c453b10f5cf072ca39965fdba18aa1cbe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a38137772cc5d6a163c6e8298c4b76c

SHA1
d8a89efee2ee86a1e1d50212d1aee0d45d0c41e6

SHA256
0a5e41f7dec72a38f57d3528db4a30e7a7b184ffa06260ed74e32677c95eaff4

SHA512
e7191eccaef3842dee3093727b945c39e4cea66641b24d614c00813562a29f9b42e9fbb9671f5ca31db5690d00742343b2b3c5118ecc0fd7dfc3942ff9d97264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61d6aea6a6944e78503f87bbcdca37aa

SHA1
53bd2f529c8f26f7beeaefdd294f45a9b54e91b8

SHA256
5a2c475dbb1da939aca3de733b728600681f6cec99fc1a9e0945e38e90c6f045

SHA512
491b803ba27af0c9ddac8ac6b15df61079a448e5e70743df2ec83154deae986bd5e96a3cdf81dfb72cd71a51709e41b235a675b0b3d52c86d78902fa75cf2777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
734f4fc1a487d4e38e32ac1e651cb149

SHA1
1333306a97a71366414912dd21e2a0121754026b

SHA256
8d36039b9bca8f49e69b72dad0c13a973772620e6e6828a0b4679f9fa83a876c

SHA512
e6f2c7cd311020eed5c50f7642c673a9be9ed8f8f78f6265319e1ea39971d6f1b569fa6b1120ebf30cf1d25f07a12aa58624b9c38391e0c9676bc239b63f4faf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14bc5c5dc338a593e3f5ec1fb949e5c6

SHA1
f7b837ca866bbe3f093b49bd5f2cde55eec0d1d2

SHA256
884a8f678328dff38faf2c7c06df1cd3256f7c2cc1a860d2564d595ca9f94852

SHA512
84e4da12228eff2ca3053d54442ca5f3499909754d970f2ecbb45218f9f8a8f6ae2353d6bc960809e1a06cf87da655e9949236ddefb0a8183a96b5c0a5a57823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff79b60f265ece04ed1e22b071d960c7

SHA1
e84eb191767d0d605f0c86ed880f7625b01117b7

SHA256
8d61432a75f24edc57772111895e33259f63f46a235d8ed3974b6cce3b8b6af7

SHA512
6a3840e7091364b53ce35a78e2d0e358cc23c4549f20ca3f198753a86777658a61a4fd7c9ca2c3906245d8f757f6db4a9ae38a2fe0cc3e1f793f7e908f60a109

Download Submit
C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat

Filesize
249B

MD5
d9a7fc08dec54dc889e77f7083b1eec3

SHA1
2a4d553faf7c8eba5ce4da6bf7a8f2e0aad3d166

SHA256
b3585f36109c1d6c4e5b85f36214ca1707834eedf919b48ca9992769014f967b

SHA512
d487d1396f7df63c38387dbcf4a7c2457c5b326d81d8341b6655f6006d9e71be79ff93cdbbbcbe321ff4c78bedfc0b99fc377ed60328f9e94b1698ac9e2369ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat

Filesize
249B

MD5
c8412c7f8ce0b9c2a25cc9b1e9c48715

SHA1
e7306cd414db7bb08b555963de126df267a8bf8b

SHA256
083d8d7549cef00b7b556dc5f48d22a4a2775434066bc511527b913bafd932f3

SHA512
7d167239a7d388780ca4df935c67583fab82b24bc1e9f2d55d228a6a793b7e8545c71bc2b03c81b57f801b0bef15ee4aacfc84921f9ec796382a0d8d15bd2bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat

Filesize
249B

MD5
9caed7b5c806cb81ecbe90ef99213b0a

SHA1
b837f980d39c60c5dea837d286089d7b43fc7029

SHA256
63edf5333a71d119834169afa6023a8b94a861001e4221e3c5e3bb4b01d6d4b6

SHA512
f80ece6c28cd8564e9b5be40cccc32767e794ff00e084e313b1c6f94623f38b9d1768b3f7ef52822354d5ad9a6e89c515b570e01f4005d188a62a571175c374e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CTHuJZ10YE.bat

Filesize
249B

MD5
5573f874e9229cad19b9c33359af4039

SHA1
b7b9707e29fd3d18f5d7c12489d6ba1bb9bef8a2

SHA256
fe3b9b3dbb007cf5ea3f4e0b130e440863fe232efba0984a99849a66f45ec777

SHA512
d6d1412e6277213971c47152767f0bfa8fe5d384f6f66c1113ea36eb7c021eb35e623c1d222a8b9edb2bdf7554e20f172200904ce507ade95a4245c9ed1c73fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFFD4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat

Filesize
249B

MD5
b9070a60c2575cd7257db567b3d52c57

SHA1
5d375021c4c71788cf9b8d89a7c3a85195f42d8a

SHA256
8ca81719707cf972213d0d183f84608bf7ec235d56be139fd0b3cbf5cbd4ab2b

SHA512
d32d1fc2baaf9825010277d0a4dac15e04db64ba3bef739cffa67f561a6053140caf7433d1ef53bbbe61b0d1449f83420c56f581760698740413982871d038c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\GvLkm7sAXX.bat

Filesize
249B

MD5
b648195ada5cb3ccb0b208191f03eda2

SHA1
0d11b3a831a21372043ffd7b39a689061f31efab

SHA256
3b7ba47030437fe254e896775f73c97647f1d076f05c3b11f316c6186c0b795f

SHA512
d688f79912c256bac18850ca2df27921dbb8e78a211639a185537b13d30260d06c1c435b6b58241c778b87dfad041763979bc9e2e65646556cd98f425bad729a

Download Submit
C:\Users\Admin\AppData\Local\Temp\LEBHQwxRW8.bat

Filesize
249B

MD5
90d093b38f314970c41997f7786f62d9

SHA1
115d7abf2fe0625b32f703322407c08103ec4886

SHA256
2fcdc4622f4c14e893cbcb2462b6128a51cab71bbdc8f680dd860dcdf8cfe190

SHA512
312e3aa12a71c4eff1a0d7347c31215389d0170d0bd9ecce76f899ca00603ef43acae02bedd182a36c6d8476125e389e1256ac098ae575822e11576dd920877a

Download Submit
C:\Users\Admin\AppData\Local\Temp\M53DwaTFc6.bat

Filesize
249B

MD5
3be994cf5b4f84a775f83729fdb18fba

SHA1
1095c3e043f5929bd307e8c950483220512583b2

SHA256
35a086fc2dd6abe364ddf5ba1387c69e3b7730fd93bd1314cbeb0a89abf31eb1

SHA512
2e1dc03c184764b80db6bce820ce8b296e1defa215ddc2f8b9491926cf184328aa818e6452f50b5b045600a90cd450de13ede511f4ddf16dfd62c5f58ecd7a0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat

Filesize
249B

MD5
6edaf7c88ddafc8c8b111825b4dd3f17

SHA1
91bcd942c31691d3049bd8d30100f540b8f528e9

SHA256
816b0cefd3e41f7ac59db491abdac8d4f0441d97c38a40b56fc63be647b4be4a

SHA512
48eacacdf3b6a274e7f488b3dbd8065f9a79caac5af8d0ade76fd081f8414964ea5b719ac153fc3a0279a13eaaaef4eedefee77b9611187c8a811f24b31765a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFFF6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\V61H6ynXXY.bat

Filesize
249B

MD5
6a9a24c8a157400010db7177431aabfd

SHA1
a38c7c07fcb99cfc842cd82186dd5f241c0c8ca2

SHA256
16b3686ac2082cff25100e949e5a55a238047c27a3767b93b4cb53a58904ad41

SHA512
593e64bb1e99772cd57391ca0bf9310cd51955905c6c31f9d91860962589d398219ce45bc8230d61d180309caa97143c3d4eb6923aee70214b54e2f3ffad0cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\V68XQM6FdC.bat

Filesize
249B

MD5
fc534c304ef9db8a74dd1b3d00e34d04

SHA1
e46e1ab4382cad3dac29252fe853565fd9f2a3b5

SHA256
20373d05186f1896ae945e910a9349c095b26f511bab8522ada6d22bb1dba67a

SHA512
6a157aaa9dd49df062141741233e88704ac1b659bfdb0fb3d438524fdfa6ca777d536aba24b3019841e49e8f82d938e40f0cceda6acc30d12abb338f9b14f708

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0485ed47d4a596e9e9f46094663ecd92

SHA1
245711d1bd66e199c4faa864b78bc60c28c1fafd

SHA256
52d84edac80c9feb0cc023bf70ea0ef865f4b7c5054759376b09e1052a532614

SHA512
b06323ec7f223c593308d8642b43c00315f56b8eb5cf3b848cf08e1e46109c5324c8835c5d4e1de56aeafe9b880750876267c13e6b7e851868beaec1d1dcb14b

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/352-740-0x00000000000A0000-0x00000000001B0000-memory.dmp

Filesize
1.1MB

Download
memory/940-443-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/1252-52-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/1252-51-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/1528-324-0x0000000001020000-0x0000000001130000-memory.dmp

Filesize
1.1MB

Download
memory/1704-562-0x0000000001390000-0x00000000014A0000-memory.dmp

Filesize
1.1MB

Download
memory/1860-264-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/1912-62-0x0000000000AE0000-0x0000000000BF0000-memory.dmp

Filesize
1.1MB

Download
memory/2584-16-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2584-15-0x0000000000460000-0x000000000046C000-memory.dmp

Filesize
48KB

Download
memory/2584-14-0x0000000000160000-0x0000000000172000-memory.dmp

Filesize
72KB

Download
memory/2584-13-0x0000000000AC0000-0x0000000000BD0000-memory.dmp

Filesize
1.1MB

Download
memory/2584-17-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/3024-204-0x00000000003E0000-0x00000000003F2000-memory.dmp

Filesize
72KB

Download
memory/3024-203-0x0000000000BC0000-0x0000000000CD0000-memory.dmp

Filesize
1.1MB

Download