dcrat | 36e0fa55438dbf73086d022ac1f06a91b94a10a1db769a1fd1112c854e6c6fdc

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36e0fa55438dbf73086d022ac1f06a91b94a10a1db769a1fd1112c854e6c6fdc.exe
Size

1.3MB
MD5

0b619940c8d4d33085ccb0aebca44ff8
SHA1

36aa712b21c0c4a129c18cab08a45ca2511141ba
SHA256

36e0fa55438dbf73086d022ac1f06a91b94a10a1db769a1fd1112c854e6c6fdc
SHA512

40a01952cb9044c0a6b7bfc4f0bc99a0c74880b03fc0cabf938f46e3731d9e466d5b79c64de3a4003d92d6144bb68f60457a385d86617fe89136310185b3580d
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	2624	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2624	schtasks.exe	34

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000017079-12.dat	dcrat
behavioral1/memory/2052-13-0x0000000000190000-0x00000000002A0000-memory.dmp	dcrat
behavioral1/memory/1920-114-0x0000000001030000-0x0000000001140000-memory.dmp	dcrat
behavioral1/memory/2092-350-0x0000000001160000-0x0000000001270000-memory.dmp	dcrat
behavioral1/memory/2032-589-0x0000000000370000-0x0000000000480000-memory.dmp	dcrat
behavioral1/memory/1324-649-0x00000000010C0000-0x00000000011D0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1776	powershell.exe
1440	powershell.exe
1536	powershell.exe
2476	powershell.exe
1360	powershell.exe
2164	powershell.exe
988	powershell.exe
2300	powershell.exe
848	powershell.exe
2040	powershell.exe
664	powershell.exe
3028	powershell.exe
856	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2052	DllCommonsvc.exe
1920	wininit.exe
840	wininit.exe
2164	wininit.exe
2084	wininit.exe
2092	wininit.exe
2512	wininit.exe
1500	wininit.exe
272	wininit.exe
2032	wininit.exe
1324	wininit.exe
1700	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
2384	cmd.exe
2384	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
31	raw.githubusercontent.com
40	raw.githubusercontent.com
4	raw.githubusercontent.com
12	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com
34	raw.githubusercontent.com
37	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\56085415360792	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\24dbde2999530e	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\system\088424020bedd6	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36e0fa55438dbf73086d022ac1f06a91b94a10a1db769a1fd1112c854e6c6fdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
592	schtasks.exe
1740	schtasks.exe
1824	schtasks.exe
2196	schtasks.exe
1712	schtasks.exe
1728	schtasks.exe
2068	schtasks.exe
2732	schtasks.exe
1304	schtasks.exe
1708	schtasks.exe
1720	schtasks.exe
2892	schtasks.exe
620	schtasks.exe
2868	schtasks.exe
1768	schtasks.exe
1264	schtasks.exe
1640	schtasks.exe
2204	schtasks.exe
2060	schtasks.exe
536	schtasks.exe
2032	schtasks.exe
2316	schtasks.exe
956	schtasks.exe
3020	schtasks.exe
1368	schtasks.exe
2436	schtasks.exe
2284	schtasks.exe
2180	schtasks.exe
712	schtasks.exe
2148	schtasks.exe
1628	schtasks.exe
1480	schtasks.exe
2856	schtasks.exe
2168	schtasks.exe
1092	schtasks.exe
1996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2052	DllCommonsvc.exe
856	powershell.exe
1536	powershell.exe
2300	powershell.exe
3028	powershell.exe
664	powershell.exe
1776	powershell.exe
1440	powershell.exe
988	powershell.exe
2164	powershell.exe
848	powershell.exe
2476	powershell.exe
1360	powershell.exe
2040	powershell.exe
1920	wininit.exe
840	wininit.exe
2164	wininit.exe
2084	wininit.exe
2092	wininit.exe
2512	wininit.exe
1500	wininit.exe
272	wininit.exe
2032	wininit.exe
1324	wininit.exe
1700	wininit.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	DllCommonsvc.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	664	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	848	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	1920	wininit.exe
Token: SeDebugPrivilege	840	wininit.exe
Token: SeDebugPrivilege	2164	wininit.exe
Token: SeDebugPrivilege	2084	wininit.exe
Token: SeDebugPrivilege	2092	wininit.exe
Token: SeDebugPrivilege	2512	wininit.exe
Token: SeDebugPrivilege	1500	wininit.exe
Token: SeDebugPrivilege	272	wininit.exe
Token: SeDebugPrivilege	2032	wininit.exe
Token: SeDebugPrivilege	1324	wininit.exe
Token: SeDebugPrivilege	1700	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2812	2644	36e0fa55438dbf73086d022ac1f06a91b94a10a1db769a1fd1112c854e6c6fdc.exe	30
PID 2644 wrote to memory of 2812	2644	36e0fa55438dbf73086d022ac1f06a91b94a10a1db769a1fd1112c854e6c6fdc.exe	30
PID 2644 wrote to memory of 2812	2644	36e0fa55438dbf73086d022ac1f06a91b94a10a1db769a1fd1112c854e6c6fdc.exe	30
PID 2644 wrote to memory of 2812	2644	36e0fa55438dbf73086d022ac1f06a91b94a10a1db769a1fd1112c854e6c6fdc.exe	30
PID 2812 wrote to memory of 2384	2812	WScript.exe	31
PID 2812 wrote to memory of 2384	2812	WScript.exe	31
PID 2812 wrote to memory of 2384	2812	WScript.exe	31
PID 2812 wrote to memory of 2384	2812	WScript.exe	31
PID 2384 wrote to memory of 2052	2384	cmd.exe	33
PID 2384 wrote to memory of 2052	2384	cmd.exe	33
PID 2384 wrote to memory of 2052	2384	cmd.exe	33
PID 2384 wrote to memory of 2052	2384	cmd.exe	33
PID 2052 wrote to memory of 1536	2052	DllCommonsvc.exe	71
PID 2052 wrote to memory of 1536	2052	DllCommonsvc.exe	71
PID 2052 wrote to memory of 1536	2052	DllCommonsvc.exe	71
PID 2052 wrote to memory of 1776	2052	DllCommonsvc.exe	72
PID 2052 wrote to memory of 1776	2052	DllCommonsvc.exe	72
PID 2052 wrote to memory of 1776	2052	DllCommonsvc.exe	72
PID 2052 wrote to memory of 2164	2052	DllCommonsvc.exe	73
PID 2052 wrote to memory of 2164	2052	DllCommonsvc.exe	73
PID 2052 wrote to memory of 2164	2052	DllCommonsvc.exe	73
PID 2052 wrote to memory of 988	2052	DllCommonsvc.exe	74
PID 2052 wrote to memory of 988	2052	DllCommonsvc.exe	74
PID 2052 wrote to memory of 988	2052	DllCommonsvc.exe	74
PID 2052 wrote to memory of 856	2052	DllCommonsvc.exe	75
PID 2052 wrote to memory of 856	2052	DllCommonsvc.exe	75
PID 2052 wrote to memory of 856	2052	DllCommonsvc.exe	75
PID 2052 wrote to memory of 2300	2052	DllCommonsvc.exe	76
PID 2052 wrote to memory of 2300	2052	DllCommonsvc.exe	76
PID 2052 wrote to memory of 2300	2052	DllCommonsvc.exe	76
PID 2052 wrote to memory of 848	2052	DllCommonsvc.exe	77
PID 2052 wrote to memory of 848	2052	DllCommonsvc.exe	77
PID 2052 wrote to memory of 848	2052	DllCommonsvc.exe	77
PID 2052 wrote to memory of 2040	2052	DllCommonsvc.exe	78
PID 2052 wrote to memory of 2040	2052	DllCommonsvc.exe	78
PID 2052 wrote to memory of 2040	2052	DllCommonsvc.exe	78
PID 2052 wrote to memory of 1440	2052	DllCommonsvc.exe	79
PID 2052 wrote to memory of 1440	2052	DllCommonsvc.exe	79
PID 2052 wrote to memory of 1440	2052	DllCommonsvc.exe	79
PID 2052 wrote to memory of 664	2052	DllCommonsvc.exe	80
PID 2052 wrote to memory of 664	2052	DllCommonsvc.exe	80
PID 2052 wrote to memory of 664	2052	DllCommonsvc.exe	80
PID 2052 wrote to memory of 2476	2052	DllCommonsvc.exe	81
PID 2052 wrote to memory of 2476	2052	DllCommonsvc.exe	81
PID 2052 wrote to memory of 2476	2052	DllCommonsvc.exe	81
PID 2052 wrote to memory of 1360	2052	DllCommonsvc.exe	82
PID 2052 wrote to memory of 1360	2052	DllCommonsvc.exe	82
PID 2052 wrote to memory of 1360	2052	DllCommonsvc.exe	82
PID 2052 wrote to memory of 3028	2052	DllCommonsvc.exe	83
PID 2052 wrote to memory of 3028	2052	DllCommonsvc.exe	83
PID 2052 wrote to memory of 3028	2052	DllCommonsvc.exe	83
PID 2052 wrote to memory of 1920	2052	DllCommonsvc.exe	98
PID 2052 wrote to memory of 1920	2052	DllCommonsvc.exe	98
PID 2052 wrote to memory of 1920	2052	DllCommonsvc.exe	98
PID 1920 wrote to memory of 3024	1920	wininit.exe	99
PID 1920 wrote to memory of 3024	1920	wininit.exe	99
PID 1920 wrote to memory of 3024	1920	wininit.exe	99
PID 3024 wrote to memory of 2220	3024	cmd.exe	101
PID 3024 wrote to memory of 2220	3024	cmd.exe	101
PID 3024 wrote to memory of 2220	3024	cmd.exe	101
PID 3024 wrote to memory of 840	3024	cmd.exe	102
PID 3024 wrote to memory of 840	3024	cmd.exe	102
PID 3024 wrote to memory of 840	3024	cmd.exe	102
PID 840 wrote to memory of 2492	840	wininit.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\36e0fa55438dbf73086d022ac1f06a91b94a10a1db769a1fd1112c854e6c6fdc.exe
"C:\Users\Admin\AppData\Local\Temp\36e0fa55438dbf73086d022ac1f06a91b94a10a1db769a1fd1112c854e6c6fdc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Desktop\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\system\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\de-DE\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1360
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
    - - C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1920
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2220
        
        C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GvLkm7sAXX.bat"
        8⤵
        
        PID:2492
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1992
        
        C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0MFyH7TMVd.bat"
        10⤵
        
        PID:2028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1984
        
        C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T7KIMELUbd.bat"
        12⤵
        
        PID:2888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2196
        
        C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jlvf1Vq2YP.bat"
        14⤵
        
        PID:956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2436
        
        C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat"
        16⤵
        
        PID:2536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1768
        
        C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B4BP5ZSgoJ.bat"
        18⤵
        
        PID:1200
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1516
        
        C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:272
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QOz0umrEhM.bat"
        20⤵
        
        PID:1692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3056
        
        C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat"
        22⤵
        
        PID:1792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1312
        
        C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat"
        24⤵
        
        PID:2216
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1044
        
        C:\Users\All Users\Desktop\wininit.exe
        
        "C:\Users\All Users\Desktop\wininit.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sNl5EWIzDs.bat"
        26⤵
        
        PID:2784
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Downloads\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Downloads\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Desktop\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Desktop\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Windows\system\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\system\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\system\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e78a0bafb2ddf36a0bc0ce29490fe759

SHA1
d4883e4d885e8d99e64f5330a4cb638e685fe60a

SHA256
d604b77fe5e4fb20a9b12afbd5b5f60b2e600ce5e1cc9d426d1c9b7672f8ebf4

SHA512
7347e7736f2387d31ae63c2f5824f64b888be2af8de8d64edf22c446fcb1f969b48c7098ed053b11964bea81f27a263bb8a5d70932a0f4f5c871d67f6fa14834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1528cee80b641001d6112f11abc85c33

SHA1
6258342f88882769dadd22f338617defe865d824

SHA256
0bf27a9d5914815c0e01497c66c5f1f59687eb45954b2f469863e821e3b250fa

SHA512
743efaa5f6a4c131470fdc0ad262339304f437986f595ee09680c22e220b945cd26b77dd344bf30258797bc7717b7ac5cc07774fb4fc2985ec43ae182e60bffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
556d741c3e70a0b7ded536b41636330d

SHA1
e50312f01bf01702e30329f9f0c6d095f2174a68

SHA256
54d92bbb1c6c8a5ce5d7aca807c95da0584335b7afe0ac6edb174b88a9333e80

SHA512
336a93127b9d397af5af5dc0fd0bba014a7e17aa8e4353c823d84ec21f7cbc97b7b6c2d6ac3ecedc49b6404c9e2e385d76066b267795e9fc725f7bd7fefe3299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4135156d442344320872ef4744d8e322

SHA1
393fde497403c5fceb8baf21fc0caee2f2297e7c

SHA256
219cf43a2031344095d0569952c09870653f45e50d5c81099f56ba33c3dac9b8

SHA512
a110c1c9fb004ffb7d67303a177ad5484dae04d4dc7b4ddbd78890dd8fdcd9cdd4f26afc55d61529f6d3622f3c78c3b3f1549560861ee9af20758ccb8d19f02f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90163b6e2fd7442b4da1f599f642e97a

SHA1
28213baae127f667f0fdcea6f6421f81cc84214e

SHA256
5b9ae21f234f4b02b0394a9dee3d1df47e100994cb01550027e3fb89ed8fe59c

SHA512
797dcfbcf291ba72adf6ab7fe03ae8163ab047838807d177aeb8e70ae4d3eee07fa591d148da64391ae5f273198333df67fce2524d49d2555398ad54b7cf9104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4fcb56fe210b7cb1c0ef26aacd3fb9d

SHA1
39edd6a2c75fe09a6d30ea81c59f56f12aad3bf1

SHA256
88047dd13c66de451c3e18d317dcdd33cf53215e42d0a58e4bcbd3a6264e7e82

SHA512
40a8104bf70abd0b03e35faf01b6bc7708adbec727aad6d248978da3df3de0f8a7ee39b7349b53120af230890b788f99a5b1a540aea53fe39817808f8fa884c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d02773d98887cff8deae1f4c77016149

SHA1
8765a737e52c3209a8cd6f7217c2c01defd4c10d

SHA256
410f702f89b0c3069d288db8e37e4878ec9754f46811146dd60f88642b939ee3

SHA512
bf0f0e84c48bfe7513afb91d9d8c48c3ee4bff159a2c00e57aaa7644b421fca1734d23f63088465d887fd45a279f51268d9da2efc9f3b9352a793f8c4c3b73b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
057cfade3aff887e332d9da249562012

SHA1
6b7e35b2449056d9e726d4fc14f397c06559bfcc

SHA256
7a20e0f6c1fb5f19a5a3c853207b2d163b9f05f799d43e4c8d9721295dfa8961

SHA512
539e6b6a92cbac20154d5584d8ef799797ceb86f212ec807b506e4849423aa3d2c97f0ad608c7b5fc46e0dd256d040865846d360bdd877492841fc18c0e0324f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92d52d74fc9ab26b1ff39f87ce4a46c3

SHA1
92bef93c30d31211a55a70d8430e11eb5a95fb1c

SHA256
60a68c150c6a26de4a7cb51bf8401bf3a8324b96fc30559bc649dab08fbb11b4

SHA512
86d6b9a7aa2aa1b0b0222b3a752246c4af6bd902ba5b7ee5e0be0c05503b84e12c2d7499b456fa7a0b6f22a9f2d05fcae300459af903ea09e6fbc5852cbc3bd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b53be26c56550b34de9785bdf86939e

SHA1
375a513d800dcf254fc89649814e8a3f54eef460

SHA256
9d571320f2dfca61a49fb55b0a147104f9182bdf8180accdedd0c62379a51562

SHA512
92d7d9bcc4b59d738f3e45b95468496e836926e78b2078f3ea6e302b6631410b2a0ed491159297b1e90f51a18a75e4ddfaaafd3c23d84f8c00614b16a7130138

Download Submit
C:\Users\Admin\AppData\Local\Temp\0MFyH7TMVd.bat

Filesize
203B

MD5
1f7036c2e47ca61512129e0c8639d8cc

SHA1
fb969df3491164ce595ea3d39256d6d613efa2cb

SHA256
fb0e6a00bc8ba782a6b9b9fecce45f7bea1265c5299d0e7ec2b437a63d3587e4

SHA512
316e1d048d4759e081488b648989652638af4f949a8d464d60dbab8cb8bc748fe2fd8d4b93c49292317679c1d802693422463a02827849f2f54cbec893c0afe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat

Filesize
203B

MD5
7990be22ddd3f9e4bca09233e325f7c4

SHA1
13efd408faa5e8633725ba924b584ed6414ec2b3

SHA256
80abf8310dda803fad9087718cd08d73651a1eda99f150a1f84b6d2bea95abc4

SHA512
2671518829c8a7d9f569f7ff1a65e830a19d5e62baf26185d6ce0926cad43a37ad19e48f13b5f73a1653e26c605bb3856fdf397c216f9c78b7179079a732fee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\B4BP5ZSgoJ.bat

Filesize
203B

MD5
7da09a9a65e21d828c1425ad49027450

SHA1
dc448ffc1f066e015f0218a64731706ae569b36e

SHA256
f0eb33f6cb7450640195275a9369865ea69fdeb0937861f99448c0e65d459dbe

SHA512
c7323085f8f051d4253fd5a88638320d97a0d6c16ac7974dc5fb9c5b27f27ac668179d4936a8aae414676ba130f81c74d5975526675e8940a8324b34a38b7ce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3574.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GvLkm7sAXX.bat

Filesize
203B

MD5
c91719145b33243f9dea72f090ba3778

SHA1
3048ac853f2205632231d39dfd1c4a4583029976

SHA256
0fc0f32fb36543b3e4bad454f8faa17bd0eff2a8a18b3b597f05def6ba1dd64a

SHA512
619eb5fbc06c0fa52be0b3e1e6e9b3d89ac4f8f8d5c03f8953f5eb8994edabafe5008a2d700fd5545ffebb3fccf2d30850ba6ddcf9b19fa0d36036e0934e4f7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jlvf1Vq2YP.bat

Filesize
203B

MD5
ddf6899d6624aa0c92b15aa30581d32d

SHA1
6599a50d63023304dbd456633ca95880e5abb8b1

SHA256
781c48b4ad726dc8ca6afe3223f8db54704a28cbc9d7c00872bfe14200af5481

SHA512
2e80c35319c490bf42cb268e18ae5681ae41d9bb87b5d27c6acc8a2488a729d0c879a08baf0048c78c685917e800cf23188baa14d032364e9f7fd4fddcbca8d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsMShxucCb.bat

Filesize
203B

MD5
f144de12871a06e9c947b450a9753549

SHA1
87381c566bab872a9f5c98d6a06510751643e71e

SHA256
5b1f2979afe9a65ff8d4dd1176fe56f815c5308141bd26d73c2aba91d24fbbaa

SHA512
d38deb4961d2de3b25ef0311c26e1b8388418bf73d3361332194e6b8f1d21d1a9bb91a278b067cd082134379594b1831c698195502803926043b27c1fd3cbad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\QOz0umrEhM.bat

Filesize
203B

MD5
da0e9c44acacb7682550cb2282d0c33a

SHA1
47164e6dc58e85650d8f0646414826d3985cbd80

SHA256
e8e8e5e9a8aa560eb09b4b480058d6c01db31bddc46aa192c25658138cde31d5

SHA512
efd962821b6a91412f4bcaae6d652c9d4cd1a1f1749fa6dd58aaf8ad3a8a34ddd265890b92ae57f1b1b6add559b5e34b5f367957debf6e93cd3bb063a1a962c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\T7KIMELUbd.bat

Filesize
203B

MD5
a27597dbedb2d5b08e8cf0db39d98fbb

SHA1
784fa2d2ace17c8e9b4d439075651be065d0fc5b

SHA256
e6ae01f3fa10390f5fa8aaed44ac7656218499a71de6ca969c1c19a29ee8ab97

SHA512
e6e52f7351c9283b9b86aee89f4a561495506df347d0a838b5e83dfd3d072f4661e222e670e9b6af993a9b46ea6dbc19ab3d70cfae1083607b566cc1df6b797a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3587.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat

Filesize
203B

MD5
5c8daa65b736a6632bed4eb250a5ba19

SHA1
3342060be7a25fd14d333ef3b302828f2ee959fa

SHA256
9a11a9f34a6e9b844a97bc434aea2f0e5dfde45e7ac4991619e0553037478f12

SHA512
ad49646650c6bdd25f428de122cc4d968b7b47f00b3d787db0fe9fdc212b1b92489313d441e2e64e1fb74d65c6cf5f7c19fba63c2fdf1a6ff33a180f2f4a3a40

Download Submit
C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat

Filesize
203B

MD5
4aa9ad821fb0c764939eeb7725cc4c9a

SHA1
973db1f1602b70044d44b3f1fa1ceafc73eee277

SHA256
5200d0fc6a0f199373922c2af00e58e57bdd40c3f63ad1a2d7b282a3afa7aa7e

SHA512
976f19ca2353fab87649436313e478392d9580ecca6a237fa34af76f8096635671536389af879be4663ed1a56dbd737e267708b9b4ce238dae9e2605497915cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\sNl5EWIzDs.bat

Filesize
203B

MD5
c6a8b8afe508cf0f21b465d36ad1fb18

SHA1
57deb6c51a1a83ac9aa6d1bb81f6d67ad1d25933

SHA256
1933cc54161e7a9516280a68a4631b4aa750927146d6aab2f6441d0de2d395d1

SHA512
f7d352884bf19c6de34c360d37f53f2724dfebe6bf121b11269f24160e90d74abad223c90af107ef498c6ef08d724297f85e557e3cde8cf2468ac424e48e71f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
15d279d2cafb8d537946dce03b2229df

SHA1
c526a3cd64c2843e06fae8e6615e0b055a0645c4

SHA256
8f1952974f787045c1f26f1f4a4e2a908042665e3b21efc7f04ce01be6d2cf87

SHA512
80acb610e338a8971bcc59dc926de5c25f30f6b7823a5e2425a1bc5c84eedf74026c963e949992f733df215daca9e88a9931998b1173778e34d549aefb6cb602

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/856-59-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/1324-649-0x00000000010C0000-0x00000000011D0000-memory.dmp

Filesize
1.1MB

Download
memory/1776-48-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/1920-114-0x0000000001030000-0x0000000001140000-memory.dmp

Filesize
1.1MB

Download
memory/2032-589-0x0000000000370000-0x0000000000480000-memory.dmp

Filesize
1.1MB

Download
memory/2052-17-0x0000000000510000-0x000000000051C000-memory.dmp

Filesize
48KB

Download
memory/2052-16-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2052-15-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2052-14-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2052-13-0x0000000000190000-0x00000000002A0000-memory.dmp

Filesize
1.1MB

Download
memory/2092-351-0x00000000003B0000-0x00000000003C2000-memory.dmp

Filesize
72KB

Download
memory/2092-350-0x0000000001160000-0x0000000001270000-memory.dmp

Filesize
1.1MB

Download
memory/2512-411-0x0000000000390000-0x00000000003A2000-memory.dmp

Filesize
72KB

Download