dcrat | efe572ee34f8a6aad46980090b615c188de9921e335d2124a4912bf4cc94500e

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_efe572ee34f8a6aad46980090b615c188de9921e335d2124a4912bf4cc94500e.exe
Size

1.3MB
MD5

1eaf4824a0ff1ce7483580da62ffddf0
SHA1

8c349e58038ac86d53901b0eaef9adf8ca3d45f3
SHA256

efe572ee34f8a6aad46980090b615c188de9921e335d2124a4912bf4cc94500e
SHA512

31d0a5191b78e12c02d5a9e70e0fcf780e8c9772537938471a9478fb87d2c9c8106009c3396965b653ef83d95c5b3ce5fdc6144cc8a817216c4fb56ea7a30f09
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2668	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2668	schtasks.exe	34

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016b86-12.dat	dcrat
behavioral1/memory/2572-13-0x00000000011A0000-0x00000000012B0000-memory.dmp	dcrat
behavioral1/memory/3040-115-0x0000000000840000-0x0000000000950000-memory.dmp	dcrat
behavioral1/memory/1788-175-0x00000000002D0000-0x00000000003E0000-memory.dmp	dcrat
behavioral1/memory/1872-236-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat
behavioral1/memory/1108-297-0x0000000000360000-0x0000000000470000-memory.dmp	dcrat
behavioral1/memory/1404-358-0x0000000000A40000-0x0000000000B50000-memory.dmp	dcrat
behavioral1/memory/2384-418-0x0000000000D30000-0x0000000000E40000-memory.dmp	dcrat
behavioral1/memory/2168-538-0x0000000000140000-0x0000000000250000-memory.dmp	dcrat
behavioral1/memory/1040-598-0x00000000013C0000-0x00000000014D0000-memory.dmp	dcrat
behavioral1/memory/2752-718-0x0000000000020000-0x0000000000130000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe
1032	powershell.exe
2408	powershell.exe
2384	powershell.exe
1872	powershell.exe
340	powershell.exe
1956	powershell.exe
2268	powershell.exe
1072	powershell.exe
2376	powershell.exe
1192	powershell.exe
1152	powershell.exe
2208	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2572	DllCommonsvc.exe
3040	taskhost.exe
1788	taskhost.exe
1872	taskhost.exe
1108	taskhost.exe
1404	taskhost.exe
2384	taskhost.exe
1036	taskhost.exe
2168	taskhost.exe
1040	taskhost.exe
2160	taskhost.exe
2752	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2772	cmd.exe
2772	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com
36	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\Idle.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Windows\inf\smss.exe	DllCommonsvc.exe
File created	C:\Windows\inf\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\lsm.exe	DllCommonsvc.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\Offline Web Pages\System.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_efe572ee34f8a6aad46980090b615c188de9921e335d2124a4912bf4cc94500e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2196	schtasks.exe
2232	schtasks.exe
988	schtasks.exe
2160	schtasks.exe
2904	schtasks.exe
2344	schtasks.exe
1308	schtasks.exe
1932	schtasks.exe
1712	schtasks.exe
2912	schtasks.exe
2292	schtasks.exe
3064	schtasks.exe
396	schtasks.exe
840	schtasks.exe
1456	schtasks.exe
2444	schtasks.exe
2380	schtasks.exe
932	schtasks.exe
596	schtasks.exe
2188	schtasks.exe
2060	schtasks.exe
2812	schtasks.exe
1704	schtasks.exe
2864	schtasks.exe
2080	schtasks.exe
1552	schtasks.exe
2968	schtasks.exe
1284	schtasks.exe
708	schtasks.exe
2752	schtasks.exe
568	schtasks.exe
2636	schtasks.exe
1672	schtasks.exe
1200	schtasks.exe
404	schtasks.exe
1240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2572	DllCommonsvc.exe
2572	DllCommonsvc.exe
2572	DllCommonsvc.exe
2572	DllCommonsvc.exe
2572	DllCommonsvc.exe
1956	powershell.exe
2208	powershell.exe
1072	powershell.exe
2384	powershell.exe
2268	powershell.exe
1192	powershell.exe
1032	powershell.exe
2368	powershell.exe
2376	powershell.exe
1872	powershell.exe
1152	powershell.exe
340	powershell.exe
2408	powershell.exe
3040	taskhost.exe
1788	taskhost.exe
1872	taskhost.exe
1108	taskhost.exe
1404	taskhost.exe
2384	taskhost.exe
1036	taskhost.exe
2168	taskhost.exe
1040	taskhost.exe
2160	taskhost.exe
2752	taskhost.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	DllCommonsvc.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	340	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	3040	taskhost.exe
Token: SeDebugPrivilege	1788	taskhost.exe
Token: SeDebugPrivilege	1872	taskhost.exe
Token: SeDebugPrivilege	1108	taskhost.exe
Token: SeDebugPrivilege	1404	taskhost.exe
Token: SeDebugPrivilege	2384	taskhost.exe
Token: SeDebugPrivilege	1036	taskhost.exe
Token: SeDebugPrivilege	2168	taskhost.exe
Token: SeDebugPrivilege	1040	taskhost.exe
Token: SeDebugPrivilege	2160	taskhost.exe
Token: SeDebugPrivilege	2752	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2820	2640	JaffaCakes118_efe572ee34f8a6aad46980090b615c188de9921e335d2124a4912bf4cc94500e.exe	30
PID 2640 wrote to memory of 2820	2640	JaffaCakes118_efe572ee34f8a6aad46980090b615c188de9921e335d2124a4912bf4cc94500e.exe	30
PID 2640 wrote to memory of 2820	2640	JaffaCakes118_efe572ee34f8a6aad46980090b615c188de9921e335d2124a4912bf4cc94500e.exe	30
PID 2640 wrote to memory of 2820	2640	JaffaCakes118_efe572ee34f8a6aad46980090b615c188de9921e335d2124a4912bf4cc94500e.exe	30
PID 2820 wrote to memory of 2772	2820	WScript.exe	31
PID 2820 wrote to memory of 2772	2820	WScript.exe	31
PID 2820 wrote to memory of 2772	2820	WScript.exe	31
PID 2820 wrote to memory of 2772	2820	WScript.exe	31
PID 2772 wrote to memory of 2572	2772	cmd.exe	33
PID 2772 wrote to memory of 2572	2772	cmd.exe	33
PID 2772 wrote to memory of 2572	2772	cmd.exe	33
PID 2772 wrote to memory of 2572	2772	cmd.exe	33
PID 2572 wrote to memory of 1872	2572	DllCommonsvc.exe	71
PID 2572 wrote to memory of 1872	2572	DllCommonsvc.exe	71
PID 2572 wrote to memory of 1872	2572	DllCommonsvc.exe	71
PID 2572 wrote to memory of 2376	2572	DllCommonsvc.exe	72
PID 2572 wrote to memory of 2376	2572	DllCommonsvc.exe	72
PID 2572 wrote to memory of 2376	2572	DllCommonsvc.exe	72
PID 2572 wrote to memory of 1192	2572	DllCommonsvc.exe	73
PID 2572 wrote to memory of 1192	2572	DllCommonsvc.exe	73
PID 2572 wrote to memory of 1192	2572	DllCommonsvc.exe	73
PID 2572 wrote to memory of 340	2572	DllCommonsvc.exe	74
PID 2572 wrote to memory of 340	2572	DllCommonsvc.exe	74
PID 2572 wrote to memory of 340	2572	DllCommonsvc.exe	74
PID 2572 wrote to memory of 1956	2572	DllCommonsvc.exe	75
PID 2572 wrote to memory of 1956	2572	DllCommonsvc.exe	75
PID 2572 wrote to memory of 1956	2572	DllCommonsvc.exe	75
PID 2572 wrote to memory of 2268	2572	DllCommonsvc.exe	76
PID 2572 wrote to memory of 2268	2572	DllCommonsvc.exe	76
PID 2572 wrote to memory of 2268	2572	DllCommonsvc.exe	76
PID 2572 wrote to memory of 2368	2572	DllCommonsvc.exe	77
PID 2572 wrote to memory of 2368	2572	DllCommonsvc.exe	77
PID 2572 wrote to memory of 2368	2572	DllCommonsvc.exe	77
PID 2572 wrote to memory of 1152	2572	DllCommonsvc.exe	78
PID 2572 wrote to memory of 1152	2572	DllCommonsvc.exe	78
PID 2572 wrote to memory of 1152	2572	DllCommonsvc.exe	78
PID 2572 wrote to memory of 2208	2572	DllCommonsvc.exe	79
PID 2572 wrote to memory of 2208	2572	DllCommonsvc.exe	79
PID 2572 wrote to memory of 2208	2572	DllCommonsvc.exe	79
PID 2572 wrote to memory of 1072	2572	DllCommonsvc.exe	80
PID 2572 wrote to memory of 1072	2572	DllCommonsvc.exe	80
PID 2572 wrote to memory of 1072	2572	DllCommonsvc.exe	80
PID 2572 wrote to memory of 1032	2572	DllCommonsvc.exe	81
PID 2572 wrote to memory of 1032	2572	DllCommonsvc.exe	81
PID 2572 wrote to memory of 1032	2572	DllCommonsvc.exe	81
PID 2572 wrote to memory of 2408	2572	DllCommonsvc.exe	82
PID 2572 wrote to memory of 2408	2572	DllCommonsvc.exe	82
PID 2572 wrote to memory of 2408	2572	DllCommonsvc.exe	82
PID 2572 wrote to memory of 2384	2572	DllCommonsvc.exe	83
PID 2572 wrote to memory of 2384	2572	DllCommonsvc.exe	83
PID 2572 wrote to memory of 2384	2572	DllCommonsvc.exe	83
PID 2572 wrote to memory of 1972	2572	DllCommonsvc.exe	97
PID 2572 wrote to memory of 1972	2572	DllCommonsvc.exe	97
PID 2572 wrote to memory of 1972	2572	DllCommonsvc.exe	97
PID 1972 wrote to memory of 2776	1972	cmd.exe	99
PID 1972 wrote to memory of 2776	1972	cmd.exe	99
PID 1972 wrote to memory of 2776	1972	cmd.exe	99
PID 1972 wrote to memory of 3040	1972	cmd.exe	100
PID 1972 wrote to memory of 3040	1972	cmd.exe	100
PID 1972 wrote to memory of 3040	1972	cmd.exe	100
PID 3040 wrote to memory of 2180	3040	taskhost.exe	101
PID 3040 wrote to memory of 2180	3040	taskhost.exe	101
PID 3040 wrote to memory of 2180	3040	taskhost.exe	101
PID 2180 wrote to memory of 2712	2180	cmd.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_efe572ee34f8a6aad46980090b615c188de9921e335d2124a4912bf4cc94500e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_efe572ee34f8a6aad46980090b615c188de9921e335d2124a4912bf4cc94500e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\ja-JP\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\inf\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KC4nnSWOK3.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1972
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2776
      - C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oPL6j2OtN4.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2712
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\muCkezbCVz.bat"
        9⤵
        
        PID:1200
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2064
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OZJpL0Zeaq.bat"
        11⤵
        
        PID:2440
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:440
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6n1oUPmZQq.bat"
        13⤵
        
        PID:632
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1528
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JCnMdX7E06.bat"
        15⤵
        
        PID:2220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:960
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OoUlhQHDc2.bat"
        17⤵
        
        PID:2664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1648
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"
        19⤵
        
        PID:2856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2456
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat"
        21⤵
        
        PID:840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:964
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat"
        23⤵
        
        PID:2388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1952
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m47JVZSxDi.bat"
        25⤵
        
        PID:596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2444
        
        C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
        
        "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Application Data\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Application Data\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\inf\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\inf\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\inf\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\Offline Web Pages\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
823690724c5649437fb8bcc20a415c2b

SHA1
cc05c6f286de31e4a44a459d73f42bf4d4da7563

SHA256
e95fd388d1f4d5895e9a73052015b3c7971daf52efa53b68bf88a3f780094737

SHA512
181327dfde8b7ddb3d96c3945e65c2e9d912ddd2b091336e8ceb1d5261d4c9e48c8809502ba94093da98d685cfef666dd0d682fbb9bd08f8ab89dbdb3a22bd07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24d3e7ade5eb9bbdeb753dc9abdeaba4

SHA1
b3bfbbf848306182a2bd136a14a03a3e35ea6f72

SHA256
27af7aef9c5914b6b2fec5c6c571c6d20252f28025411f0a1cbdb7c7d210dd93

SHA512
5d091dc2e0e12c86df08fae3d07748ea3af23e1c413bca524a2123cd446374f54d138d93b121a8109ce8e2a836a99820a2fe33acfb1612afcb58c5633bb6bad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9f83b9987164ceb79ebb41a7ee54261

SHA1
77d5d335a1809781c7d82b92a81a5fd4238fcf64

SHA256
57b6ec445d950324ca15a5cc4532c85ef421c53844ff33da7981bebe03bfc992

SHA512
926226374784211ff390e8872aec80e48daabd57cf9fd475a1168ca0c5cf9a327331152172863efe7d3c3cd760adc14584d267b36c515940883bbb7ea8367839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aab5168858290581b1ae203c76b901f8

SHA1
56e82c88d32f41cd467a733403ad6e958754c1a9

SHA256
39134b237a0ae98a2b6af277b0c1a57850b1367376dd9a90aeec170f11816a1e

SHA512
6b60bf1ce89af566b24878fe7aa66ab973cf12d199645ad7b6bb1c533c508771d6944ee6d9040e7768406bde84a4194b6e10a3fe8c9f7a332737ca9a1ddbbcd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3fd0b310750caa9d1a5fa9b2cf182b4

SHA1
c1cc94e3589f66491e14b6d21f53415e4c243252

SHA256
843ec727bb87b4c5f6cf2fa6c2643be5a875d85cccd335e9fb9a1d6a3e0f18af

SHA512
0f881d2faa28bdbaea7d70293413a75b51dad03ad9eb6978fc53029a65e6b06fbbbb908fffa41a5eb0557187b3ca556767770a2414501f8cc1019b1ce435855c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4fe85ae70dc0fac4bd333786e3dd1d1

SHA1
42b5a78e7ced2184795dd996d657bc8cd885806e

SHA256
963140326bb218f8d990e3282936cb50c055e4fe4638b7b3d61e66c58da93ea8

SHA512
585fa96fdd6d857a679766c364c2d893c9cc0cfe05d2f98ea2fce7df624dc5260b3879f3248e8ecac4f90b84ef3926f3a1ebc934acf18a91227e289bdca8338c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1915d7686b740adc244fe79c820f3896

SHA1
0ff9a8a1d0016e0e7057f59dffb2605bef14929f

SHA256
26e6a898a3566366d3e4a5e05d3b4ce5e7a382c6710d6920cbe452e54f17b438

SHA512
6689bc4c5928018b343fe856cf56a6328f6d56b06a0edf491ba7a8c1f7721eb03ec6fe1a91b154f6553261cd44c68122d7f932773c885e6728609632365feca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45c877efd941cad51b9db6220341dcb8

SHA1
0d6a39a4e7e0f3505a88ee2afbd85c75ccde426c

SHA256
a1a6ac5f54185ba0e63202b30fbb65c7083ac44c6f94779613341e59ef17655b

SHA512
e3050f4ecb6caf19bb956d721c75c6f6d39bf87fcf96d5590597f8f2eb3e9a7fe0c6371483263fece02db830e244a1cd0cabaa666d3be8365df13210769cac2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9edc573f973496b64438634b3e7da4b4

SHA1
aeb605029c963e4b62f9518568fa0935f1d5bb64

SHA256
a6f06deec42320fcedf45594169114c5ac30815659de5b91212ae4c18f22ce12

SHA512
08f42f511d6ef0a2aed0d5e09621449847ff7218cb2c4855a5d8fade5a1a08bf687ebcbe76dc17c145ee75103703070601b34c6da964a0c22f01ef0b7fe0e1f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\6n1oUPmZQq.bat

Filesize
240B

MD5
d051b0f48fb669659d4aca5147aca1a6

SHA1
f3cfd83bb67e440c07e0087e835cb854b887d0e0

SHA256
bda9115cc8094d14083599aa599000e2938cbbb8e139001c95e204f2dedacd41

SHA512
940c4216d8f68a0cf24891b76fb1955f3cd094ad0f1b15b2c6af8d240b85c238739348d16ed97d9ed3c0ddd21d0e511c85a7db8c984d00549b6f87ea388ffc83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9050.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat

Filesize
240B

MD5
018ad0ac4864a03d3de2d04650f83cfb

SHA1
3373671f390e84760d3f76fec584fcbf72636d1c

SHA256
0e5a645af67d6f3b48e16acbc99429e1e55bfd76ddbfcd1620f971ce7baffba2

SHA512
51491d23580dee1f9c32ae742cf7c0d69b0c2d36b825b7e57caf23ce47551d6a8d369ba50cdd2b797c5ac3915bc5e22bec9499959085db25c66eff654dc9752c

Download Submit
C:\Users\Admin\AppData\Local\Temp\JCnMdX7E06.bat

Filesize
240B

MD5
2a923403ade363cb9146eb0fd20fe6e1

SHA1
38da5c0799e2cbb3b95a41df807b4621ed22f285

SHA256
25fb8a8b9a9ece87d438a27f95e0afd4b468d52cccd82a51b6e103c3ee92fb00

SHA512
dcc7765cac2919ef960e5c55caab709987929287ae665a3166447819efa239735ff770e85e245beaf324fe27ac6ef7a9046bc76bdb8af45b115aaa29bc4ad433

Download Submit
C:\Users\Admin\AppData\Local\Temp\KC4nnSWOK3.bat

Filesize
240B

MD5
9f41b53fc6c20c1f685040091be47c81

SHA1
af59feeff4bc05d64059a71a71042b0520177232

SHA256
d5769ca818d6a4c3db4c27dc1b59e7ecd02e16d0504d07727e4616395f64d521

SHA512
f8977e96337d956d64d42433e853845338815c90467e8859803be578b8947dfad680cec7dff763478bfc1239058d59b8e70b7d7ba8398da2fbb88b90d87c5da0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat

Filesize
240B

MD5
f690f7078eddf21834095aa4eeeff20f

SHA1
f581e67d6676dfe21931bbc50f086ff7bd938550

SHA256
37d6e5ddb3fd24382a3dbc04d417ed68bcc2a1bdb357b3caa804bc7e18f2c48a

SHA512
c19adac125406c464459804cd9b3be1db2ecd71d562f57cd18aa6fd488f3b3359d994837c7472e239d0e91dcb8dabd7f1b0e1d51e6f34b2e433f53ab82bc0e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\OZJpL0Zeaq.bat

Filesize
240B

MD5
3d10ba52d31afee79aa83557e6acb8f6

SHA1
b00b4d34e30ab5b2145f41df30db1a93675c7801

SHA256
2ed5071206904c926ad9eafdec19873128ea5d76fd8267e6f024378303d7093b

SHA512
dd80fac009e790071f298953dddad2fd901fa128469b5f043d9c346abe585a647ee137908bfd6639f03d91acf44c627d3daebaa183ffacbf2408358edf647efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\OoUlhQHDc2.bat

Filesize
240B

MD5
7ee2104e3112fb172d80405e73062cc5

SHA1
26f6f578bd250d49b0b8f14f8160c8460acb4dbc

SHA256
aedfcf78adcd99f7f440fdae6b032b13f8f1fa0a4ba961c52c2606128c0c7775

SHA512
90b969a98d6adeeee3ead56c0f28a3ee833e09974ae0f6be22c2ab425b3e9bab575ade1bef79b284133d3c0f0e4666e44c286a3dee662091e91cbf738d4b68fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9062.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\m47JVZSxDi.bat

Filesize
240B

MD5
f5ecceb42261ed8af72f378229df2ccd

SHA1
833a94328c68c99e6f301cd53d850f8d3e66494f

SHA256
481f7ed4fd5b03cd80395087a4fac2f87e2dfd7b2ae55b4f6076c650d55434e5

SHA512
14ebc863202a7ca8c4db3e08b42f628a213b0f7495ad2c0422695521367d1a79acfe5c164b916421bc7eed4cab38ae9501665338920f745e16722520886fd7c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\muCkezbCVz.bat

Filesize
240B

MD5
9ac8dcf96d6c5bf8e69ce9e26b7742b9

SHA1
842f6dd9bdfeacd3f06cb12e1c551205cd9b7ea9

SHA256
d978755962a49517176686c28bd57e06bc700358c4fd10bf87899dd6842c8dbd

SHA512
d2ca6f386f172f3357ed040932537221eec87271fc70c6b35d36dd93c236952cb5c49ea43bf8a7f33c9271719b2951fa54e4615623a8f997eec9862d8538ea7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\oPL6j2OtN4.bat

Filesize
240B

MD5
1790779658414b5bad0a77c8159ceae1

SHA1
d9c172fc0d45a49f4a9f1823b21f03093c234c2b

SHA256
93a616b04efbcaed9f9052d437bb8677a3bbc04fe8ba447a7f9c995f430bcaa1

SHA512
e8f25284bc1c804f8641031a85840026105d8ecd0b14037bb570a6d62486d7587b4c17acd0abd9def0cc60a12084fdfbf64f60215a8881c392527c7889636e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdW26R6SPG.bat

Filesize
240B

MD5
8bab1863ba1c6664684d6b31e27a2bf1

SHA1
b4d00f690f43fd1454cc17cf70120cbe3560cf30

SHA256
34c20ce7eaf34b9e4471ccc928b7ebdc741b4dfa342e76db2e400095bd79cc5a

SHA512
ec8b31c86368729c3ef98855716388c88c57c1190bc3ca536acc9a46172871631951f955fec76c426ff97007211f521b3f8cc19a18aed29e13909c7d005be686

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
bb862496d405a216f7b49f23afb98be0

SHA1
5bf7bd1cd788b948e257459593771243fb5f5d1b

SHA256
21c58645211763be3b1546f3f876fb15ef74726ab1330b0798e919a112a958c4

SHA512
a9cc81eec8ac20cd0be8eb1bce765698db1db155d83d4c57f8ad5c14e6952486bef061b98e8b7001f162938848bc28e0f903f573cd501ab6754c3d2b499ec542

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1040-598-0x00000000013C0000-0x00000000014D0000-memory.dmp

Filesize
1.1MB

Download
memory/1040-599-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/1108-297-0x0000000000360000-0x0000000000470000-memory.dmp

Filesize
1.1MB

Download
memory/1108-298-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/1404-358-0x0000000000A40000-0x0000000000B50000-memory.dmp

Filesize
1.1MB

Download
memory/1788-175-0x00000000002D0000-0x00000000003E0000-memory.dmp

Filesize
1.1MB

Download
memory/1788-176-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/1872-236-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download
memory/1872-237-0x0000000000370000-0x0000000000382000-memory.dmp

Filesize
72KB

Download
memory/1956-66-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/1956-72-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/2168-538-0x0000000000140000-0x0000000000250000-memory.dmp

Filesize
1.1MB

Download
memory/2384-419-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/2384-418-0x0000000000D30000-0x0000000000E40000-memory.dmp

Filesize
1.1MB

Download
memory/2572-14-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/2572-15-0x0000000000C60000-0x0000000000C6C000-memory.dmp

Filesize
48KB

Download
memory/2572-16-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Filesize
48KB

Download
memory/2572-13-0x00000000011A0000-0x00000000012B0000-memory.dmp

Filesize
1.1MB

Download
memory/2572-17-0x0000000000E10000-0x0000000000E1C000-memory.dmp

Filesize
48KB

Download
memory/2752-718-0x0000000000020000-0x0000000000130000-memory.dmp

Filesize
1.1MB

Download
memory/3040-115-0x0000000000840000-0x0000000000950000-memory.dmp

Filesize
1.1MB

Download
memory/3040-116-0x00000000004B0000-0x00000000004C2000-memory.dmp

Filesize
72KB

Download