dcrat | 1a1de470efbd109fbe835c793e36cb76d08174e00f3031865760b2df0b972b00

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1a1de470efbd109fbe835c793e36cb76d08174e00f3031865760b2df0b972b00.exe
Size

1.3MB
MD5

0e3417f664b4fbf56be4ed3f807e5fbf
SHA1

0f67c31833856bf73aef60b3661830655cd877ca
SHA256

1a1de470efbd109fbe835c793e36cb76d08174e00f3031865760b2df0b972b00
SHA512

1c197770772e1051e1bd0fd99ed65e37ee1cdc91dbdcb51bedb71a640bf41fb77144b48b59e63337fa9723a77a52286a802f526f3f66fc0e224ae81b13a498ec
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2420	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2420	schtasks.exe	32

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000014510-9.dat	dcrat
behavioral1/memory/2712-13-0x0000000000210000-0x0000000000320000-memory.dmp	dcrat
behavioral1/memory/2488-94-0x00000000003F0000-0x0000000000500000-memory.dmp	dcrat
behavioral1/memory/408-153-0x00000000008B0000-0x00000000009C0000-memory.dmp	dcrat
behavioral1/memory/2708-213-0x0000000001080000-0x0000000001190000-memory.dmp	dcrat
behavioral1/memory/1992-332-0x00000000002D0000-0x00000000003E0000-memory.dmp	dcrat
behavioral1/memory/2948-392-0x0000000001220000-0x0000000001330000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2648	powershell.exe
668	powershell.exe
2152	powershell.exe
1588	powershell.exe
2108	powershell.exe
904	powershell.exe
2912	powershell.exe
1772	powershell.exe
1784	powershell.exe
1264	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2712	DllCommonsvc.exe
2488	dwm.exe
408	dwm.exe
2708	dwm.exe
1564	dwm.exe
1992	dwm.exe
2948	dwm.exe
1744	dwm.exe
2628	dwm.exe
2084	dwm.exe
376	dwm.exe

Loads dropped DLL 2 IoCs

pid	Process
2888	cmd.exe
2888	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
34	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
13	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\fr-FR\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\fr-FR\5940a34987c991	DllCommonsvc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\diagnostics\system\DeviceCenter\ja-JP\spoolsv.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1a1de470efbd109fbe835c793e36cb76d08174e00f3031865760b2df0b972b00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1656	schtasks.exe
2504	schtasks.exe
2404	schtasks.exe
2080	schtasks.exe
344	schtasks.exe
2856	schtasks.exe
1592	schtasks.exe
2652	schtasks.exe
3032	schtasks.exe
872	schtasks.exe
2656	schtasks.exe
2012	schtasks.exe
2600	schtasks.exe
2096	schtasks.exe
2684	schtasks.exe
2748	schtasks.exe
1968	schtasks.exe
1884	schtasks.exe
936	schtasks.exe
2488	schtasks.exe
2772	schtasks.exe
1992	schtasks.exe
2872	schtasks.exe
1980	schtasks.exe
1860	schtasks.exe
1932	schtasks.exe
788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2712	DllCommonsvc.exe
2712	DllCommonsvc.exe
2712	DllCommonsvc.exe
1772	powershell.exe
2152	powershell.exe
2648	powershell.exe
1588	powershell.exe
1264	powershell.exe
904	powershell.exe
2108	powershell.exe
1784	powershell.exe
668	powershell.exe
2912	powershell.exe
2488	dwm.exe
408	dwm.exe
2708	dwm.exe
1564	dwm.exe
1992	dwm.exe
2948	dwm.exe
1744	dwm.exe
2628	dwm.exe
2084	dwm.exe
376	dwm.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	DllCommonsvc.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2488	dwm.exe
Token: SeDebugPrivilege	408	dwm.exe
Token: SeDebugPrivilege	2708	dwm.exe
Token: SeDebugPrivilege	1564	dwm.exe
Token: SeDebugPrivilege	1992	dwm.exe
Token: SeDebugPrivilege	2948	dwm.exe
Token: SeDebugPrivilege	1744	dwm.exe
Token: SeDebugPrivilege	2628	dwm.exe
Token: SeDebugPrivilege	2084	dwm.exe
Token: SeDebugPrivilege	376	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2548	2736	JaffaCakes118_1a1de470efbd109fbe835c793e36cb76d08174e00f3031865760b2df0b972b00.exe	28
PID 2736 wrote to memory of 2548	2736	JaffaCakes118_1a1de470efbd109fbe835c793e36cb76d08174e00f3031865760b2df0b972b00.exe	28
PID 2736 wrote to memory of 2548	2736	JaffaCakes118_1a1de470efbd109fbe835c793e36cb76d08174e00f3031865760b2df0b972b00.exe	28
PID 2736 wrote to memory of 2548	2736	JaffaCakes118_1a1de470efbd109fbe835c793e36cb76d08174e00f3031865760b2df0b972b00.exe	28
PID 2548 wrote to memory of 2888	2548	WScript.exe	29
PID 2548 wrote to memory of 2888	2548	WScript.exe	29
PID 2548 wrote to memory of 2888	2548	WScript.exe	29
PID 2548 wrote to memory of 2888	2548	WScript.exe	29
PID 2888 wrote to memory of 2712	2888	cmd.exe	31
PID 2888 wrote to memory of 2712	2888	cmd.exe	31
PID 2888 wrote to memory of 2712	2888	cmd.exe	31
PID 2888 wrote to memory of 2712	2888	cmd.exe	31
PID 2712 wrote to memory of 1588	2712	DllCommonsvc.exe	60
PID 2712 wrote to memory of 1588	2712	DllCommonsvc.exe	60
PID 2712 wrote to memory of 1588	2712	DllCommonsvc.exe	60
PID 2712 wrote to memory of 2108	2712	DllCommonsvc.exe	61
PID 2712 wrote to memory of 2108	2712	DllCommonsvc.exe	61
PID 2712 wrote to memory of 2108	2712	DllCommonsvc.exe	61
PID 2712 wrote to memory of 1264	2712	DllCommonsvc.exe	62
PID 2712 wrote to memory of 1264	2712	DllCommonsvc.exe	62
PID 2712 wrote to memory of 1264	2712	DllCommonsvc.exe	62
PID 2712 wrote to memory of 904	2712	DllCommonsvc.exe	63
PID 2712 wrote to memory of 904	2712	DllCommonsvc.exe	63
PID 2712 wrote to memory of 904	2712	DllCommonsvc.exe	63
PID 2712 wrote to memory of 2648	2712	DllCommonsvc.exe	65
PID 2712 wrote to memory of 2648	2712	DllCommonsvc.exe	65
PID 2712 wrote to memory of 2648	2712	DllCommonsvc.exe	65
PID 2712 wrote to memory of 2912	2712	DllCommonsvc.exe	67
PID 2712 wrote to memory of 2912	2712	DllCommonsvc.exe	67
PID 2712 wrote to memory of 2912	2712	DllCommonsvc.exe	67
PID 2712 wrote to memory of 1784	2712	DllCommonsvc.exe	68
PID 2712 wrote to memory of 1784	2712	DllCommonsvc.exe	68
PID 2712 wrote to memory of 1784	2712	DllCommonsvc.exe	68
PID 2712 wrote to memory of 1772	2712	DllCommonsvc.exe	69
PID 2712 wrote to memory of 1772	2712	DllCommonsvc.exe	69
PID 2712 wrote to memory of 1772	2712	DllCommonsvc.exe	69
PID 2712 wrote to memory of 668	2712	DllCommonsvc.exe	70
PID 2712 wrote to memory of 668	2712	DllCommonsvc.exe	70
PID 2712 wrote to memory of 668	2712	DllCommonsvc.exe	70
PID 2712 wrote to memory of 2152	2712	DllCommonsvc.exe	71
PID 2712 wrote to memory of 2152	2712	DllCommonsvc.exe	71
PID 2712 wrote to memory of 2152	2712	DllCommonsvc.exe	71
PID 2712 wrote to memory of 2024	2712	DllCommonsvc.exe	80
PID 2712 wrote to memory of 2024	2712	DllCommonsvc.exe	80
PID 2712 wrote to memory of 2024	2712	DllCommonsvc.exe	80
PID 2024 wrote to memory of 2092	2024	cmd.exe	82
PID 2024 wrote to memory of 2092	2024	cmd.exe	82
PID 2024 wrote to memory of 2092	2024	cmd.exe	82
PID 2024 wrote to memory of 2488	2024	cmd.exe	83
PID 2024 wrote to memory of 2488	2024	cmd.exe	83
PID 2024 wrote to memory of 2488	2024	cmd.exe	83
PID 2488 wrote to memory of 2504	2488	dwm.exe	84
PID 2488 wrote to memory of 2504	2488	dwm.exe	84
PID 2488 wrote to memory of 2504	2488	dwm.exe	84
PID 2504 wrote to memory of 2908	2504	cmd.exe	86
PID 2504 wrote to memory of 2908	2504	cmd.exe	86
PID 2504 wrote to memory of 2908	2504	cmd.exe	86
PID 2504 wrote to memory of 408	2504	cmd.exe	87
PID 2504 wrote to memory of 408	2504	cmd.exe	87
PID 2504 wrote to memory of 408	2504	cmd.exe	87
PID 408 wrote to memory of 2892	408	dwm.exe	90
PID 408 wrote to memory of 2892	408	dwm.exe	90
PID 408 wrote to memory of 2892	408	dwm.exe	90
PID 2892 wrote to memory of 1360	2892	cmd.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1a1de470efbd109fbe835c793e36cb76d08174e00f3031865760b2df0b972b00.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1a1de470efbd109fbe835c793e36cb76d08174e00f3031865760b2df0b972b00.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\LocalLow\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\fr-FR\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\01W0MkcRY2.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2092
      - C:\Users\Public\Downloads\dwm.exe
        
        "C:\Users\Public\Downloads\dwm.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbMo3XBCxD.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2908
        
        C:\Users\Public\Downloads\dwm.exe
        
        "C:\Users\Public\Downloads\dwm.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1360
        
        C:\Users\Public\Downloads\dwm.exe
        
        "C:\Users\Public\Downloads\dwm.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat"
        11⤵
        
        PID:2900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1208
        
        C:\Users\Public\Downloads\dwm.exe
        
        "C:\Users\Public\Downloads\dwm.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat"
        13⤵
        
        PID:1888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2788
        
        C:\Users\Public\Downloads\dwm.exe
        
        "C:\Users\Public\Downloads\dwm.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat"
        15⤵
        
        PID:2904
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:632
        
        C:\Users\Public\Downloads\dwm.exe
        
        "C:\Users\Public\Downloads\dwm.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qKN9Q7Smhq.bat"
        17⤵
        
        PID:2916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1528
        
        C:\Users\Public\Downloads\dwm.exe
        
        "C:\Users\Public\Downloads\dwm.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat"
        19⤵
        
        PID:2672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1900
        
        C:\Users\Public\Downloads\dwm.exe
        
        "C:\Users\Public\Downloads\dwm.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V3SaMhi525.bat"
        21⤵
        
        PID:2096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3028
        
        C:\Users\Public\Downloads\dwm.exe
        
        "C:\Users\Public\Downloads\dwm.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FgAoPiAcVL.bat"
        23⤵
        
        PID:2020
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2112
        
        C:\Users\Public\Downloads\dwm.exe
        
        "C:\Users\Public\Downloads\dwm.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Downloads\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\LocalLow\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\AppData\LocalLow\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\LocalLow\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\fr-FR\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2322c4463febccf8bf1c1fc5ca3e60de

SHA1
5cdf3739d3a281d727c5ea4628d98ced80955434

SHA256
712cce92b6d9e0718a1ef4993cd6356980cf54ae68460afe9f7d72feb8b6033b

SHA512
78aa09f834d76dfa95d07dc4aa747be4a28f6e65efcbc20a4adb87e3bc80be38a9602984485f38a775bc20ebbfcb94ab14b3fa49ff9a33af001f33025e3556bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
117a4fec2c6e5754f429a41582dc8356

SHA1
d003244ed7333daabd67ba19cfcc029fbec5c7dc

SHA256
47495c751bc398194c8f48eb965e4ba366c8ad18ac1ca6bcaf6fcebaa68aefb0

SHA512
53756682ce14b99b94dcd511556efb4c80cd6e3a185432e86b1c56d1cef81fcfbad16f835892bf2f39a28514e9dfddb3e42c8265fe3f527ff3277ae8d0c68801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ef153d4f7fbe0d63aa4f2b89c6f081d

SHA1
66cae5fff2d4e738bc22fdcb94bfb14a59efc424

SHA256
1c2d6e385c1d600127e18ec664fd5730c011ff14a19dd9a27a26e926e43f8efd

SHA512
2f32ee35f944deeaf86f80482d7313784e17e96c323ef3460bcdeec2f5cf56eea9802cc7e545f505eedbf68d7f5be375edba493b20ae6205de6d875fe3e40827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31caf90a50deadef03f893a6e0f5144b

SHA1
4ef0906c6113268dba691a6ccf4480d9c48ae728

SHA256
9f36e83cbbc726ee6b5e1de477f071ff5a2b8275fab0550e14ceb9d366dcc3f8

SHA512
5f0791fe466f72c99d8ef965ce00212279f9bdfb8a2e8e0ca2afc728b82fc33a1bf87c7d1b0c6dde21be641a3e1e6090975f3043d342f7136b241a2ab9b6e4fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06e24530f0fc9e98eb6f4d3ed2edbb12

SHA1
bbfb346f284e8febce133cd947ef48ebd5e1f090

SHA256
be2ebe02c57c849d8d690ade1c6f47caa4cf930a47fa598be4159f2ede602a86

SHA512
d486c37f821310bd3ba325adbc4d483b18dd731d7d1b11a062a49e5e23936063a02754e3ccf81cd3cf9fe1c9618141d8b22b803774358f4e3a95b0a2402761e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
735666462af5128502abcd207d6f914f

SHA1
c96b38c94dc6884dc94abf7ba4ad2c6a25f516dc

SHA256
8d0ab9339ea057e0d47bf3094b3ed16be5908d80b56fb1b6765cf1e4c4eaa67e

SHA512
725ed1d549b7f3a893f2530e8e3f83c4c25e61d2755cb3ba334c93a3ff8ad3c3178c93821905f8be0c3e23cfef7a060f193caf00607d3f3b3b9da7a4885d0cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea162a1111c8b684a5997dc7cd5bd9d7

SHA1
99d289d459f9d09290f1e5ab41d4423c41ed3d56

SHA256
274f5c28180a334402e2f17fb7d453e4147029eed9ebae12d60c804c4821bcc2

SHA512
d737fb084df6ef75b5e25912e27e74822581243f5f197fe0fb9cb6131a6be64496c9ca499c0d2ed5fa832e724b92cd14f0304e7a60a87e704eeaab3fbf2d4f75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b015665db5bfdfbdaef223ff43e5099

SHA1
e3d7fed3d53abdc6f3e1661485f018274a8f9211

SHA256
c7649d2331c21a2832c325a6590737a9a9609da978320910ffc1c69f49bee0c8

SHA512
7a3ccae34723c33312b3ad18c6626c23ee801ffc94062374c9c3f8ec852e62647622a7cadbe11493a4777e0fd7c5412edb6fc5ce1ac0fc358b49dc1ed5a1e253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1df416859e0d0d615b735ed26a4bb2d7

SHA1
a65bc2a53e2a83ef3b7d8ca4c8e972c7b5d4678d

SHA256
49633b12d8116bd85bfea733de367598d0f1ace1c03c5c5f1b32da75c5de3b3e

SHA512
6c57039b9ec18e234b72ecbd8331255f59ca6d3a93d9b1081aec86d5f2c11d7a8fd8b6a072ca0b4e1df232e8caaed79adbf2f1135818f3835fa5457fbce8c90f

Download Submit
C:\Users\Admin\AppData\Local\Temp\01W0MkcRY2.bat

Filesize
198B

MD5
b253ae2b68dd90a730870b4e2d92d708

SHA1
df9cc256226e236ae498425fabb28508ad95f346

SHA256
f73104f441db7dbf0de11b3b5620109884f442fc2d629ac44840abccd44b1d1c

SHA512
11c7a27353fd487ab0d612ee9c77927864afa6ab62d164434b6b3777810da7f21c4667e6f1fd8cba97376b8c369565d6533f31a70a70f9ca0b7927c04c12ae9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA037.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FgAoPiAcVL.bat

Filesize
198B

MD5
43cc7c8ebe5f8430b90d71e6e31f9cae

SHA1
d7e9b437d98681ce0974b016dbab8a02abec8d47

SHA256
31b85a89447d36548e7fde31c50c21ed7dce15685004d4303aeff69deefd7cf5

SHA512
cbe64ae3050f188ca1cef40539b2b21106e0555aa6c6ad3f1a7db027348d69eec36eae411b85a0bf94f5b7511eefb71b81a958467b622ebce375fb174ddb9614

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA04A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\V3SaMhi525.bat

Filesize
198B

MD5
9668ee22b616df68b399156098149f1b

SHA1
676a713e81d47a6b4bbf953f94bea086e087d9ee

SHA256
c94f00abfd7718d25bd6bc029828b26e943d80b26649aa1e05f7c7dc8e17e131

SHA512
894ce0f99c10fd306847ba967e7d990f36c5b58497024b9d9393ce20991a0998b3cf39a6d396785f823e31f0c5fffac8be8d4a054ab7d13279a672b62e3cdaae

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbMo3XBCxD.bat

Filesize
198B

MD5
8e46456d66ac3a8880a8dba21773b1a2

SHA1
788bcfdce5788aea8d629743d0d8052646f92d7a

SHA256
d3caf1a79da1d33e53f005078ea6e6dbdd14cafe6f95c3dabe1e9b5ffcfd14ac

SHA512
f341b398e4ca1576ed952f8dbc2f5bef5746873000d798ddcfb81b769c1cc211b9ad779d50da657d57fb9e1ee29863065615885e724861b3aea764c084c21d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat

Filesize
198B

MD5
f8c2a0050cce788ff14cc3de84994175

SHA1
6bf34c8a2809f4a1abc4a833273e45a93d3fe6d8

SHA256
b1442f7f0a37146ee3f1c16d549d3f011e0814fd42f9624d6640e5de5ad65469

SHA512
c81abb7b9a40e6a0223e7c49b9f9bfe49ee5562fd2c74e742d89bf9358c309d3efc43388c59eecc73018fb2cab9284b39a04c7d095b90258cf367a509d96145b

Download Submit
C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat

Filesize
198B

MD5
6a4cfc58c69c96eed8d1f87f5c79e1b1

SHA1
6f3701b55cfc4de104f1b9e1da9cea0da2929b3c

SHA256
9fad3958d8912e7584452ffcac5c8b7b3f32e551932a2b0beb9b5996a5a687d4

SHA512
b8f0ab8ac3007778d0122b1d6bb1096f07189827b2a0ba774429965bc6bf3532f8c5c6c62a7761181924fc877e01474905f4d4805ef796a157a7b129ecfe157f

Download Submit
C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat

Filesize
198B

MD5
6569dbc07dc69118cb3d5ea2212a8ebd

SHA1
02e505320d30693feac15c670ca6b36937167412

SHA256
4fa7c8d8e4991fc671c9c6ab78761e063640b6cbeb37bd99a8556482c471239e

SHA512
551c63272a0025b84db87f06a788e96aabb618527edb5fe83f489e850715cd9b5d7c2be31fa25b5c585a35da517ffe02591c25ae3958684ac6ac832cab8e1275

Download Submit
C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat

Filesize
198B

MD5
8b14061f995a750f8645dfcf00ca8602

SHA1
e2c1c9d74681dae6f2c8120baeeaaa49374b78be

SHA256
43259f10f04e30f0924d69da611017913349841ba4fb812152067cc38ad412d2

SHA512
622d716d0d0ec2aa31f343ba1401ab1e18228af8c4a137bfeaa16d94d442da0363df2f2ac75b00270857c14ab90d22769651ff72abc8c47d393d21a195879668

Download Submit
C:\Users\Admin\AppData\Local\Temp\qKN9Q7Smhq.bat

Filesize
198B

MD5
2780cf8162319ddf607a9a61ec155463

SHA1
399a30571f8f8ca228678a038e70f09d47f1c3f6

SHA256
a3865e203888e776846230f7f747d62622a5bb8e3504bdf5f8951ab99dc28b68

SHA512
f2dc63b497dcedb8d1bbf4fba0f9824950de4e61e7c873680fcfff69a95121fd4b09256ba79b84c7de0fbd0c123f476550e30261f4105995077089715b36c34b

Download Submit
C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat

Filesize
198B

MD5
2ce5345b754f97cc43272660e4925d12

SHA1
b922facbb1492115d5ef88cc4a28a49aae09f94b

SHA256
edcec02461d8ddaa5ea6820d3801b2c5e2c956ee3113825b19c0c7c1775431e5

SHA512
908fc3cb0271eb7a3b32a3e9a0afb17bf3c2cfe4d3ed7ca3cc864922b8c809c3ba3954ff8fbf8765f45a7bf96814ed41dd8ee0e475f299d26b02a63551a04f97

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
922f4f71b2a32f3fc44c553f1e796afe

SHA1
7142c49dac832288fc9a9b4cf1384eec5ce949e9

SHA256
9176fc96016ca81db76c659fe10f401d092706f0acab3f606ab1f3b34739822a

SHA512
52aad89857f19cad3016712883510433c4604a7bc4d57a38f02dd3d969ebfa4ab940ac9c299367b1ab47ef1f11bf8894e3d79c7986273d03baaa0ecdc95746fc

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/408-153-0x00000000008B0000-0x00000000009C0000-memory.dmp

Filesize
1.1MB

Download
memory/1772-85-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/1992-332-0x00000000002D0000-0x00000000003E0000-memory.dmp

Filesize
1.1MB

Download
memory/2108-69-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2488-94-0x00000000003F0000-0x0000000000500000-memory.dmp

Filesize
1.1MB

Download
memory/2708-213-0x0000000001080000-0x0000000001190000-memory.dmp

Filesize
1.1MB

Download
memory/2712-17-0x0000000000200000-0x000000000020C000-memory.dmp

Filesize
48KB

Download
memory/2712-16-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/2712-15-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/2712-14-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2712-13-0x0000000000210000-0x0000000000320000-memory.dmp

Filesize
1.1MB

Download
memory/2948-393-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2948-392-0x0000000001220000-0x0000000001330000-memory.dmp

Filesize
1.1MB

Download