dcrat | 2aac6ed08c14a18a1f00b9cd1db4978751e6e2dd00b6fa73ff384d3be9e0be47

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2aac6ed08c14a18a1f00b9cd1db4978751e6e2dd00b6fa73ff384d3be9e0be47.exe
Size

1.3MB
MD5

c31323d156f8e2a73df3490f8f26f453
SHA1

67edea08e25ecd55f71d1551110dec0e2e65b05b
SHA256

2aac6ed08c14a18a1f00b9cd1db4978751e6e2dd00b6fa73ff384d3be9e0be47
SHA512

392f1f137e98ec76d51af3a1b63b3095f03a6f5adfe15ace385afc07c62ca06c4fff56097c86b0cb9b1733752dd7106d1369402a2e6af4f2e83b46f8ba7fdd12
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2596	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2596	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000700000001932d-11.dat	dcrat
behavioral1/memory/2724-13-0x0000000000A30000-0x0000000000B40000-memory.dmp	dcrat
behavioral1/memory/1756-49-0x0000000001260000-0x0000000001370000-memory.dmp	dcrat
behavioral1/memory/2636-318-0x0000000000200000-0x0000000000310000-memory.dmp	dcrat
behavioral1/memory/2136-379-0x0000000000E60000-0x0000000000F70000-memory.dmp	dcrat
behavioral1/memory/2200-499-0x00000000002F0000-0x0000000000400000-memory.dmp	dcrat
behavioral1/memory/900-559-0x0000000000110000-0x0000000000220000-memory.dmp	dcrat
behavioral1/memory/2160-619-0x0000000000AD0000-0x0000000000BE0000-memory.dmp	dcrat
behavioral1/memory/1588-679-0x00000000001E0000-0x00000000002F0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1688	powershell.exe
2336	powershell.exe
1524	powershell.exe
2204	powershell.exe
324	powershell.exe
2340	powershell.exe
772	powershell.exe
536	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2724	DllCommonsvc.exe
1756	conhost.exe
2136	conhost.exe
2344	conhost.exe
2024	conhost.exe
2636	conhost.exe
2136	conhost.exe
2248	conhost.exe
2200	conhost.exe
900	conhost.exe
2160	conhost.exe
1588	conhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2896	cmd.exe
2896	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
15	raw.githubusercontent.com
18	raw.githubusercontent.com
35	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
22	raw.githubusercontent.com
25	raw.githubusercontent.com
28	raw.githubusercontent.com
31	raw.githubusercontent.com
38	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ehome\de-DE\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\ehome\de-DE\5940a34987c991	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2aac6ed08c14a18a1f00b9cd1db4978751e6e2dd00b6fa73ff384d3be9e0be47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
900	schtasks.exe
2564	schtasks.exe
2884	schtasks.exe
2640	schtasks.exe
2248	schtasks.exe
2676	schtasks.exe
1876	schtasks.exe
2632	schtasks.exe
1032	schtasks.exe
2480	schtasks.exe
2620	schtasks.exe
2364	schtasks.exe
1980	schtasks.exe
1052	schtasks.exe
2948	schtasks.exe
948	schtasks.exe
1636	schtasks.exe
2512	schtasks.exe
292	schtasks.exe
1976	schtasks.exe
1884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2724	DllCommonsvc.exe
2724	DllCommonsvc.exe
2724	DllCommonsvc.exe
1688	powershell.exe
1524	powershell.exe
772	powershell.exe
2336	powershell.exe
536	powershell.exe
1756	conhost.exe
2204	powershell.exe
324	powershell.exe
2340	powershell.exe
2136	conhost.exe
2344	conhost.exe
2024	conhost.exe
2636	conhost.exe
2136	conhost.exe
2248	conhost.exe
2200	conhost.exe
900	conhost.exe
2160	conhost.exe
1588	conhost.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	DllCommonsvc.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	1756	conhost.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	324	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2136	conhost.exe
Token: SeDebugPrivilege	2344	conhost.exe
Token: SeDebugPrivilege	2024	conhost.exe
Token: SeDebugPrivilege	2636	conhost.exe
Token: SeDebugPrivilege	2136	conhost.exe
Token: SeDebugPrivilege	2248	conhost.exe
Token: SeDebugPrivilege	2200	conhost.exe
Token: SeDebugPrivilege	900	conhost.exe
Token: SeDebugPrivilege	2160	conhost.exe
Token: SeDebugPrivilege	1588	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2772	2120	JaffaCakes118_2aac6ed08c14a18a1f00b9cd1db4978751e6e2dd00b6fa73ff384d3be9e0be47.exe	30
PID 2120 wrote to memory of 2772	2120	JaffaCakes118_2aac6ed08c14a18a1f00b9cd1db4978751e6e2dd00b6fa73ff384d3be9e0be47.exe	30
PID 2120 wrote to memory of 2772	2120	JaffaCakes118_2aac6ed08c14a18a1f00b9cd1db4978751e6e2dd00b6fa73ff384d3be9e0be47.exe	30
PID 2120 wrote to memory of 2772	2120	JaffaCakes118_2aac6ed08c14a18a1f00b9cd1db4978751e6e2dd00b6fa73ff384d3be9e0be47.exe	30
PID 2772 wrote to memory of 2896	2772	WScript.exe	31
PID 2772 wrote to memory of 2896	2772	WScript.exe	31
PID 2772 wrote to memory of 2896	2772	WScript.exe	31
PID 2772 wrote to memory of 2896	2772	WScript.exe	31
PID 2896 wrote to memory of 2724	2896	cmd.exe	33
PID 2896 wrote to memory of 2724	2896	cmd.exe	33
PID 2896 wrote to memory of 2724	2896	cmd.exe	33
PID 2896 wrote to memory of 2724	2896	cmd.exe	33
PID 2724 wrote to memory of 536	2724	DllCommonsvc.exe	56
PID 2724 wrote to memory of 536	2724	DllCommonsvc.exe	56
PID 2724 wrote to memory of 536	2724	DllCommonsvc.exe	56
PID 2724 wrote to memory of 1688	2724	DllCommonsvc.exe	57
PID 2724 wrote to memory of 1688	2724	DllCommonsvc.exe	57
PID 2724 wrote to memory of 1688	2724	DllCommonsvc.exe	57
PID 2724 wrote to memory of 772	2724	DllCommonsvc.exe	58
PID 2724 wrote to memory of 772	2724	DllCommonsvc.exe	58
PID 2724 wrote to memory of 772	2724	DllCommonsvc.exe	58
PID 2724 wrote to memory of 2340	2724	DllCommonsvc.exe	59
PID 2724 wrote to memory of 2340	2724	DllCommonsvc.exe	59
PID 2724 wrote to memory of 2340	2724	DllCommonsvc.exe	59
PID 2724 wrote to memory of 324	2724	DllCommonsvc.exe	60
PID 2724 wrote to memory of 324	2724	DllCommonsvc.exe	60
PID 2724 wrote to memory of 324	2724	DllCommonsvc.exe	60
PID 2724 wrote to memory of 1524	2724	DllCommonsvc.exe	61
PID 2724 wrote to memory of 1524	2724	DllCommonsvc.exe	61
PID 2724 wrote to memory of 1524	2724	DllCommonsvc.exe	61
PID 2724 wrote to memory of 2336	2724	DllCommonsvc.exe	62
PID 2724 wrote to memory of 2336	2724	DllCommonsvc.exe	62
PID 2724 wrote to memory of 2336	2724	DllCommonsvc.exe	62
PID 2724 wrote to memory of 2204	2724	DllCommonsvc.exe	63
PID 2724 wrote to memory of 2204	2724	DllCommonsvc.exe	63
PID 2724 wrote to memory of 2204	2724	DllCommonsvc.exe	63
PID 2724 wrote to memory of 1756	2724	DllCommonsvc.exe	72
PID 2724 wrote to memory of 1756	2724	DllCommonsvc.exe	72
PID 2724 wrote to memory of 1756	2724	DllCommonsvc.exe	72
PID 1756 wrote to memory of 2680	1756	conhost.exe	73
PID 1756 wrote to memory of 2680	1756	conhost.exe	73
PID 1756 wrote to memory of 2680	1756	conhost.exe	73
PID 2680 wrote to memory of 900	2680	cmd.exe	75
PID 2680 wrote to memory of 900	2680	cmd.exe	75
PID 2680 wrote to memory of 900	2680	cmd.exe	75
PID 2680 wrote to memory of 2136	2680	cmd.exe	76
PID 2680 wrote to memory of 2136	2680	cmd.exe	76
PID 2680 wrote to memory of 2136	2680	cmd.exe	76
PID 2136 wrote to memory of 2972	2136	conhost.exe	77
PID 2136 wrote to memory of 2972	2136	conhost.exe	77
PID 2136 wrote to memory of 2972	2136	conhost.exe	77
PID 2972 wrote to memory of 2444	2972	cmd.exe	79
PID 2972 wrote to memory of 2444	2972	cmd.exe	79
PID 2972 wrote to memory of 2444	2972	cmd.exe	79
PID 2972 wrote to memory of 2344	2972	cmd.exe	80
PID 2972 wrote to memory of 2344	2972	cmd.exe	80
PID 2972 wrote to memory of 2344	2972	cmd.exe	80
PID 2344 wrote to memory of 1612	2344	conhost.exe	81
PID 2344 wrote to memory of 1612	2344	conhost.exe	81
PID 2344 wrote to memory of 1612	2344	conhost.exe	81
PID 1612 wrote to memory of 2228	1612	cmd.exe	83
PID 1612 wrote to memory of 2228	1612	cmd.exe	83
PID 1612 wrote to memory of 2228	1612	cmd.exe	83
PID 1612 wrote to memory of 2024	1612	cmd.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2aac6ed08c14a18a1f00b9cd1db4978751e6e2dd00b6fa73ff384d3be9e0be47.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2aac6ed08c14a18a1f00b9cd1db4978751e6e2dd00b6fa73ff384d3be9e0be47.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ehome\de-DE\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
    - - C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1756
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CPhDZIwY3l.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:900
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Lxx1rvPQX.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2444
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2228
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UxOjVeUiuv.bat"
        12⤵
        
        PID:3024
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:796
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gN51JOWfNX.bat"
        14⤵
        
        PID:2464
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1900
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat"
        16⤵
        
        PID:2792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2940
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat"
        18⤵
        
        PID:2812
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1460
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IxigaWiN4Z.bat"
        20⤵
        
        PID:2616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1052
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat"
        22⤵
        
        PID:892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2176
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TZCyxGcg3L.bat"
        24⤵
        
        PID:2440
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2756
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"
        26⤵
        
        PID:1016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\ehome\de-DE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ehome\de-DE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\ehome\de-DE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e3cb476535f2b2e2fc2fb211067b2c1

SHA1
404ec9d9a0f738eb4f288b132046b8d022f66df8

SHA256
f04261797e8552e16c469ae6bc97e3d336d061bcc3c1d8030d7769e9e4c5151d

SHA512
af0f64c081a7f32ef5a2199d480a32b5578e7e24a7316b76670e395723bd1faf8ca6939f1d55da57da658d575233b80090114f6d6639b04eb0cc3582404cff84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0b64e12e25591b165700ba8feafd508

SHA1
357494bb7e8c5284c5d52149bd6657e56635f477

SHA256
907157f29789db3a2c68fa97bc56f402ba4ec0a7432db21550ea39b1e1b6b158

SHA512
e3161977ac90c4e33b94adae5b6740c249c57e32f5045032df7f15b5f1c704afd98a670a2206672b146048e8aaaa306e728c3f3358f4de507981da0703b656a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d81bc1308d3caac41c1a0c6ea4d40b8a

SHA1
da1efd0ccc8e7823e774cc3dc320d924ed1c3353

SHA256
bbaf5ae6bbe16f581c8b085bb18e3ddbea30b20d8eceaa98f1d067997192c96e

SHA512
11218ca32abde8d74bfc58780dd00f472ca5ec8f907f8c83a9151cdb57e9efedce8d8279a9921af5148f5f2377a816e06c96baed1a2783787b9e3c316c3edd77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04f6cacfb4c89a8f6bde8caf4915a5b3

SHA1
5f82d7cbe17ca3435e77f769fde197e674e28671

SHA256
a6c10f6d4d36cea16ed97da151a58d43b1fbc0ecbaf76ec1537ec4a0e1191f99

SHA512
a8f2dda65120ea3139d3b0445d2716561fe4c4bb5c34a3a8547f0323095eae10213a63604273be5847f343884173037337104c53ed03116272f4d9a042b17639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2f8ec57a47e0a204f7b3ba89ff41587

SHA1
c6e2fb52d5d6b0bd4b4790d44ae65e2659e1d1b7

SHA256
400d89d66f03a1abbb286545ff6045629bf714a3ebd724fa486721e61c9c3c47

SHA512
46b2ba6464bc2e9f7e40abc369c0f638db6af799da90a9afb900014a303b71bfea84ef76215d989099f7c430e13ef7ab08b913200a93d429a6e323d0a41add4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
450ee641c74662628342edf46387b024

SHA1
9dcd08ddd70af2db8c7950c74538e2a1fa72c554

SHA256
92b10242095bde4458ecae4c808fec6d95cad1bb9e8517086a49569c7dc9b679

SHA512
7780a6c20dfeafc14315b28bd7dc845911cb3cd847e9bbc52f3ff48aad9de20a457172f8abbd49829fff868eb33347ce3304b94bcc265886048979435b8349b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b4130ea1c5953035a24cc63ebea498f

SHA1
1bd484e2a961162206e0f19513ae995b0c737016

SHA256
68736c9ab77eaf1e939c7562e8909033cd5a1e9f46d7306923a313ff77dd05ec

SHA512
ad54c4903bb14746c039f8f18ae4fbcc22d5b9d98867c5d216eb82a6a30eedafaad155119efbd898345fb1a6aea553c4b14cbd6f4b5cea14c42a8c7061ec27d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc6b8a5ce4dbf6e12f1d2026392f3178

SHA1
e4c2b58a0a2fe59b06e22a697659a63b1a63fa7e

SHA256
5076f2ad3fd273689ed14454c5e5de8d3f13b2a3e793ff3b0f969fad89f10b40

SHA512
ca4c1986bdebd53a64c57dacda8c9026ef8446395e88fdb9d6d3c04b88d3cf9e2ea58bffc86471152da59dc8ff75de5065e52ebb9da46bb0ad22d1171a366447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26cbe21462640a8266b880ded17cee60

SHA1
53c43c364645e7767f6dee9e7cd48b79990d9ccf

SHA256
423c683ec91261125e07c66e1b44f8cc7aa61264c716f35f8b66e0327fbaf692

SHA512
d51b5932aa3aa722cdefd04c6b030206255ea86e99764e24f0ec1c7e06b943bb8802386d697c9545b2a71676c4d2420fad6ca009641ecf22fd282d58dd6c6d88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
399058aee2582d509a32e55279bd9355

SHA1
3be8cb93b5c087ff99373c5a65b9a05a3a726bb3

SHA256
902d46157f2703d875e9d01721bba7a5f0361baf41a3f0cd44fa7c56a3752348

SHA512
1f04494cfaf00f9b33b2898befe044a9cf5464b6338993831d18203e8815cf655305d5b88c19032b56b1cd018a9f7c39d452f40a29ef12d4438bc5c91fe0101d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Lxx1rvPQX.bat

Filesize
247B

MD5
e46d08e3de0c2c68d158d32d8831fe91

SHA1
7aa8922764d88b249aab736bcad77f73951afeed

SHA256
2a9b2ec25ad844a04f042170d03a2c6ce47d9391fe6b07efe55bae7f6192ec92

SHA512
da25793ced2d05a60425688b1fb09d5d839cde2345431455c8bec0869d21132690d54e66a798893fccc2f667582c36ace8580cf1ccd13b6b8cfc5d308874c1d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3gUlVaPHfz.bat

Filesize
247B

MD5
c41c819dfea0401781864b209eaa11f8

SHA1
3940c353ab6cf86aa35b0f839e6ab525cd32d570

SHA256
64d41f0a1717b909b10b1f1bf6b6ff8af08b99c0a426804711755704d829c524

SHA512
114027760eaafb36699fdf86ada6cfeb1a7c1163452d2db0ed7a8639245aaa70cb0a6978556cb6d458d64f3d9c62c9e0a092347d76fb8491b9ae22c710d86e1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CPhDZIwY3l.bat

Filesize
247B

MD5
f2dac0ffa61032b3516d70f55f7c5417

SHA1
2286b626b1925e64fd9c4cdf7a87134c5a4d123d

SHA256
64847a94f155cb975e46e9f7b2d2193e659aeae275d52b059dd4aae53204fc5b

SHA512
254274c8a2a9e61e08d6f0e4b29b861a436cc2990cc5408042949c1e7c59cb8ed74c52323044cacaead7636275c4359fee7a79b734d183658be07f320a924cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5524.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat

Filesize
247B

MD5
f64de65e59c43de1ea1aab18bf72dba0

SHA1
742c34fef1655cca41ea6edde2a1673e717c283e

SHA256
6a13c2f2ce08ca6ececc703da755428fe5112bb1726883663aa3c226d72ee2f7

SHA512
c2e75cbfd2d1ff8e6d8d748e427540e9e609056d2d40fde0f73b6f06e159718bcdd2e8a9c6547056f172ef9197f7c285296b6d1c3895b815162490da6907a110

Download Submit
C:\Users\Admin\AppData\Local\Temp\IxigaWiN4Z.bat

Filesize
247B

MD5
e4533d411c475d2e7b89a27f84359fb8

SHA1
93f9bd4f4c8dfc884c1763b565a57eab7e9baae5

SHA256
86c8dc155a1996610b9ebb9198b678dbfc2b36470ce4f316bca0f255fe6d72d7

SHA512
ffd47fabcf3269298cf57219ec094ae790f2a663361fff955f7d10e56a92644536ab8046a866273abcb6551ab5e3fc0ac401e367a8aef86dcc5d55f51a6152c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat

Filesize
247B

MD5
d4119be6e731a08ffe3dafb091655edf

SHA1
230bafd7f0aed86d35c73e4875db27a7ef59050a

SHA256
252db401ced8802a3cc73428d655aac13466c253790982b7ac53ae95f497e2f9

SHA512
a202773308f2cfc319694bf69c23b85941ce819e3d8088325654b6c250b37e4364f56103334c5461876eb9f46339636b35e2c9c3948a54a5edd018eb7e995a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TZCyxGcg3L.bat

Filesize
247B

MD5
39661b49b3b612fe3a24d03d53216806

SHA1
de19e7318be79ecfa2765e8ea5736b538dfda268

SHA256
eed3005cc6ab4b9d043e128689eb65f2f9d7f1a4ee587fae09b4a1d6ce9758be

SHA512
4f868c4e86b45875b8da5b2eedbd4e880837090e91eb39fa48e6a32ac736d53911be8e547bc13cec1e19d6022e82e41725f44af43fccd37c5e5b4bb9b749c34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5527.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UxOjVeUiuv.bat

Filesize
247B

MD5
7537e3beae76a9ce72163cb646377c60

SHA1
600d1a5a16dd6301849a1ce5741546a03e59934a

SHA256
3c92efe7264536b2e3496865c2e5807788ac562a3f79ac49a3c114fe7b9a6db9

SHA512
0c82901b9b8e6070f55f2314069a3ce4733a4790d0215b11b8792aadaf5aadf6f9e50209d8eff378cacd5145bf618359fd29f074f58912865ffc1542d39719c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat

Filesize
247B

MD5
227df03537cc3aea649b89f9da71b377

SHA1
928ba69f5d5fedfe7ec12b67035e24beed9b5d02

SHA256
92b875d218413028dcc14f2ada8e93329715067d03c7cfc30321da6552646bfa

SHA512
e1a665f4096d1a3210a33789a6ceaa73a4cb4b30fd7d34d05b01e4853d5b2a00b938aec9f12e6d61fcea396bead72ff2013dde0d707d1731633b1767b56776af

Download Submit
C:\Users\Admin\AppData\Local\Temp\gN51JOWfNX.bat

Filesize
247B

MD5
8e8b1937730d570356d0b94a4a661561

SHA1
c2a481ef89f8e5c5c4d23def747a4022e739d35b

SHA256
108ef097cf6e29572dbf17c57443fbec6608368c53bf43c54f892ea680767da3

SHA512
c29b4a9f3c0f50419c51f34ec0b25ed0404cf3c23fc054e1d10cd358d7de58dbe7d0dbea4949948c3eb28926412731784b5c9cf4e90a4d46919b7a86ff13048b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat

Filesize
247B

MD5
8aac2ad07923607cb2a55a4a97530811

SHA1
f5269eeb7d45887db4df7fdcfcd525d6cdadd057

SHA256
c910a023a9e6857a40aeb1d21d1a80c32dcaafc1e61b0348fe263d52a11e5003

SHA512
d725eabf4b0efeb3e4b140e143bbe32bf769d8927251ed2690938295340f1696f4829a60c140d4190cd949fca601f80a3a62eac7dab20b6c5d60033f59f70c56

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b0390ddbf7da0202257ed069230d24e0

SHA1
9feaf62262682247baf6812680970deeabc049ba

SHA256
0b02359679369f564b7124d88e6c998f691a1306fcb644acf46730c5d38df0e2

SHA512
802b09ce220578ac608ae88392a8e378b8b1cc650f48ca275a0fcf10c9a872e14c78d2902d3d1992a1c116dd3b40cef9fd2aea9484f605b0f31c1f512f762543

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/900-559-0x0000000000110000-0x0000000000220000-memory.dmp

Filesize
1.1MB

Download
memory/1588-680-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/1588-679-0x00000000001E0000-0x00000000002F0000-memory.dmp

Filesize
1.1MB

Download
memory/1688-50-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download
memory/1688-48-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/1756-49-0x0000000001260000-0x0000000001370000-memory.dmp

Filesize
1.1MB

Download
memory/1756-55-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2136-139-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2136-379-0x0000000000E60000-0x0000000000F70000-memory.dmp

Filesize
1.1MB

Download
memory/2160-619-0x0000000000AD0000-0x0000000000BE0000-memory.dmp

Filesize
1.1MB

Download
memory/2200-499-0x00000000002F0000-0x0000000000400000-memory.dmp

Filesize
1.1MB

Download
memory/2248-439-0x0000000000330000-0x0000000000342000-memory.dmp

Filesize
72KB

Download
memory/2344-199-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2636-319-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2636-318-0x0000000000200000-0x0000000000310000-memory.dmp

Filesize
1.1MB

Download
memory/2724-13-0x0000000000A30000-0x0000000000B40000-memory.dmp

Filesize
1.1MB

Download
memory/2724-17-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/2724-14-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2724-16-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2724-15-0x0000000000460000-0x000000000046C000-memory.dmp

Filesize
48KB

Download