dcrat | ed24288c41dc8344dce970d09bcd4035ad4c1653d9c7c1598d42c60ba74f972f

Analysis

max time kernel
146s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ed24288c41dc8344dce970d09bcd4035ad4c1653d9c7c1598d42c60ba74f972f.exe
Size

1.3MB
MD5

484b5da52cf76a1f5261688d68e30082
SHA1

78af403f6cc28e02b1c452f5e745fbb0211cbdcf
SHA256

ed24288c41dc8344dce970d09bcd4035ad4c1653d9c7c1598d42c60ba74f972f
SHA512

2f950dddd27bd765c3f17cf8701e641392cf02a05e64750c9a39de433544ad72595f6a05fea5af9fe513f9fbacc3e5e948cf53d734744b1a117acbf3289c5698
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	728	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	2816	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2816	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016d49-10.dat	dcrat
behavioral1/memory/1752-13-0x0000000000CE0000-0x0000000000DF0000-memory.dmp	dcrat
behavioral1/memory/2088-122-0x00000000012E0000-0x00000000013F0000-memory.dmp	dcrat
behavioral1/memory/2844-181-0x0000000001340000-0x0000000001450000-memory.dmp	dcrat
behavioral1/memory/1008-361-0x00000000003E0000-0x00000000004F0000-memory.dmp	dcrat
behavioral1/memory/1276-421-0x0000000000C20000-0x0000000000D30000-memory.dmp	dcrat
behavioral1/memory/2304-481-0x00000000000F0000-0x0000000000200000-memory.dmp	dcrat
behavioral1/memory/1696-541-0x0000000001160000-0x0000000001270000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2968	powershell.exe
656	powershell.exe
1736	powershell.exe
2436	powershell.exe
2696	powershell.exe
1812	powershell.exe
920	powershell.exe
2292	powershell.exe
2124	powershell.exe
2204	powershell.exe
1676	powershell.exe
2260	powershell.exe
488	powershell.exe
2064	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
1752	DllCommonsvc.exe
2088	taskhost.exe
2844	taskhost.exe
2044	taskhost.exe
2000	taskhost.exe
1008	taskhost.exe
1276	taskhost.exe
2304	taskhost.exe
1696	taskhost.exe
2560	taskhost.exe
1604	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2516	cmd.exe
2516	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
31	raw.githubusercontent.com
9	raw.githubusercontent.com
20	raw.githubusercontent.com
24	raw.githubusercontent.com
27	raw.githubusercontent.com
34	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
13	raw.githubusercontent.com
16	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Program Files\Common Files\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\de-DE\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\de-DE\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\OSPPSVC.exe	DllCommonsvc.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Globalization\MCT\MCT-GB\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\24dbde2999530e	DllCommonsvc.exe
File created	C:\Windows\Help\OEM\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Help\OEM\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\assembly\tmp\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\Media\services.exe	DllCommonsvc.exe
File created	C:\Windows\Media\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\Globalization\MCT\MCT-GB\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Windows\assembly\tmp\csrss.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ed24288c41dc8344dce970d09bcd4035ad4c1653d9c7c1598d42c60ba74f972f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1656	schtasks.exe
1368	schtasks.exe
1988	schtasks.exe
2648	schtasks.exe
2384	schtasks.exe
1264	schtasks.exe
2884	schtasks.exe
2152	schtasks.exe
2736	schtasks.exe
1152	schtasks.exe
2004	schtasks.exe
1800	schtasks.exe
1932	schtasks.exe
2144	schtasks.exe
2856	schtasks.exe
1624	schtasks.exe
2616	schtasks.exe
2564	schtasks.exe
640	schtasks.exe
2180	schtasks.exe
2404	schtasks.exe
2040	schtasks.exe
764	schtasks.exe
2700	schtasks.exe
3028	schtasks.exe
1160	schtasks.exe
2996	schtasks.exe
264	schtasks.exe
1136	schtasks.exe
2664	schtasks.exe
2852	schtasks.exe
1892	schtasks.exe
2496	schtasks.exe
2908	schtasks.exe
2624	schtasks.exe
2176	schtasks.exe
1596	schtasks.exe
2568	schtasks.exe
728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1752	DllCommonsvc.exe
920	powershell.exe
2696	powershell.exe
2436	powershell.exe
1736	powershell.exe
2968	powershell.exe
1812	powershell.exe
1676	powershell.exe
2204	powershell.exe
2124	powershell.exe
2260	powershell.exe
488	powershell.exe
656	powershell.exe
2292	powershell.exe
2064	powershell.exe
2088	taskhost.exe
2844	taskhost.exe
2044	taskhost.exe
2000	taskhost.exe
1008	taskhost.exe
1276	taskhost.exe
2304	taskhost.exe
1696	taskhost.exe
2560	taskhost.exe
1604	taskhost.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	DllCommonsvc.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	488	powershell.exe
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	2088	taskhost.exe
Token: SeDebugPrivilege	2844	taskhost.exe
Token: SeDebugPrivilege	2044	taskhost.exe
Token: SeDebugPrivilege	2000	taskhost.exe
Token: SeDebugPrivilege	1008	taskhost.exe
Token: SeDebugPrivilege	1276	taskhost.exe
Token: SeDebugPrivilege	2304	taskhost.exe
Token: SeDebugPrivilege	1696	taskhost.exe
Token: SeDebugPrivilege	2560	taskhost.exe
Token: SeDebugPrivilege	1604	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2072	2484	JaffaCakes118_ed24288c41dc8344dce970d09bcd4035ad4c1653d9c7c1598d42c60ba74f972f.exe	30
PID 2484 wrote to memory of 2072	2484	JaffaCakes118_ed24288c41dc8344dce970d09bcd4035ad4c1653d9c7c1598d42c60ba74f972f.exe	30
PID 2484 wrote to memory of 2072	2484	JaffaCakes118_ed24288c41dc8344dce970d09bcd4035ad4c1653d9c7c1598d42c60ba74f972f.exe	30
PID 2484 wrote to memory of 2072	2484	JaffaCakes118_ed24288c41dc8344dce970d09bcd4035ad4c1653d9c7c1598d42c60ba74f972f.exe	30
PID 2072 wrote to memory of 2516	2072	WScript.exe	31
PID 2072 wrote to memory of 2516	2072	WScript.exe	31
PID 2072 wrote to memory of 2516	2072	WScript.exe	31
PID 2072 wrote to memory of 2516	2072	WScript.exe	31
PID 2516 wrote to memory of 1752	2516	cmd.exe	33
PID 2516 wrote to memory of 1752	2516	cmd.exe	33
PID 2516 wrote to memory of 1752	2516	cmd.exe	33
PID 2516 wrote to memory of 1752	2516	cmd.exe	33
PID 1752 wrote to memory of 920	1752	DllCommonsvc.exe	74
PID 1752 wrote to memory of 920	1752	DllCommonsvc.exe	74
PID 1752 wrote to memory of 920	1752	DllCommonsvc.exe	74
PID 1752 wrote to memory of 1676	1752	DllCommonsvc.exe	75
PID 1752 wrote to memory of 1676	1752	DllCommonsvc.exe	75
PID 1752 wrote to memory of 1676	1752	DllCommonsvc.exe	75
PID 1752 wrote to memory of 2968	1752	DllCommonsvc.exe	76
PID 1752 wrote to memory of 2968	1752	DllCommonsvc.exe	76
PID 1752 wrote to memory of 2968	1752	DllCommonsvc.exe	76
PID 1752 wrote to memory of 2260	1752	DllCommonsvc.exe	77
PID 1752 wrote to memory of 2260	1752	DllCommonsvc.exe	77
PID 1752 wrote to memory of 2260	1752	DllCommonsvc.exe	77
PID 1752 wrote to memory of 2696	1752	DllCommonsvc.exe	78
PID 1752 wrote to memory of 2696	1752	DllCommonsvc.exe	78
PID 1752 wrote to memory of 2696	1752	DllCommonsvc.exe	78
PID 1752 wrote to memory of 1812	1752	DllCommonsvc.exe	79
PID 1752 wrote to memory of 1812	1752	DllCommonsvc.exe	79
PID 1752 wrote to memory of 1812	1752	DllCommonsvc.exe	79
PID 1752 wrote to memory of 488	1752	DllCommonsvc.exe	80
PID 1752 wrote to memory of 488	1752	DllCommonsvc.exe	80
PID 1752 wrote to memory of 488	1752	DllCommonsvc.exe	80
PID 1752 wrote to memory of 656	1752	DllCommonsvc.exe	81
PID 1752 wrote to memory of 656	1752	DllCommonsvc.exe	81
PID 1752 wrote to memory of 656	1752	DllCommonsvc.exe	81
PID 1752 wrote to memory of 1736	1752	DllCommonsvc.exe	82
PID 1752 wrote to memory of 1736	1752	DllCommonsvc.exe	82
PID 1752 wrote to memory of 1736	1752	DllCommonsvc.exe	82
PID 1752 wrote to memory of 2292	1752	DllCommonsvc.exe	83
PID 1752 wrote to memory of 2292	1752	DllCommonsvc.exe	83
PID 1752 wrote to memory of 2292	1752	DllCommonsvc.exe	83
PID 1752 wrote to memory of 2436	1752	DllCommonsvc.exe	84
PID 1752 wrote to memory of 2436	1752	DllCommonsvc.exe	84
PID 1752 wrote to memory of 2436	1752	DllCommonsvc.exe	84
PID 1752 wrote to memory of 2064	1752	DllCommonsvc.exe	85
PID 1752 wrote to memory of 2064	1752	DllCommonsvc.exe	85
PID 1752 wrote to memory of 2064	1752	DllCommonsvc.exe	85
PID 1752 wrote to memory of 2204	1752	DllCommonsvc.exe	86
PID 1752 wrote to memory of 2204	1752	DllCommonsvc.exe	86
PID 1752 wrote to memory of 2204	1752	DllCommonsvc.exe	86
PID 1752 wrote to memory of 2124	1752	DllCommonsvc.exe	87
PID 1752 wrote to memory of 2124	1752	DllCommonsvc.exe	87
PID 1752 wrote to memory of 2124	1752	DllCommonsvc.exe	87
PID 1752 wrote to memory of 1972	1752	DllCommonsvc.exe	102
PID 1752 wrote to memory of 1972	1752	DllCommonsvc.exe	102
PID 1752 wrote to memory of 1972	1752	DllCommonsvc.exe	102
PID 1972 wrote to memory of 2596	1972	cmd.exe	104
PID 1972 wrote to memory of 2596	1972	cmd.exe	104
PID 1972 wrote to memory of 2596	1972	cmd.exe	104
PID 1972 wrote to memory of 2088	1972	cmd.exe	106
PID 1972 wrote to memory of 2088	1972	cmd.exe	106
PID 1972 wrote to memory of 2088	1972	cmd.exe	106
PID 2088 wrote to memory of 1356	2088	taskhost.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed24288c41dc8344dce970d09bcd4035ad4c1653d9c7c1598d42c60ba74f972f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ed24288c41dc8344dce970d09bcd4035ad4c1653d9c7c1598d42c60ba74f972f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\OEM\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Globalization\MCT\MCT-GB\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Start Menu\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\tmp\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\de-DE\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BesxsIGQPd.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1972
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2596
      - C:\Users\Public\Pictures\taskhost.exe
        
        "C:\Users\Public\Pictures\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat"
        7⤵
        
        PID:1356
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2884
        
        C:\Users\Public\Pictures\taskhost.exe
        
        "C:\Users\Public\Pictures\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NDsGBfOUR3.bat"
        9⤵
        
        PID:2456
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:540
        
        C:\Users\Public\Pictures\taskhost.exe
        
        "C:\Users\Public\Pictures\taskhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\61cJPf1Vjg.bat"
        11⤵
        
        PID:896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2292
        
        C:\Users\Public\Pictures\taskhost.exe
        
        "C:\Users\Public\Pictures\taskhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat"
        13⤵
        
        PID:2008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2152
        
        C:\Users\Public\Pictures\taskhost.exe
        
        "C:\Users\Public\Pictures\taskhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4NR89d4K3E.bat"
        15⤵
        
        PID:2256
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2168
        
        C:\Users\Public\Pictures\taskhost.exe
        
        "C:\Users\Public\Pictures\taskhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8UyA8TRco5.bat"
        17⤵
        
        PID:1352
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2664
        
        C:\Users\Public\Pictures\taskhost.exe
        
        "C:\Users\Public\Pictures\taskhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZHEG9SYztW.bat"
        19⤵
        
        PID:500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2736
        
        C:\Users\Public\Pictures\taskhost.exe
        
        "C:\Users\Public\Pictures\taskhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\epFjAgKouK.bat"
        21⤵
        
        PID:2412
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1108
        
        C:\Users\Public\Pictures\taskhost.exe
        
        "C:\Users\Public\Pictures\taskhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8KwMxVG80h.bat"
        23⤵
        
        PID:3028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1956
        
        C:\Users\Public\Pictures\taskhost.exe
        
        "C:\Users\Public\Pictures\taskhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\OEM\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Help\OEM\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\OEM\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Common Files\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Windows\Globalization\MCT\MCT-GB\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\Globalization\MCT\MCT-GB\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Windows\Globalization\MCT\MCT-GB\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\WTR\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Start Menu\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Start Menu\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\tmp\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\assembly\tmp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\assembly\tmp\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\de-DE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Media\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\Media\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95887c9f8aa02eee212598031152bd7c

SHA1
1b098faa7925145002b7b4c15354fc4d8e44d81e

SHA256
026bd70fb306ddcfa6c61438a72612b6e3e8b038db480c8ab0b2d2296968bdb6

SHA512
4fa082bcf41d054bed696aa7e0041b68b25297cd3c5f5950568ad69cf1f25f18031ebe302b9901c585e64f8331bb0970aebd385f5383a371fb05e526cd1e25d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07c4ca60dd66046447f91b56f4d3155c

SHA1
531f28c6ceb13c863b868efcc3246da0ea29d7d9

SHA256
af0e9b398eceb03bc42ee10c9270b7d0f67627d351e879a5c12f80aa8e7382d9

SHA512
f3964441ebcdf7196f3682b8ad08224e278acac226b5c9a47b4d06e90bc2ade79ad3fb046df4eff8fbb437f7466a177e3c5cc9c90292c74a95d16662f3052060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a9f10748455231a2aef5086cd88e251

SHA1
e29bd1b4dd2ebdf316b6a4f211f21e4c84980a5d

SHA256
d1752b193a9c02863cace82480d12882992695af48f8a0341c1a196936cb540e

SHA512
bfb51e43d64fc2fa8402dd51cc416946e206365a2cb6a7197569adacc3966db5c8283f0e12b46f56bb36dd81f3cc42f84cae94536c696ee5eaa6fc6d648ceb00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ea4c0c5c72522fc5f270eb81b7afec2

SHA1
5b649e4d2a275c458a0a259d24dcebd4e4e8dc44

SHA256
b34d1f1cc1bab92cc5c48e108b0604aa41291e3e9212ca67094232aa849038fc

SHA512
3d48a92baab719bc9e74ada02829629f847eb84a2db70870100f26adf29ae2bed4aad210f97071af055edd79308f7a93baba6e9055cb8d016c7ee42900ed3c94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0ef39b6b2422f06edaa0abcc5e05024

SHA1
ba8125e8641abed7e61e3b951c386c973bcef9d3

SHA256
982f5f3cf722f934cfb17b52190660d7e608dac1b3eeeaf95531f9668765d01c

SHA512
74b743bcef50f193c1f156bd0251913233f4dee4d4bc4389952e7f189d582b5c4b8b1abf378806f6ec2593b40a2a174121f67993b88749f13095da5b09045c3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71d6bfa1d031fbc6e8d2ae382c05b193

SHA1
859e1f4accb13060de03dbf6aa7d2ec8408091aa

SHA256
484d1a2eea5439822360a14d3d27dc8fd40576579fa601b638e2567754c4f9f9

SHA512
3912db3b109941230451e3b50a352a888193ab0ed7a68451e05a0cd6432ff9fb13f405c7cc4726681ba81a86ecbc5c27bb6777d80fe4845461923befb7557a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3def267bc0152c12c0f3e74427a6695

SHA1
8122b564b6f996996280200b7f5a8d8dcba4ed8b

SHA256
2f541e122fd740341c87e034c59c20fb70946b95d6cd21476b86d7252438262c

SHA512
70956bb9e14ac56c3e5f77718428fa4596f07022b68461b5abfff1835e23fbfca4a93150561d6617e0c7ca660acb839e8698e65f2e10257f8a6d5dd9862e2879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7926265a1e45b95e1b074974f148ad61

SHA1
0f03329f0f3152d60a1c5f43d94bde718c56d92e

SHA256
c942196d1831e667c80dacab951f4d4039e6fbaa996856e014eb45e45cee402c

SHA512
e07ec37f39f1822e67aee3eed508d50977bc645e3823164a184716cbd24211cd0f7375abab8f1926dd52c5b2c34422cc99cb33ab4347043de8ea20bb99ccf0bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\4NR89d4K3E.bat

Filesize
202B

MD5
af7a95537c16b92ab23e251255cb69d2

SHA1
76a785377a1e96e9379af80424d61253f48cba96

SHA256
8a8dcc11b6efe4c1a0c4e12776d1bd84347c125edfa7d7e757595719094e68c1

SHA512
2529b3ab3d12dfa48a97b2d5e5c3b0aceddf0f09f9447144bc346a22ebb6ea02267979ec4cb11b2ae23d40fee90dce04991564bec0fc87f3a42cddfd2dc77817

Download Submit
C:\Users\Admin\AppData\Local\Temp\61cJPf1Vjg.bat

Filesize
202B

MD5
f6b594c2e45f9ab31d13e5c6c414beff

SHA1
0d9a8b01897213001448a46f5426bfac13a9677f

SHA256
844b2670f2a1a17eb24de6c79e6e9c8f442caa4034f717b2849b74e53409676a

SHA512
3f85149ba62e97d15757d1e4f8039ad64eb7c2552e035cd8464e301a37e8efce37b216d2000aa4cb64fd6197ed8c65f53f59810c745a4227cf33baf5f30fce95

Download Submit
C:\Users\Admin\AppData\Local\Temp\8KwMxVG80h.bat

Filesize
202B

MD5
44255a13ccdd033fd6f3ad00aaa1e43f

SHA1
6429ca3db651cc6703ce86263e805e18b3429bfe

SHA256
ec707a18bfe101db8961a74cf97047b7992a161fc4fd61f438f7c8609e3edd78

SHA512
535fe2b6eae7764c7a3f6de03f1d375108ed346499373051b30f11ccf039c469511135bab8a99aa373eb51a16fab0cc3f992202f4b3c812629544dfb986a90a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\8UyA8TRco5.bat

Filesize
202B

MD5
fd89c3810ece1781d78640557df4404b

SHA1
d2e9c12ac7a1d4fa6129452b41fb85786c3c0ed1

SHA256
6657b90a63f54eaecc18575f896fc35cb2026b07901f7081807925eacf5a8773

SHA512
422de7a2ed0aa0b1df23503b6cfb58c1bc5924a0c65a5aaa3ec8cf0709e722064216db982cc9c5a34a99322ea35dced02c1cf08e8c0ae8e552767a27cd0b3414

Download Submit
C:\Users\Admin\AppData\Local\Temp\BesxsIGQPd.bat

Filesize
202B

MD5
e742f0c568a6ecacf51ff77314fb5326

SHA1
cd861817d8b1af0c176ffe42f7995bf7c2b9ee98

SHA256
50661ef15ac76d8a9c193a47e2a302351f0d59cd23d3b93ac6f0bf5008c4bb64

SHA512
38226b839724c4c7cb5df746b3bdffdb679054400b601c658c17474ecf151e6872b20eb14c3805cb87a9fb4920ec4e6ffcd02b8f1a51d8636c7fb5e43e842c88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1335.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat

Filesize
202B

MD5
9c718ba909eb3729ea21b0ac43388bb4

SHA1
f57025c252f1cea2b19e810c8cf7d1ef810ed39f

SHA256
540c03575fc7920db13d0f0cc2a41550e9784cbc4dfbd15007e65eb9fe2a3e6c

SHA512
575a66d0615ddea106205d65180b5568a3e5c780f8292fc03574f0e2c3b00ce1d9cd2bd7f6ff98d5bb50460f25a23188781baa8580a178075ea215dc211eec7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat

Filesize
202B

MD5
da49a36fed5fcc126a89f1f031bba07d

SHA1
81d8be36a7572aa2118f11ae36e7f745646da057

SHA256
1412c2a03fe5513de40bcd3266793fa7ff586845d05fa5a5e11d55d6da3fcbc4

SHA512
bc006d57651e91ed98b8421e12778bf7646841eb8f2ddf5e52fe608d0cca267e5c9b7dd855666bd9c73e0a0d4452155d23098d404e33110f9b3905e184db617a

Download Submit
C:\Users\Admin\AppData\Local\Temp\NDsGBfOUR3.bat

Filesize
202B

MD5
60dceb0d9575591e766aa710e59d8f9b

SHA1
ab23996d5959287e652d085d4553eb4e953f11f9

SHA256
22bfb2cfe5e481db556d0bb42fdc838cec25f255c984f10546794297975d4c1f

SHA512
da7e40f06ccf1fb97cb787341631413e09a0147c6520d9de73dbce113119306c6cb2684b79eb6c0b71412fdfad3858600513def4cb27b4d3807be44a7b3a84a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1357.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZHEG9SYztW.bat

Filesize
202B

MD5
65384eb99665467c75f68a62e01637a3

SHA1
aafa8f2b00a550ca9937fe6cb61b859ff43dd43e

SHA256
98b09e537f024c20539339a2417bb090c17f4ec89b22e9b67de61a018e9f5896

SHA512
e8ab287aab3b748fbf78082f61679c0bdaa4e84610426b75cda3d9d155663c321e579decd7d6f5c54a6141220fa013998e8d4b97d49df22f4861fb8bbab56a3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\epFjAgKouK.bat

Filesize
202B

MD5
a32ae56c6d950128561ee87229b60bfd

SHA1
74259d2b5278ad7b9a9d6343eb7a976d4c1b0943

SHA256
87898dc8f6c5c56b23b91ad719cbe77e034b3b7517aabdf75a55c851a6f82344

SHA512
51a690e784d6d89eaf8562a553b70eb1cd92477f3fd2e57ae480a0f0b706108d0bad8325c6a58944e4c5da3fda4edde0d41c1764932a7ef22523f46fa1378dd3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f6c5f39ace738b92e4564e86746da19a

SHA1
526a5d848bff09db24a04ca9ed6db60aff127ed6

SHA256
9be49ecf79c0f732225a500d77a9411c0ad39886a05730aeb2ebd00465e49345

SHA512
f60f10061dc8969eaaec033c7bb5be7b3971b5c1969bcd607d6cb711145b0c80dd619d3fd2c8ac52d1123c8135f09b29b7e24bc443aad23119a2045662f712d3

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/920-63-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/1008-361-0x00000000003E0000-0x00000000004F0000-memory.dmp

Filesize
1.1MB

Download
memory/1276-421-0x0000000000C20000-0x0000000000D30000-memory.dmp

Filesize
1.1MB

Download
memory/1696-541-0x0000000001160000-0x0000000001270000-memory.dmp

Filesize
1.1MB

Download
memory/1752-16-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/1752-14-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/1752-15-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/1752-13-0x0000000000CE0000-0x0000000000DF0000-memory.dmp

Filesize
1.1MB

Download
memory/1752-17-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2000-301-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2088-122-0x00000000012E0000-0x00000000013F0000-memory.dmp

Filesize
1.1MB

Download
memory/2304-481-0x00000000000F0000-0x0000000000200000-memory.dmp

Filesize
1.1MB

Download
memory/2696-57-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2844-182-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2844-181-0x0000000001340000-0x0000000001450000-memory.dmp

Filesize
1.1MB

Download