dcrat | 45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe
Size

1.3MB
MD5

432df970422a8f38c1034b91d7889ab1
SHA1

0ee4ff6f332fcc0dbbc6b3f3299b99f466dd56bc
SHA256

45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27
SHA512

b14782be9dc9ef323561929345e77c05b05edfeca5722006f60342d7dec58b2524d80e25a81d27ac2b3d8f416d2ce0e46e6efdcfd030da1d3f6650914f01fa50
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2744	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2744	schtasks.exe	34

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0009000000016d69-9.dat	dcrat
behavioral1/memory/2940-13-0x0000000000050000-0x0000000000160000-memory.dmp	dcrat
behavioral1/memory/1584-48-0x0000000000060000-0x0000000000170000-memory.dmp	dcrat
behavioral1/memory/2280-167-0x00000000010B0000-0x00000000011C0000-memory.dmp	dcrat
behavioral1/memory/2668-227-0x00000000012C0000-0x00000000013D0000-memory.dmp	dcrat
behavioral1/memory/924-583-0x0000000000320000-0x0000000000430000-memory.dmp	dcrat
behavioral1/memory/2204-644-0x0000000001350000-0x0000000001460000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1740	powershell.exe
952	powershell.exe
108	powershell.exe
812	powershell.exe
2644	powershell.exe
2676	powershell.exe
1436	powershell.exe
612	powershell.exe
2188	powershell.exe
1896	powershell.exe
1680	powershell.exe
2376	powershell.exe
800	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2940	DllCommonsvc.exe
1584	cmd.exe
2280	cmd.exe
2668	cmd.exe
1748	cmd.exe
2524	cmd.exe
2260	cmd.exe
2680	cmd.exe
2124	cmd.exe
924	cmd.exe
2204	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2844	cmd.exe
2844	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
29	raw.githubusercontent.com
32	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
23	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com
36	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
16	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\de-DE\DllCommonsvc.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\fr-FR\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\fr-FR\0a1fd5f707cd16	DllCommonsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\es-ES\smss.exe	DllCommonsvc.exe
File created	C:\Windows\es-ES\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\Boot\PCAT\el-GR\lsass.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2568	schtasks.exe
2596	schtasks.exe
2336	schtasks.exe
2800	schtasks.exe
1324	schtasks.exe
2268	schtasks.exe
3024	schtasks.exe
3036	schtasks.exe
1160	schtasks.exe
2456	schtasks.exe
2396	schtasks.exe
2916	schtasks.exe
2656	schtasks.exe
2244	schtasks.exe
2812	schtasks.exe
1708	schtasks.exe
620	schtasks.exe
2432	schtasks.exe
1644	schtasks.exe
2060	schtasks.exe
708	schtasks.exe
956	schtasks.exe
1308	schtasks.exe
1084	schtasks.exe
2652	schtasks.exe
2508	schtasks.exe
1892	schtasks.exe
1900	schtasks.exe
2492	schtasks.exe
1992	schtasks.exe
2064	schtasks.exe
2636	schtasks.exe
2620	schtasks.exe
2428	schtasks.exe
2340	schtasks.exe
1784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2940	DllCommonsvc.exe
2940	DllCommonsvc.exe
2940	DllCommonsvc.exe
612	powershell.exe
2188	powershell.exe
1740	powershell.exe
1436	powershell.exe
952	powershell.exe
108	powershell.exe
1896	powershell.exe
812	powershell.exe
2644	powershell.exe
2676	powershell.exe
1680	powershell.exe
1584	cmd.exe
800	powershell.exe
2376	powershell.exe
2280	cmd.exe
2668	cmd.exe
1748	cmd.exe
2524	cmd.exe
2260	cmd.exe
2680	cmd.exe
2124	cmd.exe
924	cmd.exe
2204	cmd.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2940	DllCommonsvc.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	1584	cmd.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	108	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	812	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2280	cmd.exe
Token: SeDebugPrivilege	2668	cmd.exe
Token: SeDebugPrivilege	1748	cmd.exe
Token: SeDebugPrivilege	2524	cmd.exe
Token: SeDebugPrivilege	2260	cmd.exe
Token: SeDebugPrivilege	2680	cmd.exe
Token: SeDebugPrivilege	2124	cmd.exe
Token: SeDebugPrivilege	924	cmd.exe
Token: SeDebugPrivilege	2204	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2212	2820	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe	30
PID 2820 wrote to memory of 2212	2820	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe	30
PID 2820 wrote to memory of 2212	2820	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe	30
PID 2820 wrote to memory of 2212	2820	JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe	30
PID 2212 wrote to memory of 2844	2212	WScript.exe	31
PID 2212 wrote to memory of 2844	2212	WScript.exe	31
PID 2212 wrote to memory of 2844	2212	WScript.exe	31
PID 2212 wrote to memory of 2844	2212	WScript.exe	31
PID 2844 wrote to memory of 2940	2844	cmd.exe	33
PID 2844 wrote to memory of 2940	2844	cmd.exe	33
PID 2844 wrote to memory of 2940	2844	cmd.exe	33
PID 2844 wrote to memory of 2940	2844	cmd.exe	33
PID 2940 wrote to memory of 1740	2940	DllCommonsvc.exe	71
PID 2940 wrote to memory of 1740	2940	DllCommonsvc.exe	71
PID 2940 wrote to memory of 1740	2940	DllCommonsvc.exe	71
PID 2940 wrote to memory of 1436	2940	DllCommonsvc.exe	72
PID 2940 wrote to memory of 1436	2940	DllCommonsvc.exe	72
PID 2940 wrote to memory of 1436	2940	DllCommonsvc.exe	72
PID 2940 wrote to memory of 2188	2940	DllCommonsvc.exe	73
PID 2940 wrote to memory of 2188	2940	DllCommonsvc.exe	73
PID 2940 wrote to memory of 2188	2940	DllCommonsvc.exe	73
PID 2940 wrote to memory of 612	2940	DllCommonsvc.exe	74
PID 2940 wrote to memory of 612	2940	DllCommonsvc.exe	74
PID 2940 wrote to memory of 612	2940	DllCommonsvc.exe	74
PID 2940 wrote to memory of 1896	2940	DllCommonsvc.exe	76
PID 2940 wrote to memory of 1896	2940	DllCommonsvc.exe	76
PID 2940 wrote to memory of 1896	2940	DllCommonsvc.exe	76
PID 2940 wrote to memory of 952	2940	DllCommonsvc.exe	78
PID 2940 wrote to memory of 952	2940	DllCommonsvc.exe	78
PID 2940 wrote to memory of 952	2940	DllCommonsvc.exe	78
PID 2940 wrote to memory of 108	2940	DllCommonsvc.exe	79
PID 2940 wrote to memory of 108	2940	DllCommonsvc.exe	79
PID 2940 wrote to memory of 108	2940	DllCommonsvc.exe	79
PID 2940 wrote to memory of 1680	2940	DllCommonsvc.exe	80
PID 2940 wrote to memory of 1680	2940	DllCommonsvc.exe	80
PID 2940 wrote to memory of 1680	2940	DllCommonsvc.exe	80
PID 2940 wrote to memory of 2376	2940	DllCommonsvc.exe	81
PID 2940 wrote to memory of 2376	2940	DllCommonsvc.exe	81
PID 2940 wrote to memory of 2376	2940	DllCommonsvc.exe	81
PID 2940 wrote to memory of 812	2940	DllCommonsvc.exe	82
PID 2940 wrote to memory of 812	2940	DllCommonsvc.exe	82
PID 2940 wrote to memory of 812	2940	DllCommonsvc.exe	82
PID 2940 wrote to memory of 800	2940	DllCommonsvc.exe	83
PID 2940 wrote to memory of 800	2940	DllCommonsvc.exe	83
PID 2940 wrote to memory of 800	2940	DllCommonsvc.exe	83
PID 2940 wrote to memory of 2676	2940	DllCommonsvc.exe	84
PID 2940 wrote to memory of 2676	2940	DllCommonsvc.exe	84
PID 2940 wrote to memory of 2676	2940	DllCommonsvc.exe	84
PID 2940 wrote to memory of 2644	2940	DllCommonsvc.exe	85
PID 2940 wrote to memory of 2644	2940	DllCommonsvc.exe	85
PID 2940 wrote to memory of 2644	2940	DllCommonsvc.exe	85
PID 2940 wrote to memory of 1584	2940	DllCommonsvc.exe	97
PID 2940 wrote to memory of 1584	2940	DllCommonsvc.exe	97
PID 2940 wrote to memory of 1584	2940	DllCommonsvc.exe	97
PID 1584 wrote to memory of 1956	1584	cmd.exe	98
PID 1584 wrote to memory of 1956	1584	cmd.exe	98
PID 1584 wrote to memory of 1956	1584	cmd.exe	98
PID 1956 wrote to memory of 1148	1956	cmd.exe	100
PID 1956 wrote to memory of 1148	1956	cmd.exe	100
PID 1956 wrote to memory of 1148	1956	cmd.exe	100
PID 1956 wrote to memory of 2280	1956	cmd.exe	101
PID 1956 wrote to memory of 2280	1956	cmd.exe	101
PID 1956 wrote to memory of 2280	1956	cmd.exe	101
PID 2280 wrote to memory of 1660	2280	cmd.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45df2dd1cc96f978cb9f0bdceed8a3b4f9dd62622e955175a63cd0fd2cce2b27.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\System\msadc\de-DE\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Cookies\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\fr-FR\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Acrobat\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2644
    - - C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1584
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r7gOBUt9HL.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1148
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat"
        8⤵
        
        PID:1660
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1100
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GW80Ek08hx.bat"
        10⤵
        
        PID:1120
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2876
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TEfATY8not.bat"
        12⤵
        
        PID:2084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:576
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zi4n06VBpB.bat"
        14⤵
        
        PID:2508
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1016
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vlZZCFJNsh.bat"
        16⤵
        
        PID:1640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:940
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat"
        18⤵
        
        PID:3032
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2948
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4vYRXbn8bW.bat"
        20⤵
        
        PID:1916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2364
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2K3DLFE7WC.bat"
        22⤵
        
        PID:968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2564
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\System\msadc\de-DE\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\msadc\de-DE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\System\msadc\de-DE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Libraries\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Libraries\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Cookies\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Cookies\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\fr-FR\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\fr-FR\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Journal\fr-FR\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\Acrobat\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Acrobat\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Adobe\Acrobat\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Application Data\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Application Data\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6edec4892af52fc6f26afac0ee25220a

SHA1
eef48b230a95bf7630926d44565ba138bacad0a7

SHA256
1adb1c209959cd6efada5efeadb793e6b1de308ebfdfb7a03cbd531112756853

SHA512
754cd944f99bff54df8adc0f403b7ba2585a507154cf27173f0c034754fa1f0d8b93f25610a88dd820cb722b838018034fcee8d584264e4e445d2d9a198c35d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33c430e80fddafff02d203102f1af051

SHA1
dd60156d6d7c2b0ddffab00f4acfd225d8658fcd

SHA256
710459f8d6dd2280e23bdeb967d3455fb195e8ae48b322ff07000ee668becfff

SHA512
6237cc3406fcba9df77942e0d59198ea8979368f8245fc050a68354542e0fe618ac2ad5cd2b8f8f8e26993a95707f5120c9601e9d29318ac45de9e003b88e2cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31c50c9fb022f88cf2614f6229b23352

SHA1
f40b1209a833a7a8f40f29aa22f426f7cb92143c

SHA256
e25f81c053d8d8bb16fbc6063796c7e374aa2e2f5bece8b4462316717ed9390d

SHA512
8469637a406ceb65642331f10542048e3b3a039292e9527fd4173ccb38cd519d2c0b6bcb043d903712d2c5a5603834dde918604e2774f75cd9690a50c0799eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4681afa1bac17bc918051e068d850db

SHA1
d84b52207b6a3bcae5d2d9d650fd927c9b98b9e4

SHA256
6ccc5001b13a695a3e3fc2087240a3ffb03ac725c5f0c6fa4f0e2e8d4837678f

SHA512
d40825172d6c20cc798b33fe0702a5b5549086b7dc5a177b84397dded0977f42bf1050bf22d268c1bf8e3c2328a670c6df30a20ebd8e785233e79dfeeff80cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49baa39002cf312e40bbb925ea0a999f

SHA1
baf5073e469271b58a1c89fa654412f0fe26a6bf

SHA256
9a70b8fe38ad22fd8f7ad5e1eccca6f56adf4269af191aab2f04707aaaa6dcb1

SHA512
04fa7bc4ab26a35576e2392e157872a270c665a19fcd5ff4858449d300813261041e1f05d6b58ee6acb603bf64232d15a6b349095bbae564dd55699c62fcda4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3a552f57487818dd57d43d5e6f591fc

SHA1
cf8abca0615739f3cfdb54dd0a371ef9522dd6b6

SHA256
0b1e68cf203d67193acc4142b35c9713a4c2461ee84339f6776e4df80330ea7c

SHA512
72312b4638cab4fd77266a734cf285d88106189940281629c1eb609096f2637f961fad622e6835d28286eb523a41636f94a8a2183181b8ccc1ae0717beed3753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3024b662bca950e82bbfaa65c251e17d

SHA1
d0142876506eaa89a063b7243ba54dbc6a6a6991

SHA256
0573e70bd37727b6a6ca497638d623be3c9a89e62d949777a7c8ccb91e9c4163

SHA512
fb64c68417680b6ebc202ddea9b84a3723d8782eaa701047cbc2c26ce4229306d0a171a567eabd6fc9427b1365837f27c0e635ff5b66201ecf57c3a8d207b6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a6989a7ad75b4524c8a17f1383c9259

SHA1
adce53cb71c45e3f74f53a41098f66282025e3a1

SHA256
0484253ff406121a30f69147524edf9b59f53af5091a710184e1f9be766cfb2d

SHA512
0b80518b60883014c4de35f1f1464c73e8017bf8c253fcdb35aeac0dd5855c069bb601c3976457e281a838b5d079ff5c00767033042ccfadc08a288c19e0030f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b6b701d2798b2659d383a62f17df04a

SHA1
931fef01f17d77f533a77ca5e9c5895a75dbae04

SHA256
d8f659bc3f998b7ffcb662b70900e0f3eeedaccb4b94dce99619b9933d753e02

SHA512
7699d59b15b2b751aa413e9b1b7d5f9d182f0148cbc2f267120fb80f1d1e2b0032a24699da655a530b510faf2836cca62a7f82e6a66558a3585ce257ab20fe44

Download Submit
C:\Users\Admin\AppData\Local\Temp\2K3DLFE7WC.bat

Filesize
190B

MD5
6e4fb2fbebee09587f65538bdfe37374

SHA1
b8934e345c9c87926c19dfeddb8d4d56d6c7a696

SHA256
39f603b18c794ba67359d1f2ca1deef26a45cfb8b186bf7c910c2a6f9aac8aef

SHA512
468e58e44723436ad657aa03fe55ed01e92c39be3e97cf6690c8dc715c2a1a784bd1062d0ee00e64950cf972d6ecfa2bdc863530f0b73efcb6013ad7baa855ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\4vYRXbn8bW.bat

Filesize
190B

MD5
d7f84969851fd087cf7562d9563041fb

SHA1
23b72f040cd86e20b3e8e5777ac6123fe1d90dc6

SHA256
841350228da907020af3619e028cf2c3b59cfe7af948d1a7b55bc473b6bbba2c

SHA512
0b02880ea8a40d4ba59a85c1e561ae04ccf62f100b15bab15d8ec954cb318e54402ea54d61a10734eef094c8ce78ec64742c53e202fc617717369d9fe8f2e925

Download Submit
C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat

Filesize
190B

MD5
ae61e8fde205eb707cc7079c2bbbaf0b

SHA1
5bf9fdece67fa2a95a6ef870cd55f9d198d7e7c8

SHA256
07cdbfd03aab3689a99fd5c5cc3837c8ae151da83b5fdacdb194db16edc940c0

SHA512
6c6f3bde9da768e50041e56cf23ae06ee18088378550cf0dc888bb6e0d569b808ddf7d097c645e768144aa25f738a913df7139d81d8b6cbe84cc094a531225a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27DD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GW80Ek08hx.bat

Filesize
190B

MD5
c671e0a21bf924066d8f33f5c8b8da20

SHA1
08c3ee4d237d46101a6acf8efa7480d29632677a

SHA256
5b84de3c934ba9ec3ae74c70ca40fd53ce44dfe9f72479135670837b7aeedbaa

SHA512
89bf12c352c07dd5218c9b8835f86907362a9d54f73f51314d6c47d6bbf80efa1a65f8fbcaf93345a6360660a49a99255e2f901d2b3e76e8d02e3e2363a70043

Download Submit
C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat

Filesize
190B

MD5
a4ec110162c82bc002881f8c41de549e

SHA1
cfa91ed5fc930f5da4936d8aeb53f2bf4b7fd46f

SHA256
6213a0f06aea246352973f011f239e7c828af533585fdea9e2ac60d5eaefe1a1

SHA512
3cb7f78b1ab6e6f414a8da9462bac803b28712cae6f784ccba51fabc4669041416e10fa37de72464bfa78aae9f73f131d667a4904db81e59af337f56cd6c2db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TEfATY8not.bat

Filesize
190B

MD5
259e6efa1f5d7e1afe21bdb09c5ab33f

SHA1
34c1cb5bddfbc7600ec284b0092998f6aab7ed16

SHA256
e84c1911d63d105990fb5a394b8103784f2dc3dd4013afb851047f951df13832

SHA512
759f4fb92f8f1dced3de51fefb3965f53b273cded17d8efd0d8c2fc3d4f29877321b4fa60a0ad14be0088ed899f1b474b37c6db9adda59eda6c4c9a7c0bdd671

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar284D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\r7gOBUt9HL.bat

Filesize
190B

MD5
be3cac24e04d9067d659e8e13a2e9225

SHA1
fe7fb9e05a1af08867776adf35cc824165dcb57d

SHA256
945e91e764d1d2ac9cc5d15b2539ce909441cc16dfb7e5fd816148bdc5f35ce5

SHA512
93e008dd76c419e00a1e3243435a6bf5a3ae89b43425b4e94c954b2d9a86b8712a96f8823fb6dfa7b3ca77dea7b6b6c35d85dce5d17eaa4272af3c705773075d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlZZCFJNsh.bat

Filesize
190B

MD5
d2d3d6a8a1b33869a2c376676e9226b5

SHA1
83a28773713a608bd6a8aa2879239cf88370ae08

SHA256
83a4155e157bbdf89c88d2212c4d4972149e444c237e900584e40ac85f33a363

SHA512
ee702b58057e4433f580a97ddca3c523dd230c51c862e547d94c298a8d6281837eac6f419f5ec9f1fa299b3f2ed8816c8fc17aa9543f5f0f6d6c35c9a0a0a8fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\zi4n06VBpB.bat

Filesize
190B

MD5
29d4844bb966287850ae41ca638f3e21

SHA1
109f41dfcd60bac37a7bae0b05dfa8528d2a4bd1

SHA256
5da26632d9db942d15459f1a4ce8e74ceb89783b2cf10a46b7bc65995173fe45

SHA512
ff3d4f80a0a5ff1f301cc2631249aa84c38ef87b7304f7e89475e34cd3f9da59d14fdef6923fda79f973c64d33358556bf1756f12f9ac5e4ca12db2262a57775

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
37087baaad4110d810fb6691bbfac179

SHA1
310fdf2759c936e8561ccd2b42021d5f3e850112

SHA256
07b91af99264eb80506b6d34666212587da16ba6a47f43b48f2529d124af38ea

SHA512
d8b88d215ba9f49fb82af3b81dfc867f375e9730cda50d4a5324121716241ab1b6658e43b4694e60ec81b3f5a89da37dec2c49281c9345f259bf31640027f309

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/612-59-0x000000001B300000-0x000000001B5E2000-memory.dmp

Filesize
2.9MB

Download
memory/612-60-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/924-584-0x0000000000310000-0x0000000000322000-memory.dmp

Filesize
72KB

Download
memory/924-583-0x0000000000320000-0x0000000000430000-memory.dmp

Filesize
1.1MB

Download
memory/1584-48-0x0000000000060000-0x0000000000170000-memory.dmp

Filesize
1.1MB

Download
memory/2204-644-0x0000000001350000-0x0000000001460000-memory.dmp

Filesize
1.1MB

Download
memory/2280-167-0x00000000010B0000-0x00000000011C0000-memory.dmp

Filesize
1.1MB

Download
memory/2668-228-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/2668-227-0x00000000012C0000-0x00000000013D0000-memory.dmp

Filesize
1.1MB

Download
memory/2940-17-0x0000000000320000-0x000000000032C000-memory.dmp

Filesize
48KB

Download
memory/2940-16-0x0000000000310000-0x000000000031C000-memory.dmp

Filesize
48KB

Download
memory/2940-15-0x0000000000300000-0x000000000030C000-memory.dmp

Filesize
48KB

Download
memory/2940-14-0x00000000002F0000-0x0000000000302000-memory.dmp

Filesize
72KB

Download
memory/2940-13-0x0000000000050000-0x0000000000160000-memory.dmp

Filesize
1.1MB

Download