dcrat | 8ae436fb69f2909a5827dbe6839a99b6ddfaa34c8021e5f0305d5cc22680ac48

Analysis

max time kernel
148s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8ae436fb69f2909a5827dbe6839a99b6ddfaa34c8021e5f0305d5cc22680ac48.exe
Size

1.3MB
MD5

eee61744db1dddacf6e2281f9e045323
SHA1

6acfa1325cf6cbaeddd8e06d038601aa0eeff1c3
SHA256

8ae436fb69f2909a5827dbe6839a99b6ddfaa34c8021e5f0305d5cc22680ac48
SHA512

9c4b2c1d8cd2588ba19fe01db05a016de8a1e8e0787b61e9350de650b8ed62a6ed7bff353c3115ea1fc5033ee77bfb7389220f6c7373f8720c8ce07aabe019cb
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	328	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	328	schtasks.exe	34

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000600000001945c-9.dat	dcrat
behavioral1/memory/2132-13-0x0000000000F10000-0x0000000001020000-memory.dmp	dcrat
behavioral1/memory/2420-94-0x0000000000330000-0x0000000000440000-memory.dmp	dcrat
behavioral1/memory/3028-154-0x0000000000CC0000-0x0000000000DD0000-memory.dmp	dcrat
behavioral1/memory/2188-214-0x00000000012D0000-0x00000000013E0000-memory.dmp	dcrat
behavioral1/memory/2064-274-0x0000000001340000-0x0000000001450000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
952	powershell.exe
948	powershell.exe
1160	powershell.exe
1504	powershell.exe
2112	powershell.exe
1248	powershell.exe
2516	powershell.exe
944	powershell.exe
1368	powershell.exe
1640	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2132	DllCommonsvc.exe
2420	taskhost.exe
3028	taskhost.exe
2188	taskhost.exe
2064	taskhost.exe
2428	taskhost.exe
3060	taskhost.exe
2172	taskhost.exe
1108	taskhost.exe
760	taskhost.exe
944	taskhost.exe
908	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2664	cmd.exe
2664	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
29	raw.githubusercontent.com
32	raw.githubusercontent.com
35	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
18	raw.githubusercontent.com
22	raw.githubusercontent.com
25	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Uninstall Information\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\a76d7bf15d8370	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Vss\Writers\Application\taskhost.exe	DllCommonsvc.exe
File created	C:\Windows\Vss\Writers\Application\b75386f1303e64	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8ae436fb69f2909a5827dbe6839a99b6ddfaa34c8021e5f0305d5cc22680ac48.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2052	schtasks.exe
2168	schtasks.exe
1144	schtasks.exe
1884	schtasks.exe
2004	schtasks.exe
592	schtasks.exe
692	schtasks.exe
2908	schtasks.exe
1108	schtasks.exe
1760	schtasks.exe
2108	schtasks.exe
1888	schtasks.exe
2600	schtasks.exe
872	schtasks.exe
2184	schtasks.exe
2156	schtasks.exe
2220	schtasks.exe
2632	schtasks.exe
2144	schtasks.exe
2356	schtasks.exe
1492	schtasks.exe
2624	schtasks.exe
1728	schtasks.exe
2876	schtasks.exe
1736	schtasks.exe
2816	schtasks.exe
1772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2132	DllCommonsvc.exe
948	powershell.exe
2516	powershell.exe
1640	powershell.exe
1248	powershell.exe
944	powershell.exe
2112	powershell.exe
952	powershell.exe
1160	powershell.exe
1504	powershell.exe
1368	powershell.exe
2420	taskhost.exe
3028	taskhost.exe
2188	taskhost.exe
2064	taskhost.exe
2428	taskhost.exe
3060	taskhost.exe
2172	taskhost.exe
1108	taskhost.exe
760	taskhost.exe
944	taskhost.exe
908	taskhost.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	DllCommonsvc.exe
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	944	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	2420	taskhost.exe
Token: SeDebugPrivilege	3028	taskhost.exe
Token: SeDebugPrivilege	2188	taskhost.exe
Token: SeDebugPrivilege	2064	taskhost.exe
Token: SeDebugPrivilege	2428	taskhost.exe
Token: SeDebugPrivilege	3060	taskhost.exe
Token: SeDebugPrivilege	2172	taskhost.exe
Token: SeDebugPrivilege	1108	taskhost.exe
Token: SeDebugPrivilege	760	taskhost.exe
Token: SeDebugPrivilege	944	taskhost.exe
Token: SeDebugPrivilege	908	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2700	2916	JaffaCakes118_8ae436fb69f2909a5827dbe6839a99b6ddfaa34c8021e5f0305d5cc22680ac48.exe	30
PID 2916 wrote to memory of 2700	2916	JaffaCakes118_8ae436fb69f2909a5827dbe6839a99b6ddfaa34c8021e5f0305d5cc22680ac48.exe	30
PID 2916 wrote to memory of 2700	2916	JaffaCakes118_8ae436fb69f2909a5827dbe6839a99b6ddfaa34c8021e5f0305d5cc22680ac48.exe	30
PID 2916 wrote to memory of 2700	2916	JaffaCakes118_8ae436fb69f2909a5827dbe6839a99b6ddfaa34c8021e5f0305d5cc22680ac48.exe	30
PID 2700 wrote to memory of 2664	2700	WScript.exe	31
PID 2700 wrote to memory of 2664	2700	WScript.exe	31
PID 2700 wrote to memory of 2664	2700	WScript.exe	31
PID 2700 wrote to memory of 2664	2700	WScript.exe	31
PID 2664 wrote to memory of 2132	2664	cmd.exe	33
PID 2664 wrote to memory of 2132	2664	cmd.exe	33
PID 2664 wrote to memory of 2132	2664	cmd.exe	33
PID 2664 wrote to memory of 2132	2664	cmd.exe	33
PID 2132 wrote to memory of 944	2132	DllCommonsvc.exe	62
PID 2132 wrote to memory of 944	2132	DllCommonsvc.exe	62
PID 2132 wrote to memory of 944	2132	DllCommonsvc.exe	62
PID 2132 wrote to memory of 952	2132	DllCommonsvc.exe	63
PID 2132 wrote to memory of 952	2132	DllCommonsvc.exe	63
PID 2132 wrote to memory of 952	2132	DllCommonsvc.exe	63
PID 2132 wrote to memory of 1368	2132	DllCommonsvc.exe	64
PID 2132 wrote to memory of 1368	2132	DllCommonsvc.exe	64
PID 2132 wrote to memory of 1368	2132	DllCommonsvc.exe	64
PID 2132 wrote to memory of 1640	2132	DllCommonsvc.exe	65
PID 2132 wrote to memory of 1640	2132	DllCommonsvc.exe	65
PID 2132 wrote to memory of 1640	2132	DllCommonsvc.exe	65
PID 2132 wrote to memory of 1504	2132	DllCommonsvc.exe	66
PID 2132 wrote to memory of 1504	2132	DllCommonsvc.exe	66
PID 2132 wrote to memory of 1504	2132	DllCommonsvc.exe	66
PID 2132 wrote to memory of 948	2132	DllCommonsvc.exe	67
PID 2132 wrote to memory of 948	2132	DllCommonsvc.exe	67
PID 2132 wrote to memory of 948	2132	DllCommonsvc.exe	67
PID 2132 wrote to memory of 2112	2132	DllCommonsvc.exe	68
PID 2132 wrote to memory of 2112	2132	DllCommonsvc.exe	68
PID 2132 wrote to memory of 2112	2132	DllCommonsvc.exe	68
PID 2132 wrote to memory of 1248	2132	DllCommonsvc.exe	69
PID 2132 wrote to memory of 1248	2132	DllCommonsvc.exe	69
PID 2132 wrote to memory of 1248	2132	DllCommonsvc.exe	69
PID 2132 wrote to memory of 2516	2132	DllCommonsvc.exe	70
PID 2132 wrote to memory of 2516	2132	DllCommonsvc.exe	70
PID 2132 wrote to memory of 2516	2132	DllCommonsvc.exe	70
PID 2132 wrote to memory of 1160	2132	DllCommonsvc.exe	71
PID 2132 wrote to memory of 1160	2132	DllCommonsvc.exe	71
PID 2132 wrote to memory of 1160	2132	DllCommonsvc.exe	71
PID 2132 wrote to memory of 2528	2132	DllCommonsvc.exe	82
PID 2132 wrote to memory of 2528	2132	DllCommonsvc.exe	82
PID 2132 wrote to memory of 2528	2132	DllCommonsvc.exe	82
PID 2528 wrote to memory of 2728	2528	cmd.exe	84
PID 2528 wrote to memory of 2728	2528	cmd.exe	84
PID 2528 wrote to memory of 2728	2528	cmd.exe	84
PID 2528 wrote to memory of 2420	2528	cmd.exe	85
PID 2528 wrote to memory of 2420	2528	cmd.exe	85
PID 2528 wrote to memory of 2420	2528	cmd.exe	85
PID 2420 wrote to memory of 572	2420	taskhost.exe	86
PID 2420 wrote to memory of 572	2420	taskhost.exe	86
PID 2420 wrote to memory of 572	2420	taskhost.exe	86
PID 572 wrote to memory of 884	572	cmd.exe	88
PID 572 wrote to memory of 884	572	cmd.exe	88
PID 572 wrote to memory of 884	572	cmd.exe	88
PID 572 wrote to memory of 3028	572	cmd.exe	89
PID 572 wrote to memory of 3028	572	cmd.exe	89
PID 572 wrote to memory of 3028	572	cmd.exe	89
PID 3028 wrote to memory of 2596	3028	taskhost.exe	90
PID 3028 wrote to memory of 2596	3028	taskhost.exe	90
PID 3028 wrote to memory of 2596	3028	taskhost.exe	90
PID 2596 wrote to memory of 2220	2596	cmd.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ae436fb69f2909a5827dbe6839a99b6ddfaa34c8021e5f0305d5cc22680ac48.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ae436fb69f2909a5827dbe6839a99b6ddfaa34c8021e5f0305d5cc22680ac48.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\Application\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.7.0_80\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\StXPigBvZL.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2528
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2728
      - C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2qVagYZlTM.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:572
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:884
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Bf5uratM3O.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2220
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QtXcZTVakC.bat"
        11⤵
        
        PID:2892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1008
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat"
        13⤵
        
        PID:1724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2616
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Bp0TjAk7l7.bat"
        15⤵
        
        PID:2168
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1876
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8RIE4o2SCx.bat"
        17⤵
        
        PID:2860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2708
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gQkyN2upze.bat"
        19⤵
        
        PID:1344
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2696
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MXvuXcjR4o.bat"
        21⤵
        
        PID:560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:288
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat"
        23⤵
        
        PID:2992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3016
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lg1oIatdTn.bat"
        25⤵
        
        PID:3000
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1772
        
        C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe
        
        "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Templates\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Default\Templates\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Templates\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Uninstall Information\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Uninstall Information\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Windows\Vss\Writers\Application\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Application\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Windows\Vss\Writers\Application\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Application Data\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Application Data\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jdk1.7.0_80\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jdk1.7.0_80\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d561a6ac4c0546242b91f6d15719bb90

SHA1
138bfc9df97f06019a43162a1f7bc0548324dfee

SHA256
383cfd60c94510161f657fa27c4b2bf0880d35c6cee3ccdb3a080479e88667cf

SHA512
584a0fa2cf371825d1d9dedb867d2747dd500701cbb6e9cfe31545c1f3c8f53d48533646d96e5d9861df60e51193917cd1558eda578385b38f1403d815a5852b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4121fe30ea3041e4b84d1f6bd8f9b741

SHA1
20060a8a8dadd7d031ede9c8f71e320d504b325b

SHA256
0fb5ad52db684340b14b09938ac4c13e02a184f6c327703c5e6c68ff197eee37

SHA512
a9b398dbe0148ce05aa1692704cd25bfa2ee2876a79c961490ceaa7329b1c6381f3188f6d09ab74fb40c44f879af2be6b2781891e3ac8c0bbd0e79438e09143a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32c3ebf9e36c2016ae89f63d1b423b77

SHA1
793ee5d2fdef151d026038296e5cc4370494e585

SHA256
3ed6eb1153ab4a1dfbf6a47ed8fbf7acc46e2884d204d9f91962bb15ba01a1c8

SHA512
91c753d09270a180a95c93a9ad468c74bec17b3faca1e9cbb54256ba7ebab1a10762fa88875a1f33b522b937394718e220dfd19a46757b9b913a7291e94e6adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e675e490372282e153b149feec66239

SHA1
c29ec5b73094af6da90a8a2b8ff08f057116ca91

SHA256
5e5810a12afad91801473cc3180923524cd85e9f6b0c56b27e1bacc95c479174

SHA512
22cafbf788ef635cb69608854dd5f3ec4a47e136ee7496aa1a9dc43aa1589eeaed0649f5d9ee0a08f99ca733eb32878cee04335395aaa3c48cb37168a992be14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c306ef1b654d80b589e6003640be5d0b

SHA1
900b81ca83746a6063abd74cbae1bce66b3f9350

SHA256
26917c0741765d762f9066c51132ad04bcdf79052af4d3776428e48297d7cbf7

SHA512
b2259248adde3c5f9a3435857751820bf1d01560b2ef848981d60a0299bc36adbe379d35cb7a5912b3aa9bbc1127a81e1fcdfbd306d19fb7d711e91439797fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e665b410bb2ba79c770cb8451aa78eb6

SHA1
161c9b337a91b1dbdf59b050cdefc7805accf99f

SHA256
0fde19f2e6e14fd8ff121c7599a3a3c69e071e241172925d831fe4ae2c7eaf9b

SHA512
7f5bb6c1bd1a3ae436c2aa2987c0e1b917f3f02c3e79fa07a8921bc7d6ee56728d8ff70cf195fbc90c7afb0f6d99c959d0df6c384dca7028ca837f656ce55e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2638ce09b15e020f0c46569bcc99a56

SHA1
f36bd8240a20dd424214d04f241cfb7b6e59eb6b

SHA256
944ecf6469ec0d4ccb010276a61e537d6eca48ac3624f9de96f5d51be6976d63

SHA512
812524503f702d584b719cdf0de43378e1246865b2341624c9c2328834e8bec6a2daa2129419ebf3e07a27ca5a5a1e918d513f4b7498e1294ea10cf14e7f6a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
137688301321d9fb5950f9ac50817c66

SHA1
01942b465bece938080b31e5332ced992c555e98

SHA256
b02ee11b4cc8ba4c6bd2ac40ccbd009dbb904d025dc879a539b0db84f145755f

SHA512
cf237ed953a2e7f317c8f10ab1f578ef21ff62ecb34b1ebd66c495a37a2c96cddc00e16da4e22772936ea42f1134508d03143da5dd22783f2d721ab0010e2148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ee59190ec8f062eb5b17461ee174282

SHA1
e376cced060f6376c6e5cb18891adb9bbadaa3dd

SHA256
a07d49200afe27e3773114554bed6eb07bcaeba4fc0cb9df57f8a33d433982f0

SHA512
5af96c306fb6c4db4c1591bfe1b5862402e8c7cce986826554f6f0a50fa1c9cd49f39f3a764d2b41f17e1e6e5c9811e853b85fd6e79dcab988b2a0c4cf0d94ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\2qVagYZlTM.bat

Filesize
226B

MD5
01597178dc1cba0099f71e9852ef6284

SHA1
db67e229d1a1b831619d2fc377a16f5a50b60317

SHA256
35d7f3fc89313dee087f11c8340191b97061f44777613f1d26656f604e9c3938

SHA512
a1b9277422e061b315d76333709a6006fcbcee8c15d6e81d8ebbe54f0440ae61a9e6174a4d90762d9975c3ed8832ab08dbd3eeee44f284ede890dd9a76303c4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8RIE4o2SCx.bat

Filesize
226B

MD5
f2fc1f555a9224b210aaf6f74c471a32

SHA1
dd10cc50aac45ff8386cc6587f0a0bef15866e3a

SHA256
721f73be2c0f39d699ce0206bd4fcc748bb5e03b6b0968bf0a909920b215abc5

SHA512
3c8974cc90744862979a9e0efd4c207e4402b5ae3f876a9ad3d6f9bd8d51185bb01be3a86d4d884b4c4f24ec0d0540d2cf6273dbd420e5c45dcd3c7a56164777

Download Submit
C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat

Filesize
226B

MD5
56a43eb4ed130731cb57fd716432e9ea

SHA1
ee897f5f39541cf1579228570a7576bda0290338

SHA256
211fad44598500e9aa768b11e6a54755c0ed53f405ee561f86317ae1ce442afd

SHA512
54973f7613bc1e3f5aaa6258fc9c17b922ba08e13c143db8284db435576f31a7354e420c98f682e538b896446c03b7e37266dadb65e7ca23c2e73d8c9d0f82da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bf5uratM3O.bat

Filesize
226B

MD5
4e480b03e8b77e77af16e4790db9a926

SHA1
30541e5415a8be1adb887816d0a153b89c59a510

SHA256
43b4cf273b19d47498c9781b8f4bcf1da7d22d035b1235a0deb092f865fa24e4

SHA512
ddc186ccfbe3c866950083715f71ef0834c32966d01927f49cc6248996c2eb67ebe1076c4b669782e3a0343325d9caec85b9e6228cc93cf0f14e7b656ec66a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bp0TjAk7l7.bat

Filesize
226B

MD5
5446c313f8a2fac505ff213139d16268

SHA1
5ffa3fb100b3e0c3ffebc1bdb67516093d47ca2a

SHA256
d410690d7eed5dfb5c55616eb86910ce8588b82f9c07943a3baff9cbc069e9d7

SHA512
9a86eacf443e956f3b30154874925efe695fca497a092786b534725021fa22c67b7ab2d18d1d287022c6a385dcb7383ea5b49e474c86e81d7797c13c55207c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4ECE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MXvuXcjR4o.bat

Filesize
226B

MD5
827c235a425898f590c0a5ea61239dad

SHA1
b5d1296cffde9277f95f4c924b7fa7d320e8ec36

SHA256
2250ff413a08f2c5b08b13aa03953bc9a07013a20e4e73c97a06f93b1600dabd

SHA512
4163cea8c5bd3e984ce11100461a91e35e8af2cf6ee8252814935f4fd9083ffa751796547b4457f2ad7ff612304cc5a715bcc9556a3e78d06b1297227cda59bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\QtXcZTVakC.bat

Filesize
226B

MD5
1edcee211dc97b66b53417c9da1b7b14

SHA1
6485336ce3ab655fa1d5cfd5f18fab583cbc5c6b

SHA256
84f2617ae7799eabc160ff07ec3b8daaaefd78a757d456ba3f6597cfe31f77a1

SHA512
6c6a45f917efd2cf7d3d0b0763a9583be90e7e475b724879c4ca48f651491f58c4e2df2201a19f39845c613f6c76f449046dd5c3db5c561e4bc838acbae3d105

Download Submit
C:\Users\Admin\AppData\Local\Temp\StXPigBvZL.bat

Filesize
226B

MD5
25a2b88edb95ca5684300d6a9a345398

SHA1
120793301ea6cd85cdf9c9f738a0896df74d1b0e

SHA256
1346d9e1c590981be2a9967559ab30f6907869303512defd18c3fd8f58be9505

SHA512
4b441061ee5ee918704b694d0ec7e389dfb3dff508f73c238fbc0ce984ad39877c423c53665ea7000223e5a998a231146dde40424a2d669082afad7897af6195

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4EE0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gQkyN2upze.bat

Filesize
226B

MD5
c53031831af1a55a0767f1761ca99957

SHA1
a8921e343e4bc1a832bb005a885e41cfe42f12cb

SHA256
892dbdd4798fafb896649a9e58b1f258843c9e6b217e5e2d72b0e6ec52b35f57

SHA512
f9740f5d65fd0017821de2fab3218a6dff147946f13ae7379c45c1e8acfaf19b4f4b3adc0caa86c9fb495cec47c618e4ff015aab81ff4435e3a5cbf11dc856a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lg1oIatdTn.bat

Filesize
226B

MD5
cc55e54428e4d3a413c3e2a1872856e5

SHA1
b7708b19b9066349758052002c31e390bf5193af

SHA256
2dc2cfc6cd2270897fc992307f20b260e05c25f61d72a67665922db5630439a2

SHA512
5a121fec01efae1076138e0e0b72f1c50e782ee832e718b3d2c4bcbefadcb2b71571d04c9addc2aec83abeceb54280070e8de3e9c3fbe6da9af6e0e6cae1b17c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c2b1af2d85a2d6122bd5842aca00eeeb

SHA1
59b0d7646b9372b9cb17cb221d3110ccf320c64f

SHA256
e0de83ceb2236802ad61967c419dfa68e27b29d1a644b54317f46a714bfc68e0

SHA512
7cae2ba970ba9bf32326a622e9d104f064d0af7a22099d46c74f9c62e13c9bd6a5685ff2c3893b16ba484ce320276ce25101f0814b85864b93814b640d352a7d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/760-571-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/948-70-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/948-69-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/1108-511-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2064-274-0x0000000001340000-0x0000000001450000-memory.dmp

Filesize
1.1MB

Download
memory/2132-17-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Filesize
48KB

Download
memory/2132-14-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/2132-15-0x00000000006F0000-0x00000000006FC000-memory.dmp

Filesize
48KB

Download
memory/2132-13-0x0000000000F10000-0x0000000001020000-memory.dmp

Filesize
1.1MB

Download
memory/2132-16-0x0000000000A10000-0x0000000000A1C000-memory.dmp

Filesize
48KB

Download
memory/2188-214-0x00000000012D0000-0x00000000013E0000-memory.dmp

Filesize
1.1MB

Download
memory/2420-94-0x0000000000330000-0x0000000000440000-memory.dmp

Filesize
1.1MB

Download
memory/2420-95-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/3028-154-0x0000000000CC0000-0x0000000000DD0000-memory.dmp

Filesize
1.1MB

Download