dcrat | bfac480ee3ffd092e40911063ee3d9fca61de375f36639a13ae85c911a5cfca8

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_bfac480ee3ffd092e40911063ee3d9fca61de375f36639a13ae85c911a5cfca8.exe
Size

1.3MB
MD5

a9386d5619251ec9dc08114b772b97ea
SHA1

0b599bd41b77d3800be04e8cfb9d9d2dac672232
SHA256

bfac480ee3ffd092e40911063ee3d9fca61de375f36639a13ae85c911a5cfca8
SHA512

c7af769a5d493ae5f65f98e77a5921b3549403280c8e4915cd60d9d4671a614c6d467fa077166263aeb83b6e7618d612e631e857b554a03a832d2181730efcd2
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	2792	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2792	schtasks.exe	33

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00070000000186c3-9.dat	dcrat
behavioral1/memory/2780-13-0x0000000000D60000-0x0000000000E70000-memory.dmp	dcrat
behavioral1/memory/900-105-0x0000000000DA0000-0x0000000000EB0000-memory.dmp	dcrat
behavioral1/memory/1732-165-0x0000000000F10000-0x0000000001020000-memory.dmp	dcrat
behavioral1/memory/1936-284-0x0000000001220000-0x0000000001330000-memory.dmp	dcrat
behavioral1/memory/2672-344-0x00000000003A0000-0x00000000004B0000-memory.dmp	dcrat
behavioral1/memory/1728-405-0x0000000000AE0000-0x0000000000BF0000-memory.dmp	dcrat
behavioral1/memory/2104-465-0x0000000001250000-0x0000000001360000-memory.dmp	dcrat
behavioral1/memory/2656-585-0x0000000001360000-0x0000000001470000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
624	powershell.exe
956	powershell.exe
2104	powershell.exe
1588	powershell.exe
940	powershell.exe
1556	powershell.exe
1368	powershell.exe
2488	powershell.exe
2068	powershell.exe
1292	powershell.exe
2492	powershell.exe
1564	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2780	DllCommonsvc.exe
900	DllCommonsvc.exe
1732	DllCommonsvc.exe
1968	DllCommonsvc.exe
1936	DllCommonsvc.exe
2672	DllCommonsvc.exe
1728	DllCommonsvc.exe
2104	DllCommonsvc.exe
2836	DllCommonsvc.exe
2656	DllCommonsvc.exe
928	DllCommonsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
2508	cmd.exe
2508	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
30	raw.githubusercontent.com
4	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
34	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\winlogon.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\ja-JP\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\ja-JP\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\5940a34987c991	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Vss\Writers\System\56085415360792	DllCommonsvc.exe
File created	C:\Windows\TAPI\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\TAPI\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Windows\Vss\Writers\System\wininit.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bfac480ee3ffd092e40911063ee3d9fca61de375f36639a13ae85c911a5cfca8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2696	schtasks.exe
2944	schtasks.exe
316	schtasks.exe
1944	schtasks.exe
2560	schtasks.exe
2084	schtasks.exe
668	schtasks.exe
2752	schtasks.exe
2240	schtasks.exe
2656	schtasks.exe
2688	schtasks.exe
2912	schtasks.exe
988	schtasks.exe
2032	schtasks.exe
1156	schtasks.exe
1936	schtasks.exe
2172	schtasks.exe
3048	schtasks.exe
912	schtasks.exe
1036	schtasks.exe
2516	schtasks.exe
1748	schtasks.exe
1712	schtasks.exe
1644	schtasks.exe
1460	schtasks.exe
2832	schtasks.exe
2968	schtasks.exe
2684	schtasks.exe
2368	schtasks.exe
1280	schtasks.exe
1776	schtasks.exe
2500	schtasks.exe
2096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2780	DllCommonsvc.exe
940	powershell.exe
2104	powershell.exe
2492	powershell.exe
1588	powershell.exe
1564	powershell.exe
2068	powershell.exe
1368	powershell.exe
2488	powershell.exe
956	powershell.exe
624	powershell.exe
1292	powershell.exe
1556	powershell.exe
900	DllCommonsvc.exe
1732	DllCommonsvc.exe
1968	DllCommonsvc.exe
1936	DllCommonsvc.exe
2672	DllCommonsvc.exe
1728	DllCommonsvc.exe
2104	DllCommonsvc.exe
2836	DllCommonsvc.exe
2656	DllCommonsvc.exe
928	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	DllCommonsvc.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	900	DllCommonsvc.exe
Token: SeDebugPrivilege	1732	DllCommonsvc.exe
Token: SeDebugPrivilege	1968	DllCommonsvc.exe
Token: SeDebugPrivilege	1936	DllCommonsvc.exe
Token: SeDebugPrivilege	2672	DllCommonsvc.exe
Token: SeDebugPrivilege	1728	DllCommonsvc.exe
Token: SeDebugPrivilege	2104	DllCommonsvc.exe
Token: SeDebugPrivilege	2836	DllCommonsvc.exe
Token: SeDebugPrivilege	2656	DllCommonsvc.exe
Token: SeDebugPrivilege	928	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2256	1048	JaffaCakes118_bfac480ee3ffd092e40911063ee3d9fca61de375f36639a13ae85c911a5cfca8.exe	29
PID 1048 wrote to memory of 2256	1048	JaffaCakes118_bfac480ee3ffd092e40911063ee3d9fca61de375f36639a13ae85c911a5cfca8.exe	29
PID 1048 wrote to memory of 2256	1048	JaffaCakes118_bfac480ee3ffd092e40911063ee3d9fca61de375f36639a13ae85c911a5cfca8.exe	29
PID 1048 wrote to memory of 2256	1048	JaffaCakes118_bfac480ee3ffd092e40911063ee3d9fca61de375f36639a13ae85c911a5cfca8.exe	29
PID 2256 wrote to memory of 2508	2256	WScript.exe	30
PID 2256 wrote to memory of 2508	2256	WScript.exe	30
PID 2256 wrote to memory of 2508	2256	WScript.exe	30
PID 2256 wrote to memory of 2508	2256	WScript.exe	30
PID 2508 wrote to memory of 2780	2508	cmd.exe	32
PID 2508 wrote to memory of 2780	2508	cmd.exe	32
PID 2508 wrote to memory of 2780	2508	cmd.exe	32
PID 2508 wrote to memory of 2780	2508	cmd.exe	32
PID 2780 wrote to memory of 2068	2780	DllCommonsvc.exe	67
PID 2780 wrote to memory of 2068	2780	DllCommonsvc.exe	67
PID 2780 wrote to memory of 2068	2780	DllCommonsvc.exe	67
PID 2780 wrote to memory of 1292	2780	DllCommonsvc.exe	68
PID 2780 wrote to memory of 1292	2780	DllCommonsvc.exe	68
PID 2780 wrote to memory of 1292	2780	DllCommonsvc.exe	68
PID 2780 wrote to memory of 2492	2780	DllCommonsvc.exe	69
PID 2780 wrote to memory of 2492	2780	DllCommonsvc.exe	69
PID 2780 wrote to memory of 2492	2780	DllCommonsvc.exe	69
PID 2780 wrote to memory of 1564	2780	DllCommonsvc.exe	70
PID 2780 wrote to memory of 1564	2780	DllCommonsvc.exe	70
PID 2780 wrote to memory of 1564	2780	DllCommonsvc.exe	70
PID 2780 wrote to memory of 624	2780	DllCommonsvc.exe	71
PID 2780 wrote to memory of 624	2780	DllCommonsvc.exe	71
PID 2780 wrote to memory of 624	2780	DllCommonsvc.exe	71
PID 2780 wrote to memory of 956	2780	DllCommonsvc.exe	72
PID 2780 wrote to memory of 956	2780	DllCommonsvc.exe	72
PID 2780 wrote to memory of 956	2780	DllCommonsvc.exe	72
PID 2780 wrote to memory of 2104	2780	DllCommonsvc.exe	73
PID 2780 wrote to memory of 2104	2780	DllCommonsvc.exe	73
PID 2780 wrote to memory of 2104	2780	DllCommonsvc.exe	73
PID 2780 wrote to memory of 940	2780	DllCommonsvc.exe	74
PID 2780 wrote to memory of 940	2780	DllCommonsvc.exe	74
PID 2780 wrote to memory of 940	2780	DllCommonsvc.exe	74
PID 2780 wrote to memory of 1556	2780	DllCommonsvc.exe	75
PID 2780 wrote to memory of 1556	2780	DllCommonsvc.exe	75
PID 2780 wrote to memory of 1556	2780	DllCommonsvc.exe	75
PID 2780 wrote to memory of 1368	2780	DllCommonsvc.exe	76
PID 2780 wrote to memory of 1368	2780	DllCommonsvc.exe	76
PID 2780 wrote to memory of 1368	2780	DllCommonsvc.exe	76
PID 2780 wrote to memory of 1588	2780	DllCommonsvc.exe	77
PID 2780 wrote to memory of 1588	2780	DllCommonsvc.exe	77
PID 2780 wrote to memory of 1588	2780	DllCommonsvc.exe	77
PID 2780 wrote to memory of 2488	2780	DllCommonsvc.exe	78
PID 2780 wrote to memory of 2488	2780	DllCommonsvc.exe	78
PID 2780 wrote to memory of 2488	2780	DllCommonsvc.exe	78
PID 2780 wrote to memory of 3064	2780	DllCommonsvc.exe	91
PID 2780 wrote to memory of 3064	2780	DllCommonsvc.exe	91
PID 2780 wrote to memory of 3064	2780	DllCommonsvc.exe	91
PID 3064 wrote to memory of 2872	3064	cmd.exe	93
PID 3064 wrote to memory of 2872	3064	cmd.exe	93
PID 3064 wrote to memory of 2872	3064	cmd.exe	93
PID 3064 wrote to memory of 900	3064	cmd.exe	94
PID 3064 wrote to memory of 900	3064	cmd.exe	94
PID 3064 wrote to memory of 900	3064	cmd.exe	94
PID 900 wrote to memory of 2776	900	DllCommonsvc.exe	95
PID 900 wrote to memory of 2776	900	DllCommonsvc.exe	95
PID 900 wrote to memory of 2776	900	DllCommonsvc.exe	95
PID 2776 wrote to memory of 1384	2776	cmd.exe	97
PID 2776 wrote to memory of 1384	2776	cmd.exe	97
PID 2776 wrote to memory of 1384	2776	cmd.exe	97
PID 2776 wrote to memory of 1732	2776	cmd.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bfac480ee3ffd092e40911063ee3d9fca61de375f36639a13ae85c911a5cfca8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bfac480ee3ffd092e40911063ee3d9fca61de375f36639a13ae85c911a5cfca8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\ja-JP\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\System\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8okcwczJrd.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2872
      - C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AKY6NrPTox.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1384
        
        C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1CKPPXbanu.bat"
        9⤵
        
        PID:1116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1940
        
        C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J6LEBq1ChC.bat"
        11⤵
        
        PID:2192
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2752
        
        C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAWHCtE00Z.bat"
        13⤵
        
        PID:2100
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1680
        
        C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat"
        15⤵
        
        PID:2324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2316
        
        C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat"
        17⤵
        
        PID:236
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1588
        
        C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ph6jqiBtuj.bat"
        19⤵
        
        PID:868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2856
        
        C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9ncYvmuuF5.bat"
        21⤵
        
        PID:2368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2384
        
        C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat"
        23⤵
        
        PID:1556
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1016
        
        C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\ja-JP\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\ja-JP\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\ja-JP\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\System\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\Vss\Writers\System\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\TAPI\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Uninstall Information\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e408d5bb6004635beabf4ef86d141442

SHA1
dd318c3cddebdcebb6d6bc038ac12954f1cd4a19

SHA256
271b751fb5134b7db8efab07b9a9924288d64211df0b2eb460ffd5ef0c4e6478

SHA512
efd71a18fe7ca8e6241d054e8b87b4f0c9b476322fe587e1162bad652ba435493a164a580f4bc7d7558329d3e829a994cd1327dbda42e8fed9c9dd0809631847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40a921c98946fc8c3b31f7e05143cd98

SHA1
ccc72f2795f797302e04392382bcfc87b457bfb0

SHA256
71e17b0c03f0016392b118c41e511ffebd41ec56f25920dbd988462281be5098

SHA512
c0273a519ba68c33167035985a9048baa755ee66c7bafce64f57e6faef3b26ca8bb277ee48266271477eb40f7d2415f2af6e5811a13b2a5b6659924f3a0bd7fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ceeac36274128e7dd4cf50bd913c6f1

SHA1
edecd294af5f422734bc2eb2e994769b0209d3af

SHA256
1d84b577b941a234d1774b28dee36c882c9420edf077aabdd96c107152c89566

SHA512
b2b2e9e1621e068f84a2fb661a7fc55f31dc02fc503a9ea1027ba967d545935d3823f101cf7e9a323d2caf6b03263da78283b4d4540f612bea68586a27df2b69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6717412689cc00a1f5f56b8e2e2dfe25

SHA1
20fce5f51be33661f2b471e8731ca54edaa1d23c

SHA256
93695093db02db6588b47047b3a4ef3df41cc7e4e5f79835972de55265b7d6e9

SHA512
efd99a9057faebed2d47277213922c0049a9341c40058aef7a2569d5c3a4eb567852ab6b0842d17514e5a4043325761f58e09aa43f54b42ee48c6d1f01b2d607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f3d677129d6dae2a58a3f57920090ce

SHA1
1454e1faf274e28ef3f001d13671333b8a952aea

SHA256
cd399cfe5524132e6cb439834393a4213443785d4587d5f463574d624bd19167

SHA512
01fc36a23c5481aae645c19937981c18fac55b97f3b4e26dfb45028062513459cb2ff8ab12a0a9c71df69daff3417ae2b8053fcaf15245d8127a0158a892887c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63396f923350d26a5a1b98a0c902e73f

SHA1
e552dfdf7f7c19c69d99154bdddef85e1780cff0

SHA256
a48c332a4e725e86f4420114502bccfd40e33af3aea6dd34dac62670d26087f5

SHA512
7cd99c2d50ee0015dc8e2d03e72b40d15a50114c0b5282126ca30a4d57f3f1b429fa386deb9e23008b1889f25e977d40cef0507f662170f959cda88a6f58f80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb87b82c695093c55c5be6b20e91c68c

SHA1
861ae8365b52deb409ebad6ec899f00ec8b8aaa3

SHA256
bc9743a17c62fad8d3652d8eed2e3ad25cfc392a25ea776db8c8567498736dfb

SHA512
2a6d47a25de8b3821345aa26634ca476d30f098291011f2d01624c77f3b0c4d103d0067a8d7bc4b343e156142aea61cf00ce7dbcfd96ab50eba0cfc67b9135cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a60ac1ebc5be0caa620cf29a1f5f6714

SHA1
6c2285b26fc4936b8eb4227766b93e24cdbfad03

SHA256
e1aa923e609e46ca035ccc598b3e63f6b084cd82554bcbd58c551395539c48e5

SHA512
bc4ac1a3d25d98df2ca1f0071b628b68496a5f4f784e40710cfb0332206fbb7d1adc71bb7dfd412004b6faa99d7180d9bfbc8dfc7dc5b19c8b763ea3a334ff7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\0rnbwo7iYS.bat

Filesize
226B

MD5
4bcdd4a9a844d414cb0d02e5f6dadd80

SHA1
276a7a51e48b3d29dff0d2ddd483d98412c73fc9

SHA256
0e40d08d70a0684e4911b25713c2e8949eb52cde73051bdea22461f2d0f70fb0

SHA512
eea2be7d546ecc8cc41d0da35bc880094510d86627d42374ff0d39b0c999dae9b9e2676fde024d2f5818105b283ffbd29057d46cb4d8a00d4647551d017b05cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1CKPPXbanu.bat

Filesize
226B

MD5
b42aa1c3c0ca151a85472e1b4384b778

SHA1
7b18000a227dae380af257d8fc47f01409b8a56f

SHA256
d5b83ac79665818fdc028174341e0940087d6fc888592169fe6531c34648237f

SHA512
637e6e732f6d585ed9b5cff1af3ed448ef77e2e8ef74d9ae59bdd3105125022ddbff5c048ba93e0d37f0fea8e3f59367b79a5f3a50d7c6bdf82ccbe35fe14a7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\8okcwczJrd.bat

Filesize
226B

MD5
b86aa1a62a6fc75b0eb5172a7d4d6a4b

SHA1
e76690e24ccbcdb3feb5eace3588745509c47b60

SHA256
813e61a9346968561886dcdcdb1a9333ac03b5a508e304bc098d50f24366c555

SHA512
c4a7bd25b64e19dce7617646722cbba8e8998bcd142c51d516cd21dabf759cd69595bf000cb254a64ee6b82ddb76b6369eb86a404db7b7d51da76597fc1ad7c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ncYvmuuF5.bat

Filesize
226B

MD5
6f2774f07c5a798daa73b7235eb73199

SHA1
57c546cd5748e14845b17803a598bef453cf245d

SHA256
026c91811eb1fd9bdee4d39a5d2ccaf2051df26f040a8687034831acbdc0a1e6

SHA512
51036b82f267fda519c572527a65490fa8b411d52db04da5a207d33b19142f8d6bd451168149ee5258b005942a57307286cb12f0fbdcf62a97f881544af9c03a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AKY6NrPTox.bat

Filesize
226B

MD5
0825b7a7d5ce68043079f81a245c37b9

SHA1
0e8281c2ed25268abaa5dc45325192e0d7122965

SHA256
cd64fcc0f351f890d20fd643875b1c68b6338ead56a337d5f00bad507bc73c01

SHA512
a17daed495bd60d6c58047b0aa3e82133e7c47117759c23be1733ae28104aa5c3e2f0f3a3e15d691ec063785cd5e0d6bae968adb3f2fc5bf371665f403731762

Download Submit
C:\Users\Admin\AppData\Local\Temp\BAWHCtE00Z.bat

Filesize
226B

MD5
746361bd532db2f941fab3562c6ea82a

SHA1
752cc5b9599ce8eecd755e6e09e89b8d12277aa8

SHA256
1d1f8ba9bdff438d7df665a7fb6a645f8a230cd7d69feae642145220b13f6864

SHA512
a19c9ded22ae5c20b3d4d64ea0fd3b2e6c02d7c4edbe3440d6b24e128d7062313cecbae34045ba2ff332d82d8a75b2503bda4aae38924462169a5c9fcee2773f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3239.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\J6LEBq1ChC.bat

Filesize
226B

MD5
35442a912d5342056018204d910c69e3

SHA1
94e8f1f60779d2756c495c498d093171a2f2f0c8

SHA256
ad50912d8c1b3a5d2db16d03b57b298ca5a7bcc4073f719b92198fca7a12f74f

SHA512
41182abacc7e0e33fe20e974b82f6c47272546c3c26b01c09cd97a3f19e8c81f27d6d1fbcff4cab5005e2909b801f210f8f9220894bd0b426cd960cbf7075e5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar325B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat

Filesize
226B

MD5
9e4ae8a3d4a1529e5aa7f37c44c9205f

SHA1
7242cdea76843059303f18fa7fe12539103b83a4

SHA256
3b8a17258f59967f52e32956ea687f6a3081e8dbc80607d4e078c232b9d3e343

SHA512
90722f3c0c4ecb16ea80ab43766bbf7f99bf4e89302acf4339453304ba3e82c492c77c523f4f75f029dfd7c92bbe35132c347559e35569d817f118af46bb5cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\aMI81VmL1g.bat

Filesize
226B

MD5
ffc4042aa5320d157f6a7d8c40be7a28

SHA1
e6be4ddff3161d770cfc26ba47621c24b80a5570

SHA256
f8a8e550a404ff9fad3e7102418358ada4493bd2ba355d2a3e929436986cdbf8

SHA512
8d871b7ba5345d49f5c7668bea7a75d083fc5dbc6472452f846caf6976db5afbf981906f24a1b4f65f128505dc7d9e7361526a0e51f4f0558436487b238375da

Download Submit
C:\Users\Admin\AppData\Local\Temp\ph6jqiBtuj.bat

Filesize
226B

MD5
bbb3204289538db7f4a1b886003ca84c

SHA1
97d699090ae198b28f96779facca1bda0acb0d2d

SHA256
b1192314adb155f77cdd55afe2517725eba8aef6f40f94e98bc99f825aebae56

SHA512
3d62045d2006dc4c8058da06a4137447f71365b809da9caa3f833fe4ca99da3193203e81b840f2fe3d78d8028cf5c3fc9358d3ae94efbda2d405b80b4622b041

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OCSPM95YLETN0B1Z30MI.temp

Filesize
7KB

MD5
fea70e84ad4efdebe126729f30fd68fd

SHA1
b1be346290df27a1dab27cdde320fb9c94ec6e39

SHA256
4cf901d991d51073c87f0226b1ef37a0cfdf53d953f0e92417e9b02fa026fb6a

SHA512
c722564e33f77614d94c4ea41cf24451730a02d0ca3f8e29204b515487b7ca28b7d3e8130e456a8b5852ac6de30c970e592b3ef4127592f6f2ab6eb539687fe0

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/900-105-0x0000000000DA0000-0x0000000000EB0000-memory.dmp

Filesize
1.1MB

Download
memory/900-106-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/940-70-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/1588-69-0x000000001B460000-0x000000001B742000-memory.dmp

Filesize
2.9MB

Download
memory/1728-405-0x0000000000AE0000-0x0000000000BF0000-memory.dmp

Filesize
1.1MB

Download
memory/1732-165-0x0000000000F10000-0x0000000001020000-memory.dmp

Filesize
1.1MB

Download
memory/1936-284-0x0000000001220000-0x0000000001330000-memory.dmp

Filesize
1.1MB

Download
memory/2104-465-0x0000000001250000-0x0000000001360000-memory.dmp

Filesize
1.1MB

Download
memory/2656-585-0x0000000001360000-0x0000000001470000-memory.dmp

Filesize
1.1MB

Download
memory/2672-345-0x00000000005E0000-0x00000000005F2000-memory.dmp

Filesize
72KB

Download
memory/2672-344-0x00000000003A0000-0x00000000004B0000-memory.dmp

Filesize
1.1MB

Download
memory/2780-13-0x0000000000D60000-0x0000000000E70000-memory.dmp

Filesize
1.1MB

Download
memory/2780-14-0x0000000000330000-0x0000000000342000-memory.dmp

Filesize
72KB

Download
memory/2780-17-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2780-15-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/2780-16-0x00000000003C0000-0x00000000003CC000-memory.dmp

Filesize
48KB

Download
memory/2836-525-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download