dcrat | 1941b357d89fd7fbe6bdf975f25208c79c449de5f273a7b4ee9c9026ce4fe99b

Analysis

max time kernel
144s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1941b357d89fd7fbe6bdf975f25208c79c449de5f273a7b4ee9c9026ce4fe99b.exe
Size

1.3MB
MD5

ed2d9ea27366bb2e7dde45eb585f6ef4
SHA1

dc1a8dc204be3a150dd8520875ea8c6d99431780
SHA256

1941b357d89fd7fbe6bdf975f25208c79c449de5f273a7b4ee9c9026ce4fe99b
SHA512

6c4baaa9ea642859706c7e62a4ed849287bd5802bc2f0c71272e7126c706fa9aa997db2e880309da68fbc1e6fecdd7d4930fc20f2756a9bca95ad65274e42f3b
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2096	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2096	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016d30-9.dat	dcrat
behavioral1/memory/2728-13-0x0000000000B20000-0x0000000000C30000-memory.dmp	dcrat
behavioral1/memory/2752-80-0x0000000000D60000-0x0000000000E70000-memory.dmp	dcrat
behavioral1/memory/2352-198-0x00000000000C0000-0x00000000001D0000-memory.dmp	dcrat
behavioral1/memory/1000-259-0x0000000001000000-0x0000000001110000-memory.dmp	dcrat
behavioral1/memory/2264-380-0x0000000001340000-0x0000000001450000-memory.dmp	dcrat
behavioral1/memory/1732-618-0x0000000000180000-0x0000000000290000-memory.dmp	dcrat
behavioral1/memory/2396-678-0x0000000000100000-0x0000000000210000-memory.dmp	dcrat
behavioral1/memory/2592-738-0x0000000000910000-0x0000000000A20000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2228	powershell.exe
2112	powershell.exe
408	powershell.exe
2284	powershell.exe
2164	powershell.exe
1876	powershell.exe
2392	powershell.exe
2124	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2728	DllCommonsvc.exe
2752	taskhost.exe
2208	taskhost.exe
2352	taskhost.exe
1000	taskhost.exe
2772	taskhost.exe
2264	taskhost.exe
2496	taskhost.exe
1108	taskhost.exe
820	taskhost.exe
1732	taskhost.exe
2396	taskhost.exe
2592	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2572	cmd.exe
2572	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
37	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
22	raw.githubusercontent.com
26	raw.githubusercontent.com
33	raw.githubusercontent.com
40	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
29	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\de-DE\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\de-DE\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\Setup\State\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\Setup\State\cc11b995f2a76d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1941b357d89fd7fbe6bdf975f25208c79c449de5f273a7b4ee9c9026ce4fe99b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2216	schtasks.exe
2844	schtasks.exe
3020	schtasks.exe
1808	schtasks.exe
2016	schtasks.exe
1156	schtasks.exe
2788	schtasks.exe
2968	schtasks.exe
1352	schtasks.exe
320	schtasks.exe
2204	schtasks.exe
644	schtasks.exe
2536	schtasks.exe
660	schtasks.exe
2068	schtasks.exe
2144	schtasks.exe
2952	schtasks.exe
1928	schtasks.exe
2640	schtasks.exe
536	schtasks.exe
2532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2728	DllCommonsvc.exe
2728	DllCommonsvc.exe
2728	DllCommonsvc.exe
2728	DllCommonsvc.exe
2728	DllCommonsvc.exe
1876	powershell.exe
2392	powershell.exe
2124	powershell.exe
2112	powershell.exe
2228	powershell.exe
2164	powershell.exe
408	powershell.exe
2284	powershell.exe
2752	taskhost.exe
2208	taskhost.exe
2352	taskhost.exe
1000	taskhost.exe
2772	taskhost.exe
2264	taskhost.exe
2496	taskhost.exe
1108	taskhost.exe
820	taskhost.exe
1732	taskhost.exe
2396	taskhost.exe
2592	taskhost.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	DllCommonsvc.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2752	taskhost.exe
Token: SeDebugPrivilege	2208	taskhost.exe
Token: SeDebugPrivilege	2352	taskhost.exe
Token: SeDebugPrivilege	1000	taskhost.exe
Token: SeDebugPrivilege	2772	taskhost.exe
Token: SeDebugPrivilege	2264	taskhost.exe
Token: SeDebugPrivilege	2496	taskhost.exe
Token: SeDebugPrivilege	1108	taskhost.exe
Token: SeDebugPrivilege	820	taskhost.exe
Token: SeDebugPrivilege	1732	taskhost.exe
Token: SeDebugPrivilege	2396	taskhost.exe
Token: SeDebugPrivilege	2592	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2676	2776	JaffaCakes118_1941b357d89fd7fbe6bdf975f25208c79c449de5f273a7b4ee9c9026ce4fe99b.exe	30
PID 2776 wrote to memory of 2676	2776	JaffaCakes118_1941b357d89fd7fbe6bdf975f25208c79c449de5f273a7b4ee9c9026ce4fe99b.exe	30
PID 2776 wrote to memory of 2676	2776	JaffaCakes118_1941b357d89fd7fbe6bdf975f25208c79c449de5f273a7b4ee9c9026ce4fe99b.exe	30
PID 2776 wrote to memory of 2676	2776	JaffaCakes118_1941b357d89fd7fbe6bdf975f25208c79c449de5f273a7b4ee9c9026ce4fe99b.exe	30
PID 2676 wrote to memory of 2572	2676	WScript.exe	31
PID 2676 wrote to memory of 2572	2676	WScript.exe	31
PID 2676 wrote to memory of 2572	2676	WScript.exe	31
PID 2676 wrote to memory of 2572	2676	WScript.exe	31
PID 2572 wrote to memory of 2728	2572	cmd.exe	33
PID 2572 wrote to memory of 2728	2572	cmd.exe	33
PID 2572 wrote to memory of 2728	2572	cmd.exe	33
PID 2572 wrote to memory of 2728	2572	cmd.exe	33
PID 2728 wrote to memory of 2164	2728	DllCommonsvc.exe	56
PID 2728 wrote to memory of 2164	2728	DllCommonsvc.exe	56
PID 2728 wrote to memory of 2164	2728	DllCommonsvc.exe	56
PID 2728 wrote to memory of 1876	2728	DllCommonsvc.exe	57
PID 2728 wrote to memory of 1876	2728	DllCommonsvc.exe	57
PID 2728 wrote to memory of 1876	2728	DllCommonsvc.exe	57
PID 2728 wrote to memory of 2392	2728	DllCommonsvc.exe	58
PID 2728 wrote to memory of 2392	2728	DllCommonsvc.exe	58
PID 2728 wrote to memory of 2392	2728	DllCommonsvc.exe	58
PID 2728 wrote to memory of 2124	2728	DllCommonsvc.exe	59
PID 2728 wrote to memory of 2124	2728	DllCommonsvc.exe	59
PID 2728 wrote to memory of 2124	2728	DllCommonsvc.exe	59
PID 2728 wrote to memory of 2228	2728	DllCommonsvc.exe	60
PID 2728 wrote to memory of 2228	2728	DllCommonsvc.exe	60
PID 2728 wrote to memory of 2228	2728	DllCommonsvc.exe	60
PID 2728 wrote to memory of 2112	2728	DllCommonsvc.exe	61
PID 2728 wrote to memory of 2112	2728	DllCommonsvc.exe	61
PID 2728 wrote to memory of 2112	2728	DllCommonsvc.exe	61
PID 2728 wrote to memory of 408	2728	DllCommonsvc.exe	62
PID 2728 wrote to memory of 408	2728	DllCommonsvc.exe	62
PID 2728 wrote to memory of 408	2728	DllCommonsvc.exe	62
PID 2728 wrote to memory of 2284	2728	DllCommonsvc.exe	63
PID 2728 wrote to memory of 2284	2728	DllCommonsvc.exe	63
PID 2728 wrote to memory of 2284	2728	DllCommonsvc.exe	63
PID 2728 wrote to memory of 2524	2728	DllCommonsvc.exe	72
PID 2728 wrote to memory of 2524	2728	DllCommonsvc.exe	72
PID 2728 wrote to memory of 2524	2728	DllCommonsvc.exe	72
PID 2524 wrote to memory of 2424	2524	cmd.exe	74
PID 2524 wrote to memory of 2424	2524	cmd.exe	74
PID 2524 wrote to memory of 2424	2524	cmd.exe	74
PID 2524 wrote to memory of 2752	2524	cmd.exe	75
PID 2524 wrote to memory of 2752	2524	cmd.exe	75
PID 2524 wrote to memory of 2752	2524	cmd.exe	75
PID 2752 wrote to memory of 332	2752	taskhost.exe	76
PID 2752 wrote to memory of 332	2752	taskhost.exe	76
PID 2752 wrote to memory of 332	2752	taskhost.exe	76
PID 332 wrote to memory of 2800	332	cmd.exe	78
PID 332 wrote to memory of 2800	332	cmd.exe	78
PID 332 wrote to memory of 2800	332	cmd.exe	78
PID 332 wrote to memory of 2208	332	cmd.exe	79
PID 332 wrote to memory of 2208	332	cmd.exe	79
PID 332 wrote to memory of 2208	332	cmd.exe	79
PID 2208 wrote to memory of 1872	2208	taskhost.exe	80
PID 2208 wrote to memory of 1872	2208	taskhost.exe	80
PID 2208 wrote to memory of 1872	2208	taskhost.exe	80
PID 1872 wrote to memory of 2308	1872	cmd.exe	82
PID 1872 wrote to memory of 2308	1872	cmd.exe	82
PID 1872 wrote to memory of 2308	1872	cmd.exe	82
PID 1872 wrote to memory of 2352	1872	cmd.exe	83
PID 1872 wrote to memory of 2352	1872	cmd.exe	83
PID 1872 wrote to memory of 2352	1872	cmd.exe	83
PID 2352 wrote to memory of 1768	2352	taskhost.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1941b357d89fd7fbe6bdf975f25208c79c449de5f273a7b4ee9c9026ce4fe99b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1941b357d89fd7fbe6bdf975f25208c79c449de5f273a7b4ee9c9026ce4fe99b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\Sample Music\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\de-DE\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\State\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RhYkRZa0Kx.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2524
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2424
      - C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GrfoiSU1wP.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:332
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2800
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KYEunsIO9t.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2308
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9ncYvmuuF5.bat"
        11⤵
        
        PID:1768
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1780
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\v9lJjcBPjH.bat"
        13⤵
        
        PID:1272
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:860
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat"
        15⤵
        
        PID:2384
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2348
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TGRMrapfWg.bat"
        17⤵
        
        PID:1144
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2392
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat"
        19⤵
        
        PID:1588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2328
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mv5UKbIUPK.bat"
        21⤵
        
        PID:2572
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2844
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:820
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat"
        23⤵
        
        PID:2244
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1876
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2zdeBu3xOP.bat"
        25⤵
        
        PID:2760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1056
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\da4noHdFs8.bat"
        27⤵
        
        PID:3068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:1312
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\Sample Music\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Music\Sample Music\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\DVD Maker\de-DE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\DVD Maker\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WTR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\Setup\State\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Setup\State\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\Setup\State\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9875cc0561060125e067268ef5d7ac6

SHA1
6ad34209c0a248a8530d01501ae03add4c52c078

SHA256
bc1d5fa0b11a5694868c3048415b7d839f8b9081a0fe391642a28ddea80e297d

SHA512
a9b0c59e5dec258f6adb9eb6f66bcb3c5272650d59370a756a681426fc2cd225bf63c7fbde0e622e5fe6f1af42b59738dff6ac7b07e1c339d71044061463da54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2443f60a913e6078df683d2e982fc087

SHA1
20d13d37dc1ff35d00b867d2acc74cf217d979f3

SHA256
19b2bbecf0b8334453de47a1ce65a669108324bd628dfebcde4fdc596f4d0223

SHA512
6bf51ce4900b94820cc3ce67d96cc325c9a513fb2b4b00401c7c6ff6778016e52f93cc1b6380e0918eb961817d548a571fe7b0277a9ec1555a73df3ac983bf8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aacf46afcdd4b1a6a5ae3e05d31356bd

SHA1
b41b13265d463833a86108464a9551e7b542130d

SHA256
8d4ea381467d9f78dde2b371f23fab8ee93a2cccdeee1a203d4b77b85a3229c0

SHA512
ddc692af4f78ede65b96af32a8d8e4329b3a670957b8a004374c79f824db704b31fcc17d6bc1c7b866945dfecf271980599526063c1323cd660694a1aff7a290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
116293d4bc0b11831e4d471dd654f37b

SHA1
622331f3191be7ed4837297d0806d702aef927f4

SHA256
a8a4fcbe78daf2a7ee9db62172b7f93409a38158f510a125c68042edfce36920

SHA512
d9baf522e17fa5e71405b72d7d1b5a48e4043412e83e9833635391986301feb6593528538d91425cc10da9062293e502aca3d32ee1b924174373995f2cfe1b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e545fd0695d9c1740f7b1bc0ad22f9e1

SHA1
00ba588371e8817933690d50096cc0b6d5e23e5c

SHA256
ef51acb1bcaaadeee97669bf7bb6c54f0b37c337ceb1afb0b6474634eab1c56e

SHA512
881fa1f4e8a543e15d9b4b2fb7fb24314a4c1e61b70b0015bb55a36b4206ef21e93a21dcc20f291b9635dc7ffe4689f7c096e4e1119edc768887f77646b94603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38325e1825b9beb5d0b9ead6333ea9c2

SHA1
0ec8de96eeb52250dce18632deb1ba1e8bc72ce0

SHA256
0454fae1ba46d18e3cfa0bdd50c97a4ad340dd6bdb8cccba44b1e974c60b29c8

SHA512
dc59e7123d232264d47e9d8445b8fb27de99ae55b3bf39d23bc4ec35d382bdd0335c0e7ab05a3bc14d136e3d0ca5c0354a56ee5911b7529ceab2f7d909307537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37d7b93de13caf3d178ce8c73cf8080f

SHA1
8a5c84c574580613e97c22c9a6906f8dbeef0716

SHA256
05d6609e02553fa69486277bcf42536d94987c5b17069815bd5f7b24fe77de2b

SHA512
02fec77a6ca5bdb94de8e0faf2c4d901dd4c3bced540f3c0c7220f76259d378c564cb6685792a6a3dfbdb65e0086eaa4e8347f4ee1f2210b94eadb804495300f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a89ff19a166f0a3dacceb00af0c74ea

SHA1
5eb2f5357c069c21b3a937eb506c60778be08bbb

SHA256
27dac4fcbefc168acd98a80d9d620896c9733493931a28ec31638dd42bac20c9

SHA512
c1c0f6bbbc8351b3aebeefde46a75e71b03084bd41f800d48d9eed7da2aba563f2fadc3cb7f206669a9f179833cbf59a6a224e0020ea386a0cf09b75c1705ae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f84c4bc7f173b0a78260655dfbded06c

SHA1
9cc5f03d19e44c8c132253ebe9986b5480e5bc47

SHA256
bfdaa9e08b18e0c0ab49a903a2df8477bdfeffa7e1f2a361e242b943381777f6

SHA512
5186aea2262dc113ecde5751c78d7d99ec85b3741242935d1fd3d6cf03f76e9dcf05a689bbfd1b54aa24c09610d9ce18cbc9d88d70b4ebfbdf32c847b6180288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b8784e8009afe2c8606c74b92bcf7d9

SHA1
b0f16c26aad37ef57034143d655e5cb1935a4b6f

SHA256
94b8f1e5149a53355911d1fac095ab859670980b86e8ed91f0f88974239dadf3

SHA512
15dc8434c2e705b284ef68dc291529f3fac581ff1acab5fd1888c08475c134b35480fbdf1a4ac7a689d3683993a8e00fa509c8a3569001775a49f708aa7aac84

Download Submit
C:\Users\Admin\AppData\Local\Temp\2zdeBu3xOP.bat

Filesize
241B

MD5
04e370fc720c065e7a7edf13302b7376

SHA1
3add3c14de4fbe9da428c35add0d1dd95d01b66b

SHA256
5f1d5406fef1192e147b3a6a9f350336b7a56cc5b968780f7ad7de0973cd0f50

SHA512
45fc4917e146a5ec64e747080f973c1b10f2207d6273ed4a122f467a78ebb99e074fbef6d29d0369d9f10de6044f42175987381f5eb8780c2fd693f100291e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ncYvmuuF5.bat

Filesize
241B

MD5
eed603d3bfa3409312104c672128ef35

SHA1
050275e8caecf9f40ac2db0f02569af2e684c7a4

SHA256
ff218c5ef9ed18c36239e17df49c36ce88782cd8da635cf2abbbc92c78e3665c

SHA512
adfa147cc9b84e999ad094fe9905917192b0ab29d21f2bab3f470bfead571e5c5897ea41ea920c36898b7c3b599f09571cdab5c09e2a35705ab8b6eb8611fb59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2ED0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GrfoiSU1wP.bat

Filesize
241B

MD5
1fa8de5459296b64abc98e3a35f9e5af

SHA1
c208b645bbc657a8bffe41372911c1a3c10a4a32

SHA256
fd9ca9dec7a653577729c2f15642a84829ac0c0c71744b5c1de4c2ca501cc873

SHA512
85df7ee51c02cd52b8e4f7ae02260950e1df0c9124cca19b9a8d9d9ebeb79f5decd700a5a6c075c012c96f29c7a9739a959690fde1d897c1b3c2db61700b93c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\KYEunsIO9t.bat

Filesize
241B

MD5
d0170bed4ad83d677b2b3ac415a3b2b2

SHA1
2e76377f1dfcbcea9b538c0ccba51f79b5d3d5f7

SHA256
45aea09419083b0468f37f2bce39dfb4f873b29d2bfb6a7dc56ae0c3bbf50341

SHA512
037901db6c247741ed57ba4ceb041935848436c3d0a01b411f9d3f5d477a057c7bb20b5b1bae4754fc12daf3318ae13fdaf502ee1018ee976f228648043d2238

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat

Filesize
241B

MD5
58212ad846dde287693275c2b9254077

SHA1
b29a68ad29598066e41b391a2acc74b98e5d3bb9

SHA256
f166df4c3a410347623cf0c484d7501f9261b4f155be0c007ae4e9dc984a0c26

SHA512
165bd09ca440e3c8914242400115ce0a96d434733e054fa17c8fb947ebc10ccda8d3fa0ec5971fcf0ddb5d3c77143cae5e02e952e16e0507af1f060961fbe60b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RhYkRZa0Kx.bat

Filesize
241B

MD5
ef59b8c4424b420e9a5ed0770341c208

SHA1
7b1899e1bb63a4e6e725ba1b44a385b4a92e231e

SHA256
a4eb9987f847e8dbaa3ebee5e960cd9b94b8dffcaedd1bbcc1eb8fb5d796e051

SHA512
037d76fd65b50e57659adc790b9687aab67e45d905b0e74415d42073a5694eeec8aa40b1fc642a57a62b0cc1980ac090387f268b9f90895e0eda895d395b80d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TGRMrapfWg.bat

Filesize
241B

MD5
564a1d4235ad278da2cfdabad3a17638

SHA1
3ccfbbf2e49b5287b7fb04279937b9417621244a

SHA256
6828a65fec45fb70ca06d240a9b39826ea22fbbacb1b5158e4bde39a3f391aa2

SHA512
cb6bac1acabec7732b340cdf4bca841b82fc6eb0d4132ba2d70a231e117b0277a156f9370d47f729282538259332cd9052ca8c0e6922f65c3fe03bbac3a7a45e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2EE2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\da4noHdFs8.bat

Filesize
241B

MD5
de7197d8e6c0291a1d2e8800a4a7970b

SHA1
ab42851aef01caea5858fbcdc888d1acbcc9a812

SHA256
cd5f1d5691dd8b8ec52b9f17af8ceefb58217253028a5d54a33eac12d8893271

SHA512
19a94903f315fb45b90b51e62df699d409185a966aea7d787d2c03f4b4045b9670aefb63bbb092cb78743c100f5b422e0755a0db1fbf728bdbb52390327ed2e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\mv5UKbIUPK.bat

Filesize
241B

MD5
411705ed1fccaedaefc0d5ffd93a6529

SHA1
6d07d7acbe4d546d315de75fb06faeb6dbfaf6bc

SHA256
17a14fb629495554d8071e7bd72a9e318ec35d0f2cbf943efea1f20be0f7b0fc

SHA512
2e50079695cccf5b8f6df3edf88da5ab78f87833ade057026c21afa46a17a5cfa5ed53d8d2ebd0fd592c891c16d45ffd809675523e680799579f78e406fea90c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat

Filesize
241B

MD5
e06d955d50c7ac6dfb7b05b5d10d1a02

SHA1
4a82f093659e8e4f459ef878ebc2bae33281baf4

SHA256
a160274fd5d4d151a952a9dea859e6408c99317b28d0aaffefe7b0d999ed8a64

SHA512
4924defd45a9519a2b22b34fe08d82b2c5abf59633e683c43b31c7442ff7e2c377b4ffadefd46739c7db5e72c1ab93cd065781873a0ce4a47572a80e5441c946

Download Submit
C:\Users\Admin\AppData\Local\Temp\v9lJjcBPjH.bat

Filesize
241B

MD5
a1c2ad45bf9d2b9eaca7655fb94780d9

SHA1
7eaf86b3cbb4ca77e94fa6beb57baeb942eb5ed3

SHA256
281ccab7e6e69603467ce8826845240da1c783b487dda21d79cc8de520f3f9ca

SHA512
ea0568732fea39744506390b1fc2c7cd15bb767f3e2a8fc65aee4af325c90fa7519bc0265ac4dc850fd6a1c7112789ee35995aff3988f2c56b6153375549a60c

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat

Filesize
241B

MD5
1672bf2bbb061f6e9c90790b2814cbe5

SHA1
0946582f20a1a793c5ab569faf813bef0eb72977

SHA256
1b45d93271d497e4447413d10f1a42649b8f54545a153a57d1af9fb0a8cc90a3

SHA512
a868e0fd6dbdba3a2e8bdf19dc28d2acede35a5fd159ff59f593a5d1cbad7c90a3c8c52716337cad7bf3d16d0fbb187ed827ccbe40bf3f669ea2ad6b5354877f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2BGBISIY0R3P6EB0ULCN.temp

Filesize
7KB

MD5
8796b08acbe0f33837f27f6c24eda866

SHA1
b0c1faeccbaeb0c166183dbceeecc0a0f1cfc4b5

SHA256
7eecc6c710eed3458e8ff09a4779e7141942081f2425319c2b16019746603e5f

SHA512
5ff879ec6a19cc2058e25649a755ab3b23e17661423966ef213e327914eadbbbb9455e99782526e3ee53a3bbf9adac3b1ccd24397448c0fb9159dfb105a41dac

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1000-259-0x0000000001000000-0x0000000001110000-memory.dmp

Filesize
1.1MB

Download
memory/1000-260-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/1732-618-0x0000000000180000-0x0000000000290000-memory.dmp

Filesize
1.1MB

Download
memory/1876-75-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2264-380-0x0000000001340000-0x0000000001450000-memory.dmp

Filesize
1.1MB

Download
memory/2352-199-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2352-198-0x00000000000C0000-0x00000000001D0000-memory.dmp

Filesize
1.1MB

Download
memory/2392-76-0x00000000026F0000-0x00000000026F8000-memory.dmp

Filesize
32KB

Download
memory/2396-678-0x0000000000100000-0x0000000000210000-memory.dmp

Filesize
1.1MB

Download
memory/2496-440-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download
memory/2592-738-0x0000000000910000-0x0000000000A20000-memory.dmp

Filesize
1.1MB

Download
memory/2728-17-0x00000000002F0000-0x00000000002FC000-memory.dmp

Filesize
48KB

Download
memory/2728-16-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/2728-15-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2728-14-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2728-13-0x0000000000B20000-0x0000000000C30000-memory.dmp

Filesize
1.1MB

Download
memory/2752-80-0x0000000000D60000-0x0000000000E70000-memory.dmp

Filesize
1.1MB

Download
memory/2772-320-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download