dcrat | 594536a61315c65d76f40bb0141af43b119e74fe8621f1891d8cca8fbce404b7

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_594536a61315c65d76f40bb0141af43b119e74fe8621f1891d8cca8fbce404b7.exe
Size

1.3MB
MD5

2e1c9d5a758940815db9c3979575d371
SHA1

cddcfb554ccab40d8cf50b21a5d14ddf165c3d4a
SHA256

594536a61315c65d76f40bb0141af43b119e74fe8621f1891d8cca8fbce404b7
SHA512

3600bc20f12240833a85b97ed641ce5fe59cd74b16690c3f413e7070bd42c5e97628cb3289819337963a927f73dd85d8596f4e3198c79a1144b96329c1d906d1
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	336	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	3012	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	3012	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00070000000193d0-9.dat	dcrat
behavioral1/memory/3036-13-0x0000000000850000-0x0000000000960000-memory.dmp	dcrat
behavioral1/memory/1908-87-0x0000000000980000-0x0000000000A90000-memory.dmp	dcrat
behavioral1/memory/372-146-0x0000000000D50000-0x0000000000E60000-memory.dmp	dcrat
behavioral1/memory/2080-206-0x0000000000050000-0x0000000000160000-memory.dmp	dcrat
behavioral1/memory/2532-266-0x00000000001E0000-0x00000000002F0000-memory.dmp	dcrat
behavioral1/memory/2480-326-0x00000000010D0000-0x00000000011E0000-memory.dmp	dcrat
behavioral1/memory/1632-563-0x00000000011F0000-0x0000000001300000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2324	powershell.exe
2136	powershell.exe
2452	powershell.exe
1628	powershell.exe
1004	powershell.exe
2200	powershell.exe
672	powershell.exe
1056	powershell.exe
2448	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
3036	DllCommonsvc.exe
1908	WmiPrvSE.exe
372	WmiPrvSE.exe
2080	WmiPrvSE.exe
2532	WmiPrvSE.exe
2480	WmiPrvSE.exe
1740	WmiPrvSE.exe
2352	WmiPrvSE.exe
1076	WmiPrvSE.exe
1632	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
2868	cmd.exe
2868	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
27	raw.githubusercontent.com
31	raw.githubusercontent.com
34	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\a76d7bf15d8370	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_594536a61315c65d76f40bb0141af43b119e74fe8621f1891d8cca8fbce404b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3008	schtasks.exe
2104	schtasks.exe
1036	schtasks.exe
2340	schtasks.exe
2476	schtasks.exe
2064	schtasks.exe
596	schtasks.exe
984	schtasks.exe
336	schtasks.exe
2676	schtasks.exe
532	schtasks.exe
2100	schtasks.exe
1732	schtasks.exe
2644	schtasks.exe
2480	schtasks.exe
2632	schtasks.exe
1576	schtasks.exe
1696	schtasks.exe
2188	schtasks.exe
2260	schtasks.exe
2432	schtasks.exe
1452	schtasks.exe
852	schtasks.exe
1740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3036	DllCommonsvc.exe
1628	powershell.exe
2136	powershell.exe
1056	powershell.exe
2452	powershell.exe
2324	powershell.exe
1004	powershell.exe
672	powershell.exe
2200	powershell.exe
2448	powershell.exe
1908	WmiPrvSE.exe
372	WmiPrvSE.exe
2080	WmiPrvSE.exe
2532	WmiPrvSE.exe
2480	WmiPrvSE.exe
1740	WmiPrvSE.exe
2352	WmiPrvSE.exe
1076	WmiPrvSE.exe
1632	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	DllCommonsvc.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	1908	WmiPrvSE.exe
Token: SeDebugPrivilege	372	WmiPrvSE.exe
Token: SeDebugPrivilege	2080	WmiPrvSE.exe
Token: SeDebugPrivilege	2532	WmiPrvSE.exe
Token: SeDebugPrivilege	2480	WmiPrvSE.exe
Token: SeDebugPrivilege	1740	WmiPrvSE.exe
Token: SeDebugPrivilege	2352	WmiPrvSE.exe
Token: SeDebugPrivilege	1076	WmiPrvSE.exe
Token: SeDebugPrivilege	1632	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2848	2192	JaffaCakes118_594536a61315c65d76f40bb0141af43b119e74fe8621f1891d8cca8fbce404b7.exe	30
PID 2192 wrote to memory of 2848	2192	JaffaCakes118_594536a61315c65d76f40bb0141af43b119e74fe8621f1891d8cca8fbce404b7.exe	30
PID 2192 wrote to memory of 2848	2192	JaffaCakes118_594536a61315c65d76f40bb0141af43b119e74fe8621f1891d8cca8fbce404b7.exe	30
PID 2192 wrote to memory of 2848	2192	JaffaCakes118_594536a61315c65d76f40bb0141af43b119e74fe8621f1891d8cca8fbce404b7.exe	30
PID 2848 wrote to memory of 2868	2848	WScript.exe	31
PID 2848 wrote to memory of 2868	2848	WScript.exe	31
PID 2848 wrote to memory of 2868	2848	WScript.exe	31
PID 2848 wrote to memory of 2868	2848	WScript.exe	31
PID 2868 wrote to memory of 3036	2868	cmd.exe	33
PID 2868 wrote to memory of 3036	2868	cmd.exe	33
PID 2868 wrote to memory of 3036	2868	cmd.exe	33
PID 2868 wrote to memory of 3036	2868	cmd.exe	33
PID 3036 wrote to memory of 2324	3036	DllCommonsvc.exe	59
PID 3036 wrote to memory of 2324	3036	DllCommonsvc.exe	59
PID 3036 wrote to memory of 2324	3036	DllCommonsvc.exe	59
PID 3036 wrote to memory of 1628	3036	DllCommonsvc.exe	60
PID 3036 wrote to memory of 1628	3036	DllCommonsvc.exe	60
PID 3036 wrote to memory of 1628	3036	DllCommonsvc.exe	60
PID 3036 wrote to memory of 2136	3036	DllCommonsvc.exe	61
PID 3036 wrote to memory of 2136	3036	DllCommonsvc.exe	61
PID 3036 wrote to memory of 2136	3036	DllCommonsvc.exe	61
PID 3036 wrote to memory of 2452	3036	DllCommonsvc.exe	62
PID 3036 wrote to memory of 2452	3036	DllCommonsvc.exe	62
PID 3036 wrote to memory of 2452	3036	DllCommonsvc.exe	62
PID 3036 wrote to memory of 2448	3036	DllCommonsvc.exe	63
PID 3036 wrote to memory of 2448	3036	DllCommonsvc.exe	63
PID 3036 wrote to memory of 2448	3036	DllCommonsvc.exe	63
PID 3036 wrote to memory of 2200	3036	DllCommonsvc.exe	66
PID 3036 wrote to memory of 2200	3036	DllCommonsvc.exe	66
PID 3036 wrote to memory of 2200	3036	DllCommonsvc.exe	66
PID 3036 wrote to memory of 1004	3036	DllCommonsvc.exe	67
PID 3036 wrote to memory of 1004	3036	DllCommonsvc.exe	67
PID 3036 wrote to memory of 1004	3036	DllCommonsvc.exe	67
PID 3036 wrote to memory of 672	3036	DllCommonsvc.exe	68
PID 3036 wrote to memory of 672	3036	DllCommonsvc.exe	68
PID 3036 wrote to memory of 672	3036	DllCommonsvc.exe	68
PID 3036 wrote to memory of 1056	3036	DllCommonsvc.exe	69
PID 3036 wrote to memory of 1056	3036	DllCommonsvc.exe	69
PID 3036 wrote to memory of 1056	3036	DllCommonsvc.exe	69
PID 3036 wrote to memory of 1200	3036	DllCommonsvc.exe	77
PID 3036 wrote to memory of 1200	3036	DllCommonsvc.exe	77
PID 3036 wrote to memory of 1200	3036	DllCommonsvc.exe	77
PID 1200 wrote to memory of 2508	1200	cmd.exe	79
PID 1200 wrote to memory of 2508	1200	cmd.exe	79
PID 1200 wrote to memory of 2508	1200	cmd.exe	79
PID 1200 wrote to memory of 1908	1200	cmd.exe	80
PID 1200 wrote to memory of 1908	1200	cmd.exe	80
PID 1200 wrote to memory of 1908	1200	cmd.exe	80
PID 1908 wrote to memory of 492	1908	WmiPrvSE.exe	81
PID 1908 wrote to memory of 492	1908	WmiPrvSE.exe	81
PID 1908 wrote to memory of 492	1908	WmiPrvSE.exe	81
PID 492 wrote to memory of 1504	492	cmd.exe	83
PID 492 wrote to memory of 1504	492	cmd.exe	83
PID 492 wrote to memory of 1504	492	cmd.exe	83
PID 492 wrote to memory of 372	492	cmd.exe	85
PID 492 wrote to memory of 372	492	cmd.exe	85
PID 492 wrote to memory of 372	492	cmd.exe	85
PID 372 wrote to memory of 1652	372	WmiPrvSE.exe	86
PID 372 wrote to memory of 1652	372	WmiPrvSE.exe	86
PID 372 wrote to memory of 1652	372	WmiPrvSE.exe	86
PID 1652 wrote to memory of 1300	1652	cmd.exe	88
PID 1652 wrote to memory of 1300	1652	cmd.exe	88
PID 1652 wrote to memory of 1300	1652	cmd.exe	88
PID 1652 wrote to memory of 2080	1652	cmd.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_594536a61315c65d76f40bb0141af43b119e74fe8621f1891d8cca8fbce404b7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_594536a61315c65d76f40bb0141af43b119e74fe8621f1891d8cca8fbce404b7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Sample Pictures\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\SIGNUP\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1056
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VSjxgpKhh7.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1200
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2508
      - C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jBrSCX6wbi.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:492
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1504
        
        C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pbn0SniZDX.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1300
        
        C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"
        11⤵
        
        PID:2276
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2728
        
        C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kOAwrWovpT.bat"
        13⤵
        
        PID:2612
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2884
        
        C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8UyA8TRco5.bat"
        15⤵
        
        PID:2420
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2684
        
        C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GX2kvMhQbI.bat"
        17⤵
        
        PID:672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1420
        
        C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat"
        19⤵
        
        PID:1724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:568
        
        C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zHC6P4FzNT.bat"
        21⤵
        
        PID:2944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:896
        
        C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BfyeXCadxk.bat"
        23⤵
        
        PID:1680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\providercommon\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\Sample Pictures\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\Sample Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59499c2d1859da28e47642417ec74da5

SHA1
bc6d0a24885b70ac590caa1124a2d2d273be6d6c

SHA256
0efcfd9eb721504cbe14e07e4190b00067c19067bd97a9e61d7fa741c546ac4b

SHA512
3e744bee8d447268380ba243a83fc559378e4a79e5b7455e1a3b269ee4f4c2f20f47030bdbff1bf530e0ad3f91ec9ba54de8b0e17545ca20e0170cef44e3d39d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e956843848676a01accb5f696ebf2135

SHA1
b8b06d368a996eb5a28a3716e589ae720114880f

SHA256
49ab7cb4c01124243e63717eb9e9c8a2d9fc1c91e96bd87f88556e8df4a1c198

SHA512
72dd68f17d6e030c62c80782efa7be7c7846debb39d8ede919f46ba4a922d40641e5ca84297bcedb345c6051c5aa3e7bac23e0298a2c780e154cb6b87de4107b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acc9d4b9d214905a1c7786ba8dc00694

SHA1
aab20c62454962d4d62a252cbb6fa87dec5fc814

SHA256
6d6e40bfc33f2bd14129bdb15675b156228211cd6ffbc8593446b8552bee60f7

SHA512
46dbd58c521a0c06f0770d84cbf93fa65fae669607accdfd0abd3c46c46eaa7139a78ea9b6fa710ddb4dd969db9426d7c3cb657abdef0504ade5adde111526d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
440c1ca5604db130f8fffb6aa9906609

SHA1
1ddc7838bc092a3cb6fe7fad14fa1b56a3eb4aa0

SHA256
18969c253944b1fc878bb846bacf0ce8a5a771abe5438d1e084adb609e0d90bd

SHA512
c6edaf4f7ce82e47706c0d8b177caf5cd622d4f009918a1fa84f398138335129b1c3cd3628bc482ad0feec079db1c85a77f206afd262038041fa31baac0da061

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4f34f43a1f07f6c2825556ac1d628fa

SHA1
bace4d9c54e9368cbf300e4fa0b7993acdf0b25f

SHA256
d06ea9b1bfa4ea5a44a805f03afa66c180155ad88dc0f8a0a6b29e82e420cd86

SHA512
90e468c8872799fd3ecc84b81fb3adbc5bacfa9c130d3911b16f53e9a239a7f0ab9bc191b3b90abdd17643fe834faa40a1c6d6149f5f4a2d698b0c5eaf2def42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7e473084f3909a61347533bd739a54c

SHA1
2f4ebcb81405c1d19a3d0e8f5e777d8898e256f7

SHA256
b98fcd3d157e91465e49f9202088721190f0fac43bd7696f805a37eb5105e07d

SHA512
7f8c9baf7034d4018794f307782449b24dfed9bcde9e393b2b5a020898b94b6a2eee8d3ed1a51ff482f73f5d81c4324207dac646d363027e34a902d4d040a5e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7564d85ed282af6f247fad4742780025

SHA1
6ad9b77803360c75b14b1c856582d1c4d2e9ef83

SHA256
a6505f26feba8a94d43832e0847a74ca685797ef97fc4de807c30c429593d346

SHA512
929b6db7dcf8ae1a8148b45ad4d829f527d062e71aec35cd1b7114bddddd0a2c15887ecdfc79a79f9c240cdcc0713dc24f43487084bb955d89e7ef5a127e7d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
355ec353bb5844c210f81c9f9ed167b9

SHA1
aa3caef4d30de52f453e4dffdd3f3bd5f90abe29

SHA256
05096821574840f8aa2efae9dc687b2d834873aada0399859bef5f801c30f3f7

SHA512
933392b541cdbbf521d234b40ffe9d18a034483336ed4f67f2ba08bbcb0194ab3dd9de1f5b7986b601d6849863c7b8260e3f962e3a2ad92509c5fbde886c5395

Download Submit
C:\Users\Admin\AppData\Local\Temp\8UyA8TRco5.bat

Filesize
240B

MD5
1efa3ec069b2173a628e59581a6af9e3

SHA1
52c7ef6f725a2ea3e63f9a17f12deef540a3d12f

SHA256
c966c8d84158b2f7b3286e1583a2674318d006322c373063883356bdebdc6c3e

SHA512
252a80ddf66c5bf5cd289f914105b7dcc77f15ca742be7ae8c3d6f1206ce6200356b92d6918cd72b41cc631d8e8ed6eb5a52e69d6fc113642e20fe1d8189ca42

Download Submit
C:\Users\Admin\AppData\Local\Temp\BfyeXCadxk.bat

Filesize
240B

MD5
eb8f48490b8dc2759675cc283d69b103

SHA1
450078c815ee36a8955e93846fa715b147a63e79

SHA256
2862701541ac8ace4795433673eab8050a9d956460fce2d6d3754fa29a92626d

SHA512
af667ff43ea1f45c20ccd6c8a58d496c1a7b6260af95180f5868bba297548926c851196701b6938afc3275503c5e0605476b7c1f7cc1830984152916dbafceb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCB3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GX2kvMhQbI.bat

Filesize
240B

MD5
e7b6b45594cab1c8f3008e511fa7465c

SHA1
329b89b8eb582987d7fd08b69d5b2e99755bef9d

SHA256
9bac0084153656047733c0e7efa4c27a5b4b1bad4f233b59454d990cf84e2aab

SHA512
e82b45f49bda8f3f317e1b2ea4f326a00da9615ca331756da46bb7945d8492e41a85ae5166cc76d09a48816d54e28f30f1d69e75f7caeab48c0f66cb821cc63e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pbn0SniZDX.bat

Filesize
240B

MD5
4ca8d78a01d534b020bf7e770306fec8

SHA1
ecf9065a1f7e98b049d8c7e72ef5378e04c19496

SHA256
f02d086270d62859bfc055bdbae75529cfb9c2716dea5f519ca2cc979e488af4

SHA512
9cbb767234c707945106b0a0000b9ea6f51d9a3d2c7b20b2f88e467514b77c230cf51de3ec6beaab36e1158d0f95aa007393245c30445f2fd8f9877794ae5c5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCCC6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VSjxgpKhh7.bat

Filesize
240B

MD5
46bb1bb700702b814ecaea3102932642

SHA1
4469c4fd95c4b383c75d92bd410cc7c7139cd72b

SHA256
57aeb50df33b5fc5549cdba0e0b13797d6eeb67a956268598f96ea217328308a

SHA512
8a14016849ff7519d89c25cf9c8b76e5f3754823a8d285c4dafefb2d58647c34d95e5ee8fd729864721cf21972d67898b0a2aa0675516e71cfed76de0af26c47

Download Submit
C:\Users\Admin\AppData\Local\Temp\jBrSCX6wbi.bat

Filesize
240B

MD5
900358e9da8e9e5cca0b4eaed8eceecc

SHA1
14b5692d9ee86f58b856e69162c1d11d1e141b04

SHA256
6f9e69e0d963715ceb50578fb2c42a597ce71cff717b8d7c75ca54d292c3344a

SHA512
e94e2c8fc348e8a2bebe61d33a3058f36a99eb546bb486581371a8604a57a65b91cc1835bbcabcbf605f432c9874e4c900462c64ce844e8c66330d5aa5cadf12

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat

Filesize
240B

MD5
2152f661bd13896e98aac380816d1a5c

SHA1
bc8dc4e2e4de9e7d4140ecbb4440cc7344958d86

SHA256
a2d29c91e6011532e142d30f11bede065900783aa137b022432058e382d3fdc9

SHA512
2368ddc8f95534c96ba27ca4e8ba688054f21aed74981877ea4a9ad7d5fac76747dc7c1201d2d3251dcaa06cf5ffc68cddf55759f8efa145f53cafb7936baa03

Download Submit
C:\Users\Admin\AppData\Local\Temp\kOAwrWovpT.bat

Filesize
240B

MD5
34c5fb84a23cb9b4f0d3f078c9d6eeb0

SHA1
f6ab52f8323255f02890dc2642378865c60958ef

SHA256
05f9c346ee141ea65ef0dfff30f55483f696c870f62304c1cf74cb813f74719e

SHA512
252fdfc315c2582a9658d307929f9a4107df6a0e20d943d0915e2ef769a4c635eaca7900ad8ad46dbd84c3583b40e71ab9fd31f5861754342cda61a3fb7c4180

Download Submit
C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat

Filesize
240B

MD5
9282952c8caacae082b3b4952cf1c375

SHA1
14370cee39a97fcf9b15d23cc8d1c7e1e217f977

SHA256
0d4f931b15bb0718cea27e3648d0673919e433453075abd20969b5e4ba87c01d

SHA512
026a7ffbf8d1dd8304f2759fda4efbe46aac1b007ea93ddae1fb25c1c3dc048c7f55501bee2a32e43ab031f2cca0c755d5b408aff2583604d8143fea0c9f5226

Download Submit
C:\Users\Admin\AppData\Local\Temp\zHC6P4FzNT.bat

Filesize
240B

MD5
10c27229f19a267b3f7a27cbd4b5365f

SHA1
f03237aae7d046025acf65ad6c056296dad2155b

SHA256
09d7f1005a68f8b78d7b6fa10a7dc356e6ee37d6c31f04152201a44696ca31be

SHA512
c3d228ac65985d16f5b72a04886559e4cce545d5390cff9bec16661447ad8a6edc176e5d2e2e205a7d329ab3dcac9fbc77030bb3dce84946fe2cf44fb9988105

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K47NLL18WEPMFP5Y12OK.temp

Filesize
7KB

MD5
a1ed1b4c5d5d2a5e0921544dde4dd836

SHA1
d65255cbd4c73da3ee87e81dd0de51a212d06543

SHA256
9f55eb0be731e9cd4ae1d3bd2b9dba77d30b72f86f0ba07f3d26016c570c6c59

SHA512
2da27ab2e64717e3c653b2fe9b70cda834fe25e2fae695a3c124eca291b40e4f4aa24623c92d2db41b73e649ac4ed72fd296b2278449f246d51636bca11e2012

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/372-146-0x0000000000D50000-0x0000000000E60000-memory.dmp

Filesize
1.1MB

Download
memory/1628-68-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/1632-563-0x00000000011F0000-0x0000000001300000-memory.dmp

Filesize
1.1MB

Download
memory/1908-87-0x0000000000980000-0x0000000000A90000-memory.dmp

Filesize
1.1MB

Download
memory/2080-206-0x0000000000050000-0x0000000000160000-memory.dmp

Filesize
1.1MB

Download
memory/2136-64-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2480-326-0x00000000010D0000-0x00000000011E0000-memory.dmp

Filesize
1.1MB

Download
memory/2532-266-0x00000000001E0000-0x00000000002F0000-memory.dmp

Filesize
1.1MB

Download
memory/3036-15-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/3036-14-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/3036-16-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/3036-13-0x0000000000850000-0x0000000000960000-memory.dmp

Filesize
1.1MB

Download
memory/3036-17-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download