dcrat | c530651992861ff9373019aee43d4e9d94cb8c5d628cdd5add5cb63051e4f480

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c530651992861ff9373019aee43d4e9d94cb8c5d628cdd5add5cb63051e4f480.exe
Size

1.3MB
MD5

e1f40c28bc5266fdf08cdc39d1e3bb58
SHA1

9af79ee9c0871bf7db82099ffac4ac82a01b7e96
SHA256

c530651992861ff9373019aee43d4e9d94cb8c5d628cdd5add5cb63051e4f480
SHA512

bd4972131aa8094b7ea1b55bde4f51568045fc66ff2e13e4c54a6526624a6032ff38b8e2b59846c14de0b5dd4ed3464f0c238010cae3b2a70eda3de4a17eb81d
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	1852	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	1852	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000700000001922c-9.dat	dcrat
behavioral1/memory/2060-13-0x0000000001310000-0x0000000001420000-memory.dmp	dcrat
behavioral1/memory/1228-108-0x0000000000E90000-0x0000000000FA0000-memory.dmp	dcrat
behavioral1/memory/1716-226-0x00000000003A0000-0x00000000004B0000-memory.dmp	dcrat
behavioral1/memory/2288-286-0x0000000000860000-0x0000000000970000-memory.dmp	dcrat
behavioral1/memory/1592-346-0x0000000000CA0000-0x0000000000DB0000-memory.dmp	dcrat
behavioral1/memory/2172-406-0x0000000001370000-0x0000000001480000-memory.dmp	dcrat
behavioral1/memory/1192-586-0x0000000000370000-0x0000000000480000-memory.dmp	dcrat
behavioral1/memory/108-647-0x0000000000910000-0x0000000000A20000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1644	powershell.exe
1624	powershell.exe
1564	powershell.exe
288	powershell.exe
2400	powershell.exe
1716	powershell.exe
1960	powershell.exe
1608	powershell.exe
880	powershell.exe
1804	powershell.exe
992	powershell.exe
1600	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2060	DllCommonsvc.exe
1228	services.exe
2968	services.exe
1716	services.exe
2288	services.exe
1592	services.exe
2172	services.exe
1644	services.exe
1500	services.exe
1192	services.exe
108	services.exe

Loads dropped DLL 2 IoCs

pid	Process
2428	cmd.exe
2428	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
34	raw.githubusercontent.com
5	raw.githubusercontent.com
20	raw.githubusercontent.com
30	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
37	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
13	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\24dbde2999530e	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\101b941d020240	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\services.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\ja-JP\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\ja-JP\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WmiPrvSE.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Vss\Writers\System\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\Vss\Writers\System\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Windows\TAPI\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\TAPI\f3b6ecef712a24	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c530651992861ff9373019aee43d4e9d94cb8c5d628cdd5add5cb63051e4f480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2872	schtasks.exe
2692	schtasks.exe
560	schtasks.exe
2116	schtasks.exe
1372	schtasks.exe
2252	schtasks.exe
112	schtasks.exe
536	schtasks.exe
2668	schtasks.exe
2700	schtasks.exe
2924	schtasks.exe
2632	schtasks.exe
2504	schtasks.exe
1736	schtasks.exe
2384	schtasks.exe
3020	schtasks.exe
2644	schtasks.exe
2544	schtasks.exe
1228	schtasks.exe
1748	schtasks.exe
2764	schtasks.exe
2948	schtasks.exe
1616	schtasks.exe
848	schtasks.exe
2944	schtasks.exe
2584	schtasks.exe
2940	schtasks.exe
2960	schtasks.exe
2120	schtasks.exe
2652	schtasks.exe
2768	schtasks.exe
2364	schtasks.exe
2064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2060	DllCommonsvc.exe
1716	powershell.exe
1960	powershell.exe
880	powershell.exe
1564	powershell.exe
1804	powershell.exe
2400	powershell.exe
1608	powershell.exe
288	powershell.exe
1644	powershell.exe
1624	powershell.exe
1600	powershell.exe
992	powershell.exe
1228	services.exe
2968	services.exe
1716	services.exe
2288	services.exe
1592	services.exe
2172	services.exe
1644	services.exe
1500	services.exe
1192	services.exe
108	services.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	DllCommonsvc.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	288	powershell.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	1228	services.exe
Token: SeDebugPrivilege	2968	services.exe
Token: SeDebugPrivilege	1716	services.exe
Token: SeDebugPrivilege	2288	services.exe
Token: SeDebugPrivilege	1592	services.exe
Token: SeDebugPrivilege	2172	services.exe
Token: SeDebugPrivilege	1644	services.exe
Token: SeDebugPrivilege	1500	services.exe
Token: SeDebugPrivilege	1192	services.exe
Token: SeDebugPrivilege	108	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1956	2336	JaffaCakes118_c530651992861ff9373019aee43d4e9d94cb8c5d628cdd5add5cb63051e4f480.exe	30
PID 2336 wrote to memory of 1956	2336	JaffaCakes118_c530651992861ff9373019aee43d4e9d94cb8c5d628cdd5add5cb63051e4f480.exe	30
PID 2336 wrote to memory of 1956	2336	JaffaCakes118_c530651992861ff9373019aee43d4e9d94cb8c5d628cdd5add5cb63051e4f480.exe	30
PID 2336 wrote to memory of 1956	2336	JaffaCakes118_c530651992861ff9373019aee43d4e9d94cb8c5d628cdd5add5cb63051e4f480.exe	30
PID 1956 wrote to memory of 2428	1956	WScript.exe	31
PID 1956 wrote to memory of 2428	1956	WScript.exe	31
PID 1956 wrote to memory of 2428	1956	WScript.exe	31
PID 1956 wrote to memory of 2428	1956	WScript.exe	31
PID 2428 wrote to memory of 2060	2428	cmd.exe	33
PID 2428 wrote to memory of 2060	2428	cmd.exe	33
PID 2428 wrote to memory of 2060	2428	cmd.exe	33
PID 2428 wrote to memory of 2060	2428	cmd.exe	33
PID 2060 wrote to memory of 1564	2060	DllCommonsvc.exe	68
PID 2060 wrote to memory of 1564	2060	DllCommonsvc.exe	68
PID 2060 wrote to memory of 1564	2060	DllCommonsvc.exe	68
PID 2060 wrote to memory of 288	2060	DllCommonsvc.exe	69
PID 2060 wrote to memory of 288	2060	DllCommonsvc.exe	69
PID 2060 wrote to memory of 288	2060	DllCommonsvc.exe	69
PID 2060 wrote to memory of 1804	2060	DllCommonsvc.exe	70
PID 2060 wrote to memory of 1804	2060	DllCommonsvc.exe	70
PID 2060 wrote to memory of 1804	2060	DllCommonsvc.exe	70
PID 2060 wrote to memory of 880	2060	DllCommonsvc.exe	71
PID 2060 wrote to memory of 880	2060	DllCommonsvc.exe	71
PID 2060 wrote to memory of 880	2060	DllCommonsvc.exe	71
PID 2060 wrote to memory of 2400	2060	DllCommonsvc.exe	73
PID 2060 wrote to memory of 2400	2060	DllCommonsvc.exe	73
PID 2060 wrote to memory of 2400	2060	DllCommonsvc.exe	73
PID 2060 wrote to memory of 1716	2060	DllCommonsvc.exe	74
PID 2060 wrote to memory of 1716	2060	DllCommonsvc.exe	74
PID 2060 wrote to memory of 1716	2060	DllCommonsvc.exe	74
PID 2060 wrote to memory of 1624	2060	DllCommonsvc.exe	76
PID 2060 wrote to memory of 1624	2060	DllCommonsvc.exe	76
PID 2060 wrote to memory of 1624	2060	DllCommonsvc.exe	76
PID 2060 wrote to memory of 992	2060	DllCommonsvc.exe	77
PID 2060 wrote to memory of 992	2060	DllCommonsvc.exe	77
PID 2060 wrote to memory of 992	2060	DllCommonsvc.exe	77
PID 2060 wrote to memory of 1644	2060	DllCommonsvc.exe	78
PID 2060 wrote to memory of 1644	2060	DllCommonsvc.exe	78
PID 2060 wrote to memory of 1644	2060	DllCommonsvc.exe	78
PID 2060 wrote to memory of 1600	2060	DllCommonsvc.exe	79
PID 2060 wrote to memory of 1600	2060	DllCommonsvc.exe	79
PID 2060 wrote to memory of 1600	2060	DllCommonsvc.exe	79
PID 2060 wrote to memory of 1960	2060	DllCommonsvc.exe	80
PID 2060 wrote to memory of 1960	2060	DllCommonsvc.exe	80
PID 2060 wrote to memory of 1960	2060	DllCommonsvc.exe	80
PID 2060 wrote to memory of 1608	2060	DllCommonsvc.exe	81
PID 2060 wrote to memory of 1608	2060	DllCommonsvc.exe	81
PID 2060 wrote to memory of 1608	2060	DllCommonsvc.exe	81
PID 2060 wrote to memory of 1888	2060	DllCommonsvc.exe	92
PID 2060 wrote to memory of 1888	2060	DllCommonsvc.exe	92
PID 2060 wrote to memory of 1888	2060	DllCommonsvc.exe	92
PID 1888 wrote to memory of 2288	1888	cmd.exe	94
PID 1888 wrote to memory of 2288	1888	cmd.exe	94
PID 1888 wrote to memory of 2288	1888	cmd.exe	94
PID 1888 wrote to memory of 1228	1888	cmd.exe	96
PID 1888 wrote to memory of 1228	1888	cmd.exe	96
PID 1888 wrote to memory of 1228	1888	cmd.exe	96
PID 1228 wrote to memory of 2880	1228	services.exe	97
PID 1228 wrote to memory of 2880	1228	services.exe	97
PID 1228 wrote to memory of 2880	1228	services.exe	97
PID 2880 wrote to memory of 2896	2880	cmd.exe	99
PID 2880 wrote to memory of 2896	2880	cmd.exe	99
PID 2880 wrote to memory of 2896	2880	cmd.exe	99
PID 2880 wrote to memory of 2968	2880	cmd.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c530651992861ff9373019aee43d4e9d94cb8c5d628cdd5add5cb63051e4f480.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c530651992861ff9373019aee43d4e9d94cb8c5d628cdd5add5cb63051e4f480.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:288
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\ja-JP\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\System\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1608
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8okcwczJrd.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1888
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2288
      - C:\Program Files (x86)\Uninstall Information\services.exe
        
        "C:\Program Files (x86)\Uninstall Information\services.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CMv1BFFgLz.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2896
        
        C:\Program Files (x86)\Uninstall Information\services.exe
        
        "C:\Program Files (x86)\Uninstall Information\services.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EqBdbgL5Ji.bat"
        9⤵
        
        PID:1916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3000
        
        C:\Program Files (x86)\Uninstall Information\services.exe
        
        "C:\Program Files (x86)\Uninstall Information\services.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LabqbH8bfv.bat"
        11⤵
        
        PID:1244
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:268
        
        C:\Program Files (x86)\Uninstall Information\services.exe
        
        "C:\Program Files (x86)\Uninstall Information\services.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EVfp7xrD4G.bat"
        13⤵
        
        PID:2900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1500
        
        C:\Program Files (x86)\Uninstall Information\services.exe
        
        "C:\Program Files (x86)\Uninstall Information\services.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\P6ENo64DAh.bat"
        15⤵
        
        PID:1332
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1928
        
        C:\Program Files (x86)\Uninstall Information\services.exe
        
        "C:\Program Files (x86)\Uninstall Information\services.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat"
        17⤵
        
        PID:700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:448
        
        C:\Program Files (x86)\Uninstall Information\services.exe
        
        "C:\Program Files (x86)\Uninstall Information\services.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat"
        19⤵
        
        PID:1136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2472
        
        C:\Program Files (x86)\Uninstall Information\services.exe
        
        "C:\Program Files (x86)\Uninstall Information\services.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gN51JOWfNX.bat"
        21⤵
        
        PID:2768
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1704
        
        C:\Program Files (x86)\Uninstall Information\services.exe
        
        "C:\Program Files (x86)\Uninstall Information\services.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zAqEIlSfAD.bat"
        23⤵
        
        PID:2260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3012
        
        C:\Program Files (x86)\Uninstall Information\services.exe
        
        "C:\Program Files (x86)\Uninstall Information\services.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:108
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bo4ZIAkpMj.bat"
        25⤵
        
        PID:2536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\ja-JP\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\System\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\Vss\Writers\System\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\TAPI\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Uninstall Information\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09cc68e9afb418ec6f335bdf5468df55

SHA1
fec0288fc0f262ec618d62a1508cf726fe37efd1

SHA256
e2af9e8d6fc670d080b40df756345e4320d3a1367663ee555997c74bbb58eff4

SHA512
8c089a5adaa737d1b85e6279db0fb0945cc19e6d802d84086673c1eaba69085c4f615002c1e4e741fff1fb829b69334095e0db6f0440c1b03f21e027e30fb6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24d81123d1b533f70e2b64d3fc9e3013

SHA1
d432feeeb36c2a8eed2bfadf0b6e7eb4ab4ea4a2

SHA256
922f7c9cf8e77a729ef3a2ace4f493e2c3716b7453cc8776e1839afc54634925

SHA512
e32a66a1735d261020d1facc0ca02ce59b475f47591cf32eca1005e5a3952fbf5983c8042bac3198f51d46b6074d3c174f624680c25cded50ccfdaeda6f56c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
219dc1e4177ada389c543798fb476099

SHA1
c0fbf476daacdc29eab78e30b05f75dded9dc01e

SHA256
1c3c933575e8cba25cd9b89f651b559bcfda5e248d31a7ce2f6f9770fcccc133

SHA512
508e041686194a9a5a778d84956edb2dbefe7fd6cee53ca6c493f453fdcde6ce0f3200c30fe4e10645ed69d1730d61105012c8bafc3eb49fe4286dfa6a11130d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c6a11a8c58d23bb9273b5dce366d976

SHA1
9106decc454f88afb8d16886f4d054b0b6ee5a3c

SHA256
228603217bde0103ad8d36f3bce8cd39c031eba7a7d28713eb100e2ad74c5b5c

SHA512
39d9f315744623d292ab057030c8d1232a38bfc1831f9f4ab57bf34f7b46d1b09479baeee66b626056a9507c662c6855c53a5a49d580805bd0a6e909e69398ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5d7320fea610db2b3200ce25cae4a08

SHA1
727a5c87b0d864de3769e255c662881fa749f43e

SHA256
8e36acf999c5dcce4bfe7cb51cd0cc8be5ae57d4616505e4e2571be5ce4ff892

SHA512
49c2f10c3296f0a5e117d90e6bbb14f5f455f881a78d13d5823012d501709e8dd0d522f5e723ef8bd071da19bb8f879fa39642aaf7fe539e91ab4222ce9e06e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d5915944e240118bfe1fc17e53c54a6

SHA1
0d8060e63c5a2f0afdae1cbcf5e1bcc06bd38d06

SHA256
d90f6d2fd54fae3066ab9104423d181e61459154b28c37889c19c3201911abc6

SHA512
bb54e8cab4405b70709ce301aaacd13f6d8b706425ce8de3a285d29c009efbc621b2baceabc9dadaa4b5eec41b15ff527d2d24b8b91191b0d347f9d6458b2074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef3d56b72f64a66c8078bddbb5244f86

SHA1
42a9a3441839bbbd2df76862ca95117b7a352c12

SHA256
36cb4d6f6925cfe3206faafc395e3a20cc12fbb7e59db538cc5bef67cbfd0f72

SHA512
c100eb79c79dec45ad407fee1f9ecd3fd9ff2939e65f1aa389e2d6973249fe3377ce15348c51d4789667cc80c99fddafae7f9eea1f27da909c2aff2eb8fda872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
343d5f58863279b9844b5d23235abf3c

SHA1
60bcebb32c4abf93af39af0eff55270590a09fc6

SHA256
5f056a5739d1e4f989d6064156822251ab3254f8ab4fc187dfd1f69919edfc01

SHA512
2c021263ebd8d1a6a769c0e03703661314adfee07bf893c64804aae44f02e6598bf00f930572b8579212d232d5cbacb928eece7f1fe39e5236922031b326c468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b1a15077193be2f4704499af364e958

SHA1
f26d2796e3e8073144e2a09c058fd9f937d13829

SHA256
4e4c7412cb851035323645d7fc1c57bda16f4cefaf1951bd97a2c3fae6ae476e

SHA512
b4345d958a714df5f52d039ea53163231b248bc0c996151695eaf9f56aa5dc4269304b36227fe2c5544351c6eab49e4a74a625c385326e83fe9ba2960e621ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat

Filesize
222B

MD5
04a680421bbdfc3ead38768e0cd144c3

SHA1
75e641ba4c4574c97964ca6f1747f3363a2fbd7b

SHA256
3dab23f755a329c23c70fd4263cbff45b2d129745587214ec59ce649d391fc1d

SHA512
1904505406a3ca8d6246508503fb9d96016a493b6243a4bc7a992232bea4dfab1795a9e666c82c7ea483b9e8b7808548eb832ca026eaa18aa8e7f31f7c9eef01

Download Submit
C:\Users\Admin\AppData\Local\Temp\8okcwczJrd.bat

Filesize
222B

MD5
b5d5cc43284dbf4d6a2a496e3ca43760

SHA1
46f1692882e550c7f0051706b9fc687aa2484b51

SHA256
a89e2252a451ea78e631dc5228603c8b22a68e761f8cefc37b5895679ddafeeb

SHA512
322f61c38620222e9d1221642614b29640f395fe4fe2ff08c796300db7301118eef64a58bafc6efe2609f31db66f2c5eea246cb2027ba8ca9e53e689a1335d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CMv1BFFgLz.bat

Filesize
222B

MD5
184bd67ea5f95d3752060904011745cd

SHA1
e916612d11b2711562aff3f3b6a0c353ee16ad23

SHA256
311a996dd104f46b3e0a4096704217e6ecf30258e850f5fc4a26be1a0eb01a45

SHA512
883fc1480c52774dabb1bf5716185d03981b0a130d355ba46452fec509a730a729e6ffbe06ac72700ed81dc3ab493920a60348d5f693b25ae5e9fb3893c127de

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF874.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EVfp7xrD4G.bat

Filesize
222B

MD5
967ac50015a25692155c6980c13adc62

SHA1
aab7a56e2a0ece83907f30f6826a97ee603ff25d

SHA256
a0b48cbcbf90c06f12ed4e2a535d2977b3f7e473e25f696e6353c522a93f75ed

SHA512
aab87fe6b6a038f27369047019e6937611ce75fc79ed2c45ebdd5d3dfad32782b85ee5d33b9042a80c111fcc14b2b2af17e9be57aba34c511221616b66c7dc59

Download Submit
C:\Users\Admin\AppData\Local\Temp\EqBdbgL5Ji.bat

Filesize
222B

MD5
ea4a64da65fdda7fe7829e25ea71977b

SHA1
8e47343889720ed86485702978898ae4029cab42

SHA256
f6b95822b8ba29db1d41b16c9388a9f6c83750b06acb3ec588c0b2ea2538cec6

SHA512
f8d8a5aae51769f51ba6f9f9844c2d7771a5dd16a7affab9c54e5e06aba5b509675c72ef79d927313fa59be758d48ec3aa39ac554fc57832bc62635b341f569b

Download Submit
C:\Users\Admin\AppData\Local\Temp\LabqbH8bfv.bat

Filesize
222B

MD5
cfd44bf86b25c22ddeec81deeee1c92d

SHA1
f8e2ad86a7c81a7f3808cf00671fb7a6455e299c

SHA256
fac94423a919bd83bbadea965c6687f1285d9ce768f4d6f6bb8fed66e38cdaa3

SHA512
6880ac5210cede8513afb1b49c0917d025f73f44b79f41d80718b8e78475b63898acaa60d8a30970de2b79d65becad6862218c42cfd4c42cef07249decdc3b2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\P6ENo64DAh.bat

Filesize
222B

MD5
9e619f62f3dba3cffd91186253d5b0ee

SHA1
f829f234564f1e85799f8698ea1294c30225606c

SHA256
75fdd7ae07ab91faf0ec7f8d19726374ed1dc3502543e0237699a0fe99028655

SHA512
880942d35684ebfa50e254891c49e6dd586492d75b37af552b6767dd035b0b1e7e514dbc63accf924c71c8f5f0790d024f5c79a827a2807e1899f40bc90f9fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF897.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bo4ZIAkpMj.bat

Filesize
222B

MD5
93165150c5e1fba2c49bdcc8d34a0899

SHA1
d29c5010373cbf17c3144472bbf6e36a6e18dda5

SHA256
6d4a531cfb6b5dbd68378f70564170fef90b024220d672d3977e0d3a778dff88

SHA512
fd51973aff4837c2894e47f40b74a908d9a69f18593257ea4f653012449a5e3e81fb58a33935b3dad97987407aa6e633b6681063ebc8fb944fdb55057b891852

Download Submit
C:\Users\Admin\AppData\Local\Temp\gN51JOWfNX.bat

Filesize
222B

MD5
354bc1e653f2f9cb8abfc812149ecc26

SHA1
8b9f2122111f23fae98331550bfff72edb65e989

SHA256
42058ab2c934e549d4d7f6c6d070761bfecd5dad32ac0608259793fa6fcad594

SHA512
9c3653d336a972c87caa5ef35aa8f4f2541b5ac0d77f5dcba70df50ce44be8faac8af08f9d9f4ff17ebdff8e26b1a86953be6d35c4a7b9cf2d29915cc37d51d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat

Filesize
222B

MD5
324e4b03dc5767efd0835477aba11350

SHA1
f91da70db68f32f99c6dcfb6a4e6cd456eb63be9

SHA256
4b22d648e89dc3fa3b287e386eb16c882fed6b95c5582659c22b42d0d1e155ff

SHA512
30416fef94578e19d94908e3069f971e58af1f24eae9659e8a56f74da6226eb8f332f09c1a06dc6471e90a906a591d3a86e08a3eddbcf864fa90f40146562ae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\zAqEIlSfAD.bat

Filesize
222B

MD5
66b1570aa7167defd39243b79b5a7a88

SHA1
a24396531a1b08d9d184d33df363267e5f437f7b

SHA256
6b78a5b038cd8a5d217ff3cd3387458e2612a81cfbd917ab2b51b1b53925add8

SHA512
2eb18d4c084ddcee80d5f8e6867c8e40f1fbe71e106cc810efb6c9db07fe3d6cc041d86820def69ba7ff5d1f061919aa9620a948e51216483fdc95b053c727f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d413f61e23dfff7b50f221691d6f64d6

SHA1
d6dde9c75d8500d747c65d851aad3e35ac752be8

SHA256
12f4ff16ca586dadd1a0ab4ce9d9e043659cfd9ae31062744212d3a230fe583d

SHA512
3d4482a6168a79bc987c62ccddb0f8ff0b3c7ac570ab2fafc2417b085962d11a7fc0a3f15053422628abc7927fa4abb79533cdfa6a9013e04c294c7b4ba93ad2

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/108-647-0x0000000000910000-0x0000000000A20000-memory.dmp

Filesize
1.1MB

Download
memory/1192-587-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/1192-586-0x0000000000370000-0x0000000000480000-memory.dmp

Filesize
1.1MB

Download
memory/1228-108-0x0000000000E90000-0x0000000000FA0000-memory.dmp

Filesize
1.1MB

Download
memory/1500-526-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/1592-346-0x0000000000CA0000-0x0000000000DB0000-memory.dmp

Filesize
1.1MB

Download
memory/1716-86-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/1716-90-0x0000000002280000-0x0000000002288000-memory.dmp

Filesize
32KB

Download
memory/1716-226-0x00000000003A0000-0x00000000004B0000-memory.dmp

Filesize
1.1MB

Download
memory/2060-13-0x0000000001310000-0x0000000001420000-memory.dmp

Filesize
1.1MB

Download
memory/2060-14-0x00000000005E0000-0x00000000005F2000-memory.dmp

Filesize
72KB

Download
memory/2060-15-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/2060-16-0x00000000009A0000-0x00000000009AC000-memory.dmp

Filesize
48KB

Download
memory/2060-17-0x00000000009B0000-0x00000000009BC000-memory.dmp

Filesize
48KB

Download
memory/2172-407-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/2172-406-0x0000000001370000-0x0000000001480000-memory.dmp

Filesize
1.1MB

Download
memory/2288-286-0x0000000000860000-0x0000000000970000-memory.dmp

Filesize
1.1MB

Download