dcrat | dcfeed2e3f251eda0d02a7d904478b32b68b2636a5e93e48b2ffe23a93c97b1a

Analysis

max time kernel
149s
max time network
141s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_dcfeed2e3f251eda0d02a7d904478b32b68b2636a5e93e48b2ffe23a93c97b1a.exe
Size

1.3MB
MD5

ad5471db888f7b09826642339a850f5a
SHA1

f33c992829f4c0bc9a0756f32f33eec90c09bbcc
SHA256

dcfeed2e3f251eda0d02a7d904478b32b68b2636a5e93e48b2ffe23a93c97b1a
SHA512

dbe2163ce2877abca503ad14fd4ef7aa532b01d120871f12dd00df31f18d44954d2e2767a4d60e887c5d1a80f325f6fdf7e0153bf8e03ed47273d24f6ed26067
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2988	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2988	schtasks.exe	35

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016d31-9.dat	dcrat
behavioral1/memory/2168-13-0x0000000000280000-0x0000000000390000-memory.dmp	dcrat
behavioral1/memory/1564-70-0x0000000001270000-0x0000000001380000-memory.dmp	dcrat
behavioral1/memory/1176-130-0x0000000001280000-0x0000000001390000-memory.dmp	dcrat
behavioral1/memory/880-309-0x0000000000340000-0x0000000000450000-memory.dmp	dcrat
behavioral1/memory/2384-370-0x0000000001050000-0x0000000001160000-memory.dmp	dcrat
behavioral1/memory/2212-490-0x00000000001D0000-0x00000000002E0000-memory.dmp	dcrat
behavioral1/memory/2636-551-0x0000000000960000-0x0000000000A70000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1680	powershell.exe
2700	powershell.exe
2912	powershell.exe
2928	powershell.exe
2924	powershell.exe
2920	powershell.exe
1732	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2168	DllCommonsvc.exe
1564	OSPPSVC.exe
1176	OSPPSVC.exe
684	OSPPSVC.exe
2424	OSPPSVC.exe
880	OSPPSVC.exe
2384	OSPPSVC.exe
684	OSPPSVC.exe
2212	OSPPSVC.exe
2636	OSPPSVC.exe
2948	OSPPSVC.exe
2736	OSPPSVC.exe

Loads dropped DLL 2 IoCs

pid	Process
2684	cmd.exe
2684	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
16	raw.githubusercontent.com
30	raw.githubusercontent.com
34	raw.githubusercontent.com
4	raw.githubusercontent.com
13	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
37	raw.githubusercontent.com
5	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dcfeed2e3f251eda0d02a7d904478b32b68b2636a5e93e48b2ffe23a93c97b1a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\MuiCache	OSPPSVC.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\MuiCache	OSPPSVC.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\MuiCache	OSPPSVC.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\MuiCache	OSPPSVC.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\MuiCache	OSPPSVC.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\MuiCache	OSPPSVC.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\MuiCache	OSPPSVC.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\MuiCache	OSPPSVC.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\MuiCache	OSPPSVC.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\MuiCache	OSPPSVC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2716	schtasks.exe
1360	schtasks.exe
796	schtasks.exe
1596	schtasks.exe
1772	schtasks.exe
2840	schtasks.exe
2260	schtasks.exe
2500	schtasks.exe
2996	schtasks.exe
1536	schtasks.exe
2036	schtasks.exe
1528	schtasks.exe
1048	schtasks.exe
2564	schtasks.exe
1936	schtasks.exe
2040	schtasks.exe
2384	schtasks.exe
2816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2168	DllCommonsvc.exe
2168	DllCommonsvc.exe
2168	DllCommonsvc.exe
2912	powershell.exe
1732	powershell.exe
2924	powershell.exe
1680	powershell.exe
2700	powershell.exe
2920	powershell.exe
2928	powershell.exe
1564	OSPPSVC.exe
1176	OSPPSVC.exe
684	OSPPSVC.exe
2424	OSPPSVC.exe
880	OSPPSVC.exe
2384	OSPPSVC.exe
684	OSPPSVC.exe
2212	OSPPSVC.exe
2636	OSPPSVC.exe
2948	OSPPSVC.exe
2736	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	DllCommonsvc.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	1564	OSPPSVC.exe
Token: SeDebugPrivilege	1176	OSPPSVC.exe
Token: SeDebugPrivilege	684	OSPPSVC.exe
Token: SeDebugPrivilege	2424	OSPPSVC.exe
Token: SeDebugPrivilege	880	OSPPSVC.exe
Token: SeDebugPrivilege	2384	OSPPSVC.exe
Token: SeDebugPrivilege	684	OSPPSVC.exe
Token: SeDebugPrivilege	2212	OSPPSVC.exe
Token: SeDebugPrivilege	2636	OSPPSVC.exe
Token: SeDebugPrivilege	2948	OSPPSVC.exe
Token: SeDebugPrivilege	2736	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2752	3068	JaffaCakes118_dcfeed2e3f251eda0d02a7d904478b32b68b2636a5e93e48b2ffe23a93c97b1a.exe	31
PID 3068 wrote to memory of 2752	3068	JaffaCakes118_dcfeed2e3f251eda0d02a7d904478b32b68b2636a5e93e48b2ffe23a93c97b1a.exe	31
PID 3068 wrote to memory of 2752	3068	JaffaCakes118_dcfeed2e3f251eda0d02a7d904478b32b68b2636a5e93e48b2ffe23a93c97b1a.exe	31
PID 3068 wrote to memory of 2752	3068	JaffaCakes118_dcfeed2e3f251eda0d02a7d904478b32b68b2636a5e93e48b2ffe23a93c97b1a.exe	31
PID 2752 wrote to memory of 2684	2752	WScript.exe	32
PID 2752 wrote to memory of 2684	2752	WScript.exe	32
PID 2752 wrote to memory of 2684	2752	WScript.exe	32
PID 2752 wrote to memory of 2684	2752	WScript.exe	32
PID 2684 wrote to memory of 2168	2684	cmd.exe	34
PID 2684 wrote to memory of 2168	2684	cmd.exe	34
PID 2684 wrote to memory of 2168	2684	cmd.exe	34
PID 2684 wrote to memory of 2168	2684	cmd.exe	34
PID 2168 wrote to memory of 1680	2168	DllCommonsvc.exe	54
PID 2168 wrote to memory of 1680	2168	DllCommonsvc.exe	54
PID 2168 wrote to memory of 1680	2168	DllCommonsvc.exe	54
PID 2168 wrote to memory of 2700	2168	DllCommonsvc.exe	55
PID 2168 wrote to memory of 2700	2168	DllCommonsvc.exe	55
PID 2168 wrote to memory of 2700	2168	DllCommonsvc.exe	55
PID 2168 wrote to memory of 2912	2168	DllCommonsvc.exe	56
PID 2168 wrote to memory of 2912	2168	DllCommonsvc.exe	56
PID 2168 wrote to memory of 2912	2168	DllCommonsvc.exe	56
PID 2168 wrote to memory of 2928	2168	DllCommonsvc.exe	57
PID 2168 wrote to memory of 2928	2168	DllCommonsvc.exe	57
PID 2168 wrote to memory of 2928	2168	DllCommonsvc.exe	57
PID 2168 wrote to memory of 2924	2168	DllCommonsvc.exe	58
PID 2168 wrote to memory of 2924	2168	DllCommonsvc.exe	58
PID 2168 wrote to memory of 2924	2168	DllCommonsvc.exe	58
PID 2168 wrote to memory of 2920	2168	DllCommonsvc.exe	59
PID 2168 wrote to memory of 2920	2168	DllCommonsvc.exe	59
PID 2168 wrote to memory of 2920	2168	DllCommonsvc.exe	59
PID 2168 wrote to memory of 1732	2168	DllCommonsvc.exe	60
PID 2168 wrote to memory of 1732	2168	DllCommonsvc.exe	60
PID 2168 wrote to memory of 1732	2168	DllCommonsvc.exe	60
PID 2168 wrote to memory of 2172	2168	DllCommonsvc.exe	68
PID 2168 wrote to memory of 2172	2168	DllCommonsvc.exe	68
PID 2168 wrote to memory of 2172	2168	DllCommonsvc.exe	68
PID 2172 wrote to memory of 2184	2172	cmd.exe	70
PID 2172 wrote to memory of 2184	2172	cmd.exe	70
PID 2172 wrote to memory of 2184	2172	cmd.exe	70
PID 2172 wrote to memory of 1564	2172	cmd.exe	71
PID 2172 wrote to memory of 1564	2172	cmd.exe	71
PID 2172 wrote to memory of 1564	2172	cmd.exe	71
PID 1564 wrote to memory of 2528	1564	OSPPSVC.exe	72
PID 1564 wrote to memory of 2528	1564	OSPPSVC.exe	72
PID 1564 wrote to memory of 2528	1564	OSPPSVC.exe	72
PID 2528 wrote to memory of 1932	2528	cmd.exe	74
PID 2528 wrote to memory of 1932	2528	cmd.exe	74
PID 2528 wrote to memory of 1932	2528	cmd.exe	74
PID 2528 wrote to memory of 1176	2528	cmd.exe	75
PID 2528 wrote to memory of 1176	2528	cmd.exe	75
PID 2528 wrote to memory of 1176	2528	cmd.exe	75
PID 1176 wrote to memory of 1692	1176	OSPPSVC.exe	76
PID 1176 wrote to memory of 1692	1176	OSPPSVC.exe	76
PID 1176 wrote to memory of 1692	1176	OSPPSVC.exe	76
PID 1692 wrote to memory of 1644	1692	cmd.exe	78
PID 1692 wrote to memory of 1644	1692	cmd.exe	78
PID 1692 wrote to memory of 1644	1692	cmd.exe	78
PID 1692 wrote to memory of 684	1692	cmd.exe	79
PID 1692 wrote to memory of 684	1692	cmd.exe	79
PID 1692 wrote to memory of 684	1692	cmd.exe	79
PID 684 wrote to memory of 2700	684	OSPPSVC.exe	80
PID 684 wrote to memory of 2700	684	OSPPSVC.exe	80
PID 684 wrote to memory of 2700	684	OSPPSVC.exe	80
PID 2700 wrote to memory of 1688	2700	cmd.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dcfeed2e3f251eda0d02a7d904478b32b68b2636a5e93e48b2ffe23a93c97b1a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dcfeed2e3f251eda0d02a7d904478b32b68b2636a5e93e48b2ffe23a93c97b1a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Videos\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Favorites\Links\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\My Music\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IuDiLqiv5E.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2172
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2184
      - C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\Z303SGkpfh.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1932
        
        C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\rDj5Qf3YIo.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1644
        
        C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\SYN9b6Z77L.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1688
        
        C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\NbZQ8rtNu9.bat"
        13⤵
        
        PID:2804
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2880
        
        C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\6b8bDucqC9.bat"
        15⤵
        
        PID:2660
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1592
        
        C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\MeC4nzJt7G.bat"
        17⤵
        
        PID:3004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:532
        
        C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\LRKUjDoZ7F.bat"
        19⤵
        
        PID:2624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2600
        
        C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\OC0GCunrTP.bat"
        21⤵
        
        PID:292
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:328
        
        C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\yDLRlf4wIQ.bat"
        23⤵
        
        PID:2124
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1504
        
        C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Favorites\Links\yInpMt9jQQ.bat"
        25⤵
        
        PID:1488
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2664
        
        C:\Users\Admin\Favorites\Links\OSPPSVC.exe
        
        "C:\Users\Admin\Favorites\Links\OSPPSVC.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Documents\My Videos\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Videos\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Favorites\Links\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Favorites\Links\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Documents\My Music\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Music\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Documents\My Music\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74d6ed556de349caa347273118ec8ef4

SHA1
0f1eec7e5db2784f150b4e248407b0bf030939f0

SHA256
b877891db2bbc6d5713591f08b4a0901b15658a435be77d1c14d79ae328a59df

SHA512
ed810bdc48ee1037fdc1d00e7b5ed3cca514f9c45feae4c917087da997a93b268e045d4b3f690634a17716b379015fae1a495e933903515d7a7605f5da35ef68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fb6e67c3a7a7fa3df99ad6b6d01995d

SHA1
de31fde312a61ec3878d89e23db60f7d5685e042

SHA256
37e1243a3eb66d7e67878dcdceb69a529aded79d50e2e85b2e9671c21cd62d27

SHA512
3e2b1d7383d7508d9f5c825c956c4f8e4d3a91c8f6a2b9b46c00c3afdf83e10b9cb1152db5fe3899cbf0e84972677130e3262509f49947324f40035dc88bb8ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18e3660b222d9fb4e96381ec5fbc1374

SHA1
7f1c546b24e05eb527077eeff194b0eab3c53ea7

SHA256
8453cc5e634f27ebe69ddc301ba2e47c7e64ec26c978cfe14bf178e47bf83c5a

SHA512
34d718441d317bd2c659ca5e633b3014f90e3179df271bb5620e623ae9bae0b207aed4d4344fa8eff1274989f92ccfc5bbd5a21c79b7b750a249c90a82a86205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
809048435ddd8aa782046ef0cf73733a

SHA1
4596deba7d0d8199e2022445b30f5a5464edec14

SHA256
9bbfb22a6022dfdaa4eefad0d2733178e661fcc7cdd60ec141da6b95af5066db

SHA512
07c97e7ed9b746c73fc814b9b78d6e7889fc7b99ec641153b2c7192553afc666173a04473ebfdebb8d855019d929d5d4024deb926d071bc1680bc36cf33f441a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a283433cd45a988465fffb812604b5a3

SHA1
209b904d08b992eef1eead6f31c42a1922b3fe00

SHA256
fdc2995581fbcb6208aaefc33372da07f7f07a053e20083c2c82a64f90282011

SHA512
2b4d5ed987427d5d8da3d84d5cc4731498d75bfed22b3ae6b5ac402b0d38be771cbccd5cd01a8498ae38e159a6833e3bf773a4c7537420ae92ec4c320899b96d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9e4467c493a51893795b4195eca6b78

SHA1
5686c028384490876e36744091fb7ac8f3e9483d

SHA256
bcc76decbf8fe8aa7181dfe23e050c8f6f67f5752717a90b09e086b8b48f01b5

SHA512
0e121865911dcd6b2ee8886bec00708d068aab70e5d3426948ddedf6cc3cdf8a7aeec1f1400f7b971a69a2d8ac35e65baf1d3ce56274870ce7e129a458bd1428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a997e5871de248fccbf0f7822f14a5b

SHA1
ecaed565113c9e5f7826fdecd17adc26699d5e7d

SHA256
bc5cbfc7a8139630012414070216ecff24f3e97760eae299b52d285f16c1c67e

SHA512
8a7a06a4a28c6883e853f8ce84c29a9a87dcba50ef6a4e390f0b4e23c982093f4d034b4bf6dfd658defe3d71dfb3c0b2bef1714b63cfe9d36a045beffa24302c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f0f149b91412fb60d2b771ea314cc7a

SHA1
3b4413f09ff052b0054235281fb0b7b9a064be21

SHA256
d44527cc1837f6863fd2f29f07425e7b2ab9ba074b871802a4ebdf9656525acf

SHA512
6b615b2926807bfbc40bf557fe3aea6f6c992744ac8defe78c190ac68bc7a743c3008ca1c29da3276deaa0809003e922cf09fd03fbf1b6e286723f8b84cc8556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82c96c8e54b7561164b91c528afc89dd

SHA1
5f7f244428e72ef84fe18bf40cb9d96d8b0fa488

SHA256
c9105590fb9dd8bacaae6ef5791f5809a5f4cf9ed9f36f02f6c3223105d2acee

SHA512
5ca17b4fd8c7759872b5ef8f1016234ee6fb487786e1b8ffb5476b2bfe0915e7134170c10de2d0e4433f51b0960beac7a3cd7c964a814056c75319dbe8256109

Download Submit
C:\Users\Admin\AppData\LocalLow\Temp\Cab4B66.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Temp\Tar4B7A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IuDiLqiv5E.bat

Filesize
207B

MD5
7efdc6b761cd5b5825f42525be39c1f6

SHA1
e9ad8dc6913d48fa2560668b151f316f46c42bab

SHA256
4c1bbfba0b6f092099a8e63508b17fef1b38da2864220455f0982ca9e2a4b193

SHA512
a1e94458609851c93ccf621f4d6aa1c1ad273878a2f367a141315badc947c88d99fa5bcd15471faab32cc9d2ef1cdae81d8973c62b7a18f652515b1375ef32d9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3df874ca6f6e4a8a1e0e62129c498be9

SHA1
1e8cc2955f8317256dd3eb91e30e3d5b449dea6c

SHA256
fccdfa1ae864428f2155fd31dd5c14fbb7ad02fc1f7cc221576b3d3bee68cf91

SHA512
9a91062e4c2bad7abcf7a888715e638dd298e3d64f8b9df0732bf790fc16c0af7980128fa75a92df7d3afd9d1bcd69e9f9441861dec785a4cdb673549c88c659

Download Submit
C:\Users\Admin\Favorites\Links\6b8bDucqC9.bat

Filesize
203B

MD5
906ab0c9ccf7214834bb68791afda21c

SHA1
cd3327da0766e45e676496625951af8f6ec3af86

SHA256
faa0da40e781fcfdcef563c2d68e84ac641b0aacedae6a2ee45b63182e6acbbd

SHA512
c2102d7d464c858bf3e92adb8000eadb1fc39d0417d64fcc60fb0373d6dd7548815aecc923a3d4408519aaafbcc01a1b8bfd2af146207c4ce70905db83ea6ca5

Download Submit
C:\Users\Admin\Favorites\Links\LRKUjDoZ7F.bat

Filesize
203B

MD5
d4acde5bdfd89803b0fb88a63ecbf558

SHA1
5c8899adacda19d9ecb1cc3b9580b8d0fe1c775c

SHA256
96a3f5b741b16fc5e8a67639fc0aca4d3a1b21b0583520df935ef04b3d27fc30

SHA512
006a31791ebdd94e1aa04a57ab831f6a67e5dcc2ab67feca5fadb9b139cae807220d586efacbc1d5e37abbf5c7d681efcb5c90418fb5ed7efedbda0e3c3996bf

Download Submit
C:\Users\Admin\Favorites\Links\MeC4nzJt7G.bat

Filesize
203B

MD5
9f0d185dc70dea4f4a3390a2aa4f6b6b

SHA1
25fd3b99cfbfe28ba800de56646285998a0cec31

SHA256
f0e19da0327935c882390d0f9686e68edc9a3f0c1e278e3052a0ba227b77b3e1

SHA512
09ce5a4d9f685390757f286d8f85d30329ae56f18bdae8df4d1dabccd873fcac5c9399e79a416a48a7624b635751f6d6a0f93f589699a4f020f5177d758ae7c9

Download Submit
C:\Users\Admin\Favorites\Links\NbZQ8rtNu9.bat

Filesize
203B

MD5
a55b43adb46ffe7186b9e0e47027c56f

SHA1
24ad4e9410ba472ab46610ada9337efbf8b660ac

SHA256
423e840a2fa012fcd15ebfd77dea6c8511d492dad09a5e8bf1b9f1db6a383356

SHA512
a9b2cd562c7cbde2ec78eff005c52920500ca421e9eb7433c2162a4df3f0acd7a5a9776ae76aafa3be1e3e4b2c57db828ba7b1dfd7b19dfb1ded7539329998be

Download Submit
C:\Users\Admin\Favorites\Links\OC0GCunrTP.bat

Filesize
203B

MD5
b3c5cfd549f5d65a5d0f6f7571ceb0cb

SHA1
642ac5536e248a281f4bc8394d34f5097a3527ea

SHA256
1c19e12d235d010be65a3f71d3582bcc340b759d6673525a59a929615ca6690e

SHA512
7885cddb615ac51de78d7dcfab76c87c1d72d0c89bd7a8d3e45c9e64978e0b5785abf964766db3a2e05ef4dea14bb7568018042767d6359ada5e7a5d18e66dd1

Download Submit
C:\Users\Admin\Favorites\Links\SYN9b6Z77L.bat

Filesize
203B

MD5
1623596d460ffe4942f0d31a9e03cf1d

SHA1
de860144169acc5732fac07706309c20f7d9f604

SHA256
eecfa14298e78ede335118af37f7fec7ee19a4f8d9a92e13b3c18d79b3976177

SHA512
ae3868d8f58c58fc44478c0c57824b2f499e9ebe93f779c43f4cbd55f9560722c78efc21590eb21cbc37951d572c62448cb5fd47259e540fd3613c9a187d1387

Download Submit
C:\Users\Admin\Favorites\Links\Z303SGkpfh.bat

Filesize
203B

MD5
446368f08d79e7b86336d3e231733655

SHA1
9f1e8cc148d7847a9f3d54865165be2ee819e16a

SHA256
5f89afd89e881966aef827aa13f09b57ec2082d45f2e0a5f05896bfbc095cad5

SHA512
c4854c53731d34ce904c7c3e08b4fbc569d6d34c059101f33f8ae982197a154c7cbf937039a7e97331443165e392e8a10869de16bd7b1aacc2c0cd24cf760a10

Download Submit
C:\Users\Admin\Favorites\Links\rDj5Qf3YIo.bat

Filesize
203B

MD5
bf30e13464f6f695c676f5464043104b

SHA1
90ed2ae6f05ef7b5c279f23a7527564f1e1fc759

SHA256
9e9c0af283414f3e17ac4b4bffda10aa2568fd6bcd961f8941f068bb49341b99

SHA512
3257691508165fd13bc4267d1fc58380e914217434b2d92fe277f06cc4893f939fba6394914d11c05a48e5dbecfe60647bbd3b75e08a3a3a9e790a034ef97a40

Download Submit
C:\Users\Admin\Favorites\Links\yDLRlf4wIQ.bat

Filesize
203B

MD5
f090f352b908720fc96623eeaca91c4e

SHA1
eeaa736d4cdacddf0eefa7a626acc19d89a84a92

SHA256
06dc86a9c7b05849a9ac2eecf04d64e6120e8627e7409e8785243d1b65c55f22

SHA512
92d16638cbc8d6b849f1407dd8c17d69f53d1beba2aa830cc469f232462e622552424c7ad30d4651297b296dc6ce5d187ffa4fc67ba7b790c76df91c05ab32c2

Download Submit
C:\Users\Admin\Favorites\Links\yInpMt9jQQ.bat

Filesize
203B

MD5
03adc028a8524fb0222eabb8b9474d0f

SHA1
e0eb048177e3d2baad65805e64843576914344a5

SHA256
4fea4df4da426579f971ae75c30f74dc3287bfdfdfa74760d2c901c95b5eac49

SHA512
ee1abe72e20648f21ec345e480b8167a339d8870952052437031cfb4ac9cd8919514fbb6749ac4b4982103d10666bc1e480705854e9047ea2397c155a2f33e43

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/684-190-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/684-430-0x0000000000B90000-0x0000000000BA2000-memory.dmp

Filesize
72KB

Download
memory/880-310-0x0000000000330000-0x0000000000342000-memory.dmp

Filesize
72KB

Download
memory/880-309-0x0000000000340000-0x0000000000450000-memory.dmp

Filesize
1.1MB

Download
memory/1176-130-0x0000000001280000-0x0000000001390000-memory.dmp

Filesize
1.1MB

Download
memory/1564-70-0x0000000001270000-0x0000000001380000-memory.dmp

Filesize
1.1MB

Download
memory/1564-71-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/1732-45-0x0000000002050000-0x0000000002058000-memory.dmp

Filesize
32KB

Download
memory/2168-15-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/2168-14-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2168-17-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2168-16-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2168-13-0x0000000000280000-0x0000000000390000-memory.dmp

Filesize
1.1MB

Download
memory/2212-490-0x00000000001D0000-0x00000000002E0000-memory.dmp

Filesize
1.1MB

Download
memory/2212-491-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2384-370-0x0000000001050000-0x0000000001160000-memory.dmp

Filesize
1.1MB

Download
memory/2636-551-0x0000000000960000-0x0000000000A70000-memory.dmp

Filesize
1.1MB

Download
memory/2912-43-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download