dcrat | 11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480

Analysis

max time kernel
143s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe
Size

1.3MB
MD5

f2803766a2f7cea3e91c2840ac2f85a6
SHA1

546004d9f413ae33db3b6d74eceea26e6453b596
SHA256

11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480
SHA512

c6116141dcc7ebb3efcffda6f128e9a5b0c586f26ce6bb86e738eb2d89a781bac053e4f77b7314236e59df4ecf6f4b561be131b025db9fedbf89ec0f1672f491
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2796	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2796	schtasks.exe	35

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016d46-9.dat	dcrat
behavioral1/memory/2732-13-0x0000000000CC0000-0x0000000000DD0000-memory.dmp	dcrat
behavioral1/memory/2584-60-0x0000000000300000-0x0000000000410000-memory.dmp	dcrat
behavioral1/memory/752-180-0x0000000000220000-0x0000000000330000-memory.dmp	dcrat
behavioral1/memory/2016-241-0x0000000000C20000-0x0000000000D30000-memory.dmp	dcrat
behavioral1/memory/2452-361-0x0000000000E90000-0x0000000000FA0000-memory.dmp	dcrat
behavioral1/memory/2976-421-0x0000000001200000-0x0000000001310000-memory.dmp	dcrat
behavioral1/memory/1460-481-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat
behavioral1/memory/2812-542-0x0000000001100000-0x0000000001210000-memory.dmp	dcrat
behavioral1/memory/1064-602-0x0000000001130000-0x0000000001240000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
700	powershell.exe
1020	powershell.exe
2132	powershell.exe
2540	powershell.exe
352	powershell.exe
556	powershell.exe
324	powershell.exe
1416	powershell.exe
1660	powershell.exe
2448	powershell.exe
1916	powershell.exe
3044	powershell.exe
2264	powershell.exe
2464	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2732	DllCommonsvc.exe
2584	winlogon.exe
752	winlogon.exe
2016	winlogon.exe
1224	winlogon.exe
2452	winlogon.exe
2976	winlogon.exe
1460	winlogon.exe
2812	winlogon.exe
1064	winlogon.exe
2416	winlogon.exe
2728	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2284	cmd.exe
2284	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
34	raw.githubusercontent.com
37	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
20	raw.githubusercontent.com
31	raw.githubusercontent.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Office\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\75a57c1bdf437c	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\OSPPSVC.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\1610b97d3ab4a7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\42af1c969fbb7b	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\it-IT\audiodg.exe	DllCommonsvc.exe
File created	C:\Windows\it-IT\42af1c969fbb7b	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1224	schtasks.exe
1724	schtasks.exe
2244	schtasks.exe
2596	schtasks.exe
2844	schtasks.exe
1812	schtasks.exe
1192	schtasks.exe
572	schtasks.exe
2908	schtasks.exe
948	schtasks.exe
1836	schtasks.exe
3024	schtasks.exe
2972	schtasks.exe
1612	schtasks.exe
688	schtasks.exe
1384	schtasks.exe
1892	schtasks.exe
2020	schtasks.exe
2012	schtasks.exe
1728	schtasks.exe
1672	schtasks.exe
2180	schtasks.exe
944	schtasks.exe
1776	schtasks.exe
2224	schtasks.exe
2008	schtasks.exe
1244	schtasks.exe
1940	schtasks.exe
1684	schtasks.exe
2876	schtasks.exe
2552	schtasks.exe
1616	schtasks.exe
1860	schtasks.exe
2212	schtasks.exe
2184	schtasks.exe
1500	schtasks.exe
1460	schtasks.exe
2852	schtasks.exe
2688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2732	DllCommonsvc.exe
2732	DllCommonsvc.exe
2732	DllCommonsvc.exe
2732	DllCommonsvc.exe
2732	DllCommonsvc.exe
700	powershell.exe
2132	powershell.exe
1660	powershell.exe
1020	powershell.exe
3044	powershell.exe
2264	powershell.exe
1916	powershell.exe
556	powershell.exe
2464	powershell.exe
2540	powershell.exe
1416	powershell.exe
324	powershell.exe
2448	powershell.exe
352	powershell.exe
2584	winlogon.exe
752	winlogon.exe
2016	winlogon.exe
1224	winlogon.exe
2452	winlogon.exe
2976	winlogon.exe
1460	winlogon.exe
2812	winlogon.exe
1064	winlogon.exe
2416	winlogon.exe
2728	winlogon.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	DllCommonsvc.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	324	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	352	powershell.exe
Token: SeDebugPrivilege	2584	winlogon.exe
Token: SeDebugPrivilege	752	winlogon.exe
Token: SeDebugPrivilege	2016	winlogon.exe
Token: SeDebugPrivilege	1224	winlogon.exe
Token: SeDebugPrivilege	2452	winlogon.exe
Token: SeDebugPrivilege	2976	winlogon.exe
Token: SeDebugPrivilege	1460	winlogon.exe
Token: SeDebugPrivilege	2812	winlogon.exe
Token: SeDebugPrivilege	1064	winlogon.exe
Token: SeDebugPrivilege	2416	winlogon.exe
Token: SeDebugPrivilege	2728	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2368	2068	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe	30
PID 2068 wrote to memory of 2368	2068	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe	30
PID 2068 wrote to memory of 2368	2068	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe	30
PID 2068 wrote to memory of 2368	2068	JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe	30
PID 2368 wrote to memory of 2284	2368	WScript.exe	32
PID 2368 wrote to memory of 2284	2368	WScript.exe	32
PID 2368 wrote to memory of 2284	2368	WScript.exe	32
PID 2368 wrote to memory of 2284	2368	WScript.exe	32
PID 2284 wrote to memory of 2732	2284	cmd.exe	34
PID 2284 wrote to memory of 2732	2284	cmd.exe	34
PID 2284 wrote to memory of 2732	2284	cmd.exe	34
PID 2284 wrote to memory of 2732	2284	cmd.exe	34
PID 2732 wrote to memory of 2540	2732	DllCommonsvc.exe	75
PID 2732 wrote to memory of 2540	2732	DllCommonsvc.exe	75
PID 2732 wrote to memory of 2540	2732	DllCommonsvc.exe	75
PID 2732 wrote to memory of 3044	2732	DllCommonsvc.exe	76
PID 2732 wrote to memory of 3044	2732	DllCommonsvc.exe	76
PID 2732 wrote to memory of 3044	2732	DllCommonsvc.exe	76
PID 2732 wrote to memory of 2132	2732	DllCommonsvc.exe	77
PID 2732 wrote to memory of 2132	2732	DllCommonsvc.exe	77
PID 2732 wrote to memory of 2132	2732	DllCommonsvc.exe	77
PID 2732 wrote to memory of 700	2732	DllCommonsvc.exe	79
PID 2732 wrote to memory of 700	2732	DllCommonsvc.exe	79
PID 2732 wrote to memory of 700	2732	DllCommonsvc.exe	79
PID 2732 wrote to memory of 556	2732	DllCommonsvc.exe	80
PID 2732 wrote to memory of 556	2732	DllCommonsvc.exe	80
PID 2732 wrote to memory of 556	2732	DllCommonsvc.exe	80
PID 2732 wrote to memory of 2264	2732	DllCommonsvc.exe	82
PID 2732 wrote to memory of 2264	2732	DllCommonsvc.exe	82
PID 2732 wrote to memory of 2264	2732	DllCommonsvc.exe	82
PID 2732 wrote to memory of 352	2732	DllCommonsvc.exe	84
PID 2732 wrote to memory of 352	2732	DllCommonsvc.exe	84
PID 2732 wrote to memory of 352	2732	DllCommonsvc.exe	84
PID 2732 wrote to memory of 1916	2732	DllCommonsvc.exe	85
PID 2732 wrote to memory of 1916	2732	DllCommonsvc.exe	85
PID 2732 wrote to memory of 1916	2732	DllCommonsvc.exe	85
PID 2732 wrote to memory of 2448	2732	DllCommonsvc.exe	86
PID 2732 wrote to memory of 2448	2732	DllCommonsvc.exe	86
PID 2732 wrote to memory of 2448	2732	DllCommonsvc.exe	86
PID 2732 wrote to memory of 1660	2732	DllCommonsvc.exe	87
PID 2732 wrote to memory of 1660	2732	DllCommonsvc.exe	87
PID 2732 wrote to memory of 1660	2732	DllCommonsvc.exe	87
PID 2732 wrote to memory of 2464	2732	DllCommonsvc.exe	88
PID 2732 wrote to memory of 2464	2732	DllCommonsvc.exe	88
PID 2732 wrote to memory of 2464	2732	DllCommonsvc.exe	88
PID 2732 wrote to memory of 1416	2732	DllCommonsvc.exe	89
PID 2732 wrote to memory of 1416	2732	DllCommonsvc.exe	89
PID 2732 wrote to memory of 1416	2732	DllCommonsvc.exe	89
PID 2732 wrote to memory of 324	2732	DllCommonsvc.exe	90
PID 2732 wrote to memory of 324	2732	DllCommonsvc.exe	90
PID 2732 wrote to memory of 324	2732	DllCommonsvc.exe	90
PID 2732 wrote to memory of 1020	2732	DllCommonsvc.exe	91
PID 2732 wrote to memory of 1020	2732	DllCommonsvc.exe	91
PID 2732 wrote to memory of 1020	2732	DllCommonsvc.exe	91
PID 2732 wrote to memory of 2584	2732	DllCommonsvc.exe	103
PID 2732 wrote to memory of 2584	2732	DllCommonsvc.exe	103
PID 2732 wrote to memory of 2584	2732	DllCommonsvc.exe	103
PID 2584 wrote to memory of 888	2584	winlogon.exe	105
PID 2584 wrote to memory of 888	2584	winlogon.exe	105
PID 2584 wrote to memory of 888	2584	winlogon.exe	105
PID 888 wrote to memory of 1560	888	cmd.exe	107
PID 888 wrote to memory of 1560	888	cmd.exe	107
PID 888 wrote to memory of 1560	888	cmd.exe	107
PID 888 wrote to memory of 752	888	cmd.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\en-US\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Office\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\de-DE\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
    - - C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1560
        
        C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JhFjyqSsxH.bat"
        8⤵
        
        PID:2976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:988
        
        C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat"
        10⤵
        
        PID:1460
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2920
        
        C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat"
        12⤵
        
        PID:1480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2184
        
        C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tbw0avzYF4.bat"
        14⤵
        
        PID:2156
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1916
        
        C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VAhDAdBh8f.bat"
        16⤵
        
        PID:2824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:1172
        
        C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat"
        18⤵
        
        PID:932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1668
        
        C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YQG5KQjShu.bat"
        20⤵
        
        PID:1940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2840
        
        C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y29a6RA8xz.bat"
        22⤵
        
        PID:824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2364
        
        C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8t4fMT0wY0.bat"
        24⤵
        
        PID:2220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2968
        
        C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe
        
        "C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Users\Public\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Public\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Users\Public\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Office14\1033\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Office\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Office\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\providercommon\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\providercommon\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\providercommon\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\providercommon\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\de-DE\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\de-DE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\de-DE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4090f11d683def34e4903549107bc62

SHA1
2d8ae392dae0fe45e64da0b6bd6c45047d833ab9

SHA256
c2c5d80aeb19f3bae9e2f4888c1d4f650aac5ee06f31e2df181850f7c9398aa5

SHA512
5d7723cec8774d06c811b8d75a9be88a8965a6f7f3a44aea0a80199014d4aff3281aab22c00f10756f827df719a51779b34056dfa15214f827b3704fd79b35a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0064915aeffcd748fad3c78f0e1de20f

SHA1
80043483268f9c64b320a8acb8102fed370b210f

SHA256
1a8c0044d1d84ca846a372276481c17af1f2c5c4569ae083cc9579370f186ff4

SHA512
5ee12cab3a874a825817fa7408f5c2112fa231f162d35102726d234f74bb5788374bafc20ed856680bbf96b89bc32f73378be818444aa5e61d4112ae1b8eada4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
043b358a97d41e19d9f09af5878ce111

SHA1
c0110d9c737188a1545e66d491a0f6510b2d8675

SHA256
fce673061b0c74b5a8b0e4b6189bdbec260e86871fff03f11e8ff6d84a42619d

SHA512
be5b70f0ef6f5a9cfb4d7ae656e81f9d278831a23faf71b148b0db1775a97cc131394035549cb08daded2f2f7c42a0076b602709d1f4756ebcc78f41996860e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc08b951b818c6f9bb18ef7fde523e50

SHA1
c3b835da4c86d60aa5d2c13b6a12a8423b37a9a8

SHA256
bd8ce838ca3cbf50b8518c2e05e3630b37d537f484ba3e26f4074268dee9e982

SHA512
16df44a9ae44d52fe3fd4d1571a979167cac6aaad12a0911519d1a1698affd1dc2ca36d5c910d47cfb5ef1806d0feff423234018ec705c73484edbe2ed62f7e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a7ed8cc962d902f2150a71dbf0b3491

SHA1
87a70ce98058452c69738de4bd5db470d6816add

SHA256
3a26c1a90484708e22ba7ef3fa279fb46aad3b0f53958e5a8228fcb7fca9f264

SHA512
d5a4f7c84d057a5327304d94c6d7b4a534fcfa29ba297f24f7e883443caf8dd8372124cf87482ecaacaf05d32d158889e84fd49003778921cf4d278f32e4a9d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
297bbdd85fa7a4ae53bbad1fd85837c2

SHA1
b47f04a66ca278186e3ab2929888ac7eff58de37

SHA256
dbc9748d3127a5ced92ca61ed8f31ce40563931abb054a3b2d4df07c31112754

SHA512
7bf2f9e024c34f1e507c05a57975403b2e110027dec8ffba2435a213e216feb3be609794d43cf8a17bcfe15451fa443dcc1763f6c689d50c9fe71eb47869e70a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cba6e95807e28bc8defda5a2d47d62f6

SHA1
305063a44f2bd1d11b63a524dc9fba7ad52b6957

SHA256
39ac0b0408713c531a95edd17de06b4287c79861398ae82d4ae08dec5a40d009

SHA512
4b3a433bbf14bae33bce9930654f23d9c578205a98d5fa8817439a1c7022c9953f753dc37edcf9d50c66230744ddab184d2f2df08e25b2c5c3cc8f86cdc29aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf534c510f956468fb7e0d7b0b836b6f

SHA1
25463a59d94e1b4d4436e38e1b78b669fb3a1e34

SHA256
723aaab1a65b0d5be485dcb6ade3031d55d06cb7ea4a2b311fb672d1793ad214

SHA512
ea7dea9f6be9b727507d3a19c1b3c98dcbf34cd2ffe389c4f141a098631fab4817820b96eaf9397c0d5e8cd94ef71019596d3bc706d5099ee5bd5e5fc2ee6c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ca426afec7562e0c9d52347e03be346

SHA1
e36bdf81354235ff88373b143d93189e7e340e83

SHA256
396bba821c64f01fccdc609a04c5a8c6b1ccdb601a18f4a107939682a997f580

SHA512
6a91ae804dc38d6580f8bebc5aeceeffd32093b3016c08e0615901a97656d7783ce55c2c69e4659219d05d1564ab33c9deb2a3315f9053f968d69bfebc501066

Download Submit
C:\Users\Admin\AppData\Local\Temp\8t4fMT0wY0.bat

Filesize
221B

MD5
6979bd9ed25b0c94b4f2c31e0f9d497f

SHA1
d2e9fb4adcc880f95b4e94e9d7d02428f5307632

SHA256
2fc46fbf651948605e2076fdbe999a71ef56354c8f48cd12916f6259ebc24102

SHA512
2a23bca4993974d689f8b8db03cadd0ab0c29e6b9bc9bcf095ffe991bc78fe28cde1f0733c20e044b900689d92d96c96080caaedf583cbe62c1bf73b95a12aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab122C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\JhFjyqSsxH.bat

Filesize
221B

MD5
67a5e9ef6e40e08f909deda48dc299b7

SHA1
0a5ec871c11195412f519c50e0ae70fb66e43807

SHA256
844d23b62e59243f7c588df22b86375402a3786d0ad591555b1524ca8f2a93c6

SHA512
4ef54884246731814150590cb3115b5724edfde69eb22cec3da09d381df756948bd1ecd3c21fee4c704fd9583a4a12243797441706703b733a06c3c6a82033c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat

Filesize
221B

MD5
65685c8f3aab6321198a9a2436ac9427

SHA1
d1a4007f34241c15a3086ddaa25411101f7d6d37

SHA256
6f31acf34cd2400078d1d0e6a460ab12a55811aa9a454dd0c07d6c913e48fbcd

SHA512
090f855d14b1fe16eff5df14a94322d742cb6b67fd2028c402fd739df20b0b621d527e6d9100e2f33802b1bb0dbca1940e5be557671837f6235e5acce02895ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\SvvYNrLnHE.bat

Filesize
221B

MD5
96f8954a8d0b97c8d9985cad2637df32

SHA1
ff31b963e15a24e03eace7c564bf11f32d5934e6

SHA256
6c77c206d2504bbe0e5cec1154ed815a4fb189e43cb8bd06e12afe499b3a2bd0

SHA512
9ce765a0bf2eac0fa218d76e836f79f39d658bbd2a0745a3061ae37980b04e2e4a223621c433a4feedaf2ef0354af523c2508a2684a63e5352bea19afcc9580a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar124E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VAhDAdBh8f.bat

Filesize
221B

MD5
645c1928fbef5364b90994eb78d8588c

SHA1
c9358552fbf75d859a85c89622d01ffe37eb9674

SHA256
03bae5e2ae4edef27e8ee123876d772f62df889d54b1f68f47dc5cfb7a3c6f37

SHA512
993ef85f662c8f30f00a7f4b88dbe620e3f8fa62a6037115bab577d43939438331c3995dd3d9405954a2bdf75954a620dafbe66d2ff961723cb2dcef83060896

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y29a6RA8xz.bat

Filesize
221B

MD5
cb0b89567f2824a6d1ee0459d4573099

SHA1
065af58ea21649c17aa1e5d81fa3264625eb5653

SHA256
071fec8cc659d9278d5d261d2794eff133603d51385f1e9313e632dd62a4eed8

SHA512
46803dfe0f216094542445ffcf4a67c17191407fd4e9391df9c618b69c0894bc0e72569309af3dbbdf8d21baf929c96f88b41fe5f8c31178e7a522009cb6f053

Download Submit
C:\Users\Admin\AppData\Local\Temp\YQG5KQjShu.bat

Filesize
221B

MD5
a52adee42ef0cc5bd40ec2cf365e4816

SHA1
f3989216aaffcff88a88902ca62b324dbd8c3451

SHA256
1c7378fc87ce1a052671e6379a8db5c05884776851235a346c6092cabc1dd6f7

SHA512
03d04af9b46d9a7ffb434a30e13bbd2b5eb8b0960f136bd8a2513cd91145e9d8c0206e9aa150060fd1210931d3eae1039937a7d19200773160192608ac50bbdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat

Filesize
221B

MD5
02e529a28bd6ce2f2fdc46b9f1c7c216

SHA1
46bdeb447675e8d2bf6b8bf1df2cfe54235a54c4

SHA256
245b7daff3b42dee5ffac926df3705a4dee4ebfddc268d053a2c8a459942569e

SHA512
ce79c0b641667bd9c32d8608a2de3649e7e519391afa167944811d490105bd32962eb2a180a810c13f582d81046af76eba671aaca99147cc89bb460bc63af126

Download Submit
C:\Users\Admin\AppData\Local\Temp\tbw0avzYF4.bat

Filesize
221B

MD5
a2f7d2a0b081d7f752a4751d60b1e3a6

SHA1
c310a424c56168feae23a6b5c35f51ebc77cefb9

SHA256
b3dd15a5c1e0bacc24d87eefe69068a4d216a7b75f8f2edb1f554970674b6a82

SHA512
7304a3d21351585c4fc13a7271b4ebf955e3ba89cfba1e3b4efd7e11bd85245677b1197b327b065e6cc3dd5fc609dfbb6b53341941825b95773d197728fbe470

Download Submit
C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat

Filesize
221B

MD5
c835736a78bf064d529557a9a6ec5e2f

SHA1
a78bb8495ea7e3bdd252fe853798ed3da16c3b95

SHA256
feac4c82a98572c17d699e72e64218add82e70a1b0f6f2345870ae6b8a7e6877

SHA512
f9ae3e90f949d80e334d2cd7dbea153b6b15170ad86e675fdb31101d3d9d91a1cd65b4e470e7579b7e783f70de83aae91b6d3b0c77ef6207bb2952f0ed99a768

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0d48d9ede5e58d4735709893bb584d7a

SHA1
129f1edf37b22134ef57066472d16a84ec047de5

SHA256
bef3356be89308492bc2614c543d4ea8ba781a8ee02cacb59a5a96708c4b4560

SHA512
d669fa044f3377081f2751d79b83bb633ef5c685b0a8787791497ca02c5234095610c670573fa29bd7cc10ab7632bf91c69a7079ac60f3f8bd622bed5790ae8c

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/700-59-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/700-61-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/752-181-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/752-180-0x0000000000220000-0x0000000000330000-memory.dmp

Filesize
1.1MB

Download
memory/1064-602-0x0000000001130000-0x0000000001240000-memory.dmp

Filesize
1.1MB

Download
memory/1064-603-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/1224-301-0x0000000000590000-0x00000000005A2000-memory.dmp

Filesize
72KB

Download
memory/1460-482-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/1460-481-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download
memory/2016-241-0x0000000000C20000-0x0000000000D30000-memory.dmp

Filesize
1.1MB

Download
memory/2452-361-0x0000000000E90000-0x0000000000FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2584-60-0x0000000000300000-0x0000000000410000-memory.dmp

Filesize
1.1MB

Download
memory/2732-17-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

Filesize
48KB

Download
memory/2732-16-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/2732-15-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2732-14-0x00000000003E0000-0x00000000003F2000-memory.dmp

Filesize
72KB

Download
memory/2732-13-0x0000000000CC0000-0x0000000000DD0000-memory.dmp

Filesize
1.1MB

Download
memory/2812-542-0x0000000001100000-0x0000000001210000-memory.dmp

Filesize
1.1MB

Download
memory/2976-421-0x0000000001200000-0x0000000001310000-memory.dmp

Filesize
1.1MB

Download