dcrat | eb53f773dd30ea38d01b3684c2daf4d1b688592be14bd4b660bf6dd02c873b69

Analysis

max time kernel
148s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_eb53f773dd30ea38d01b3684c2daf4d1b688592be14bd4b660bf6dd02c873b69.exe
Size

1.3MB
MD5

4b37b6b4097d944ba7d9724243c70fb4
SHA1

74a967fecb6f243651a035e6fdc8a46dd624ed3c
SHA256

eb53f773dd30ea38d01b3684c2daf4d1b688592be14bd4b660bf6dd02c873b69
SHA512

10e130deef7f781b6e7c66ccefc45c1708097e763077bec3f6f42f226eb1ed371c0c7e00bda189f609b03f149df921159939a65b3135d3301e22f32e2d79c432
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	2832	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2832	schtasks.exe	35

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000600000001875d-12.dat	dcrat
behavioral1/memory/2564-13-0x0000000000C60000-0x0000000000D70000-memory.dmp	dcrat
behavioral1/memory/1512-108-0x00000000009B0000-0x0000000000AC0000-memory.dmp	dcrat
behavioral1/memory/2444-167-0x00000000001C0000-0x00000000002D0000-memory.dmp	dcrat
behavioral1/memory/332-227-0x0000000001310000-0x0000000001420000-memory.dmp	dcrat
behavioral1/memory/1656-287-0x00000000001A0000-0x00000000002B0000-memory.dmp	dcrat
behavioral1/memory/1704-347-0x0000000000EF0000-0x0000000001000000-memory.dmp	dcrat
behavioral1/memory/916-526-0x00000000002A0000-0x00000000003B0000-memory.dmp	dcrat
behavioral1/memory/2432-587-0x0000000000A50000-0x0000000000B60000-memory.dmp	dcrat
behavioral1/memory/1244-647-0x0000000000310000-0x0000000000420000-memory.dmp	dcrat
behavioral1/memory/2768-707-0x0000000000C70000-0x0000000000D80000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1476	powershell.exe
1924	powershell.exe
1464	powershell.exe
1880	powershell.exe
2456	powershell.exe
936	powershell.exe
1908	powershell.exe
2936	powershell.exe
1664	powershell.exe
916	powershell.exe
1636	powershell.exe
1148	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2564	DllCommonsvc.exe
1512	wininit.exe
2444	wininit.exe
332	wininit.exe
1656	wininit.exe
1704	wininit.exe
2924	wininit.exe
1700	wininit.exe
916	wininit.exe
2432	wininit.exe
1244	wininit.exe
2768	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
2828	cmd.exe
2828	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
20	raw.githubusercontent.com
23	raw.githubusercontent.com
29	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
13	raw.githubusercontent.com
33	raw.githubusercontent.com
36	raw.githubusercontent.com
9	raw.githubusercontent.com
17	raw.githubusercontent.com
26	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\explorer.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\ja-JP\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\ja-JP\56085415360792	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Uninstall Information\56085415360792	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\69ddcba757bf72	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Vss\Writers\System\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Windows\TAPI\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\TAPI\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Windows\Vss\Writers\System\spoolsv.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_eb53f773dd30ea38d01b3684c2daf4d1b688592be14bd4b660bf6dd02c873b69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2012	schtasks.exe
1548	schtasks.exe
2164	schtasks.exe
2244	schtasks.exe
2620	schtasks.exe
1612	schtasks.exe
2736	schtasks.exe
2884	schtasks.exe
3000	schtasks.exe
1536	schtasks.exe
2820	schtasks.exe
2188	schtasks.exe
2328	schtasks.exe
1872	schtasks.exe
2376	schtasks.exe
3064	schtasks.exe
264	schtasks.exe
1128	schtasks.exe
1896	schtasks.exe
1640	schtasks.exe
1268	schtasks.exe
2344	schtasks.exe
3028	schtasks.exe
468	schtasks.exe
3068	schtasks.exe
1520	schtasks.exe
2004	schtasks.exe
1360	schtasks.exe
672	schtasks.exe
840	schtasks.exe
3060	schtasks.exe
1616	schtasks.exe
1600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2564	DllCommonsvc.exe
1880	powershell.exe
1664	powershell.exe
1908	powershell.exe
1476	powershell.exe
1464	powershell.exe
916	powershell.exe
1148	powershell.exe
2456	powershell.exe
1636	powershell.exe
1924	powershell.exe
936	powershell.exe
2936	powershell.exe
1512	wininit.exe
2444	wininit.exe
332	wininit.exe
1656	wininit.exe
1704	wininit.exe
2924	wininit.exe
1700	wininit.exe
916	wininit.exe
2432	wininit.exe
1244	wininit.exe
2768	wininit.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	DllCommonsvc.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	1512	wininit.exe
Token: SeDebugPrivilege	2444	wininit.exe
Token: SeDebugPrivilege	332	wininit.exe
Token: SeDebugPrivilege	1656	wininit.exe
Token: SeDebugPrivilege	1704	wininit.exe
Token: SeDebugPrivilege	2924	wininit.exe
Token: SeDebugPrivilege	1700	wininit.exe
Token: SeDebugPrivilege	916	wininit.exe
Token: SeDebugPrivilege	2432	wininit.exe
Token: SeDebugPrivilege	1244	wininit.exe
Token: SeDebugPrivilege	2768	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2660	2848	JaffaCakes118_eb53f773dd30ea38d01b3684c2daf4d1b688592be14bd4b660bf6dd02c873b69.exe	31
PID 2848 wrote to memory of 2660	2848	JaffaCakes118_eb53f773dd30ea38d01b3684c2daf4d1b688592be14bd4b660bf6dd02c873b69.exe	31
PID 2848 wrote to memory of 2660	2848	JaffaCakes118_eb53f773dd30ea38d01b3684c2daf4d1b688592be14bd4b660bf6dd02c873b69.exe	31
PID 2848 wrote to memory of 2660	2848	JaffaCakes118_eb53f773dd30ea38d01b3684c2daf4d1b688592be14bd4b660bf6dd02c873b69.exe	31
PID 2660 wrote to memory of 2828	2660	WScript.exe	32
PID 2660 wrote to memory of 2828	2660	WScript.exe	32
PID 2660 wrote to memory of 2828	2660	WScript.exe	32
PID 2660 wrote to memory of 2828	2660	WScript.exe	32
PID 2828 wrote to memory of 2564	2828	cmd.exe	34
PID 2828 wrote to memory of 2564	2828	cmd.exe	34
PID 2828 wrote to memory of 2564	2828	cmd.exe	34
PID 2828 wrote to memory of 2564	2828	cmd.exe	34
PID 2564 wrote to memory of 1664	2564	DllCommonsvc.exe	69
PID 2564 wrote to memory of 1664	2564	DllCommonsvc.exe	69
PID 2564 wrote to memory of 1664	2564	DllCommonsvc.exe	69
PID 2564 wrote to memory of 1924	2564	DllCommonsvc.exe	70
PID 2564 wrote to memory of 1924	2564	DllCommonsvc.exe	70
PID 2564 wrote to memory of 1924	2564	DllCommonsvc.exe	70
PID 2564 wrote to memory of 1636	2564	DllCommonsvc.exe	71
PID 2564 wrote to memory of 1636	2564	DllCommonsvc.exe	71
PID 2564 wrote to memory of 1636	2564	DllCommonsvc.exe	71
PID 2564 wrote to memory of 916	2564	DllCommonsvc.exe	72
PID 2564 wrote to memory of 916	2564	DllCommonsvc.exe	72
PID 2564 wrote to memory of 916	2564	DllCommonsvc.exe	72
PID 2564 wrote to memory of 1148	2564	DllCommonsvc.exe	73
PID 2564 wrote to memory of 1148	2564	DllCommonsvc.exe	73
PID 2564 wrote to memory of 1148	2564	DllCommonsvc.exe	73
PID 2564 wrote to memory of 1880	2564	DllCommonsvc.exe	74
PID 2564 wrote to memory of 1880	2564	DllCommonsvc.exe	74
PID 2564 wrote to memory of 1880	2564	DllCommonsvc.exe	74
PID 2564 wrote to memory of 936	2564	DllCommonsvc.exe	75
PID 2564 wrote to memory of 936	2564	DllCommonsvc.exe	75
PID 2564 wrote to memory of 936	2564	DllCommonsvc.exe	75
PID 2564 wrote to memory of 1464	2564	DllCommonsvc.exe	76
PID 2564 wrote to memory of 1464	2564	DllCommonsvc.exe	76
PID 2564 wrote to memory of 1464	2564	DllCommonsvc.exe	76
PID 2564 wrote to memory of 2456	2564	DllCommonsvc.exe	77
PID 2564 wrote to memory of 2456	2564	DllCommonsvc.exe	77
PID 2564 wrote to memory of 2456	2564	DllCommonsvc.exe	77
PID 2564 wrote to memory of 1908	2564	DllCommonsvc.exe	78
PID 2564 wrote to memory of 1908	2564	DllCommonsvc.exe	78
PID 2564 wrote to memory of 1908	2564	DllCommonsvc.exe	78
PID 2564 wrote to memory of 2936	2564	DllCommonsvc.exe	79
PID 2564 wrote to memory of 2936	2564	DllCommonsvc.exe	79
PID 2564 wrote to memory of 2936	2564	DllCommonsvc.exe	79
PID 2564 wrote to memory of 1476	2564	DllCommonsvc.exe	80
PID 2564 wrote to memory of 1476	2564	DllCommonsvc.exe	80
PID 2564 wrote to memory of 1476	2564	DllCommonsvc.exe	80
PID 2564 wrote to memory of 3008	2564	DllCommonsvc.exe	87
PID 2564 wrote to memory of 3008	2564	DllCommonsvc.exe	87
PID 2564 wrote to memory of 3008	2564	DllCommonsvc.exe	87
PID 3008 wrote to memory of 2320	3008	cmd.exe	95
PID 3008 wrote to memory of 2320	3008	cmd.exe	95
PID 3008 wrote to memory of 2320	3008	cmd.exe	95
PID 3008 wrote to memory of 1512	3008	cmd.exe	96
PID 3008 wrote to memory of 1512	3008	cmd.exe	96
PID 3008 wrote to memory of 1512	3008	cmd.exe	96
PID 1512 wrote to memory of 1904	1512	wininit.exe	97
PID 1512 wrote to memory of 1904	1512	wininit.exe	97
PID 1512 wrote to memory of 1904	1512	wininit.exe	97
PID 1904 wrote to memory of 2148	1904	cmd.exe	99
PID 1904 wrote to memory of 2148	1904	cmd.exe	99
PID 1904 wrote to memory of 2148	1904	cmd.exe	99
PID 1904 wrote to memory of 2444	1904	cmd.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb53f773dd30ea38d01b3684c2daf4d1b688592be14bd4b660bf6dd02c873b69.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb53f773dd30ea38d01b3684c2daf4d1b688592be14bd4b660bf6dd02c873b69.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\ja-JP\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\System\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8okcwczJrd.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3008
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2320
      - C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8YXrskW4JY.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2148
        
        C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5AjNu1Vgdj.bat"
        9⤵
        
        PID:1432
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3032
        
        C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jFR8woBO6B.bat"
        11⤵
        
        PID:2916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2120
        
        C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8tyQ25hERL.bat"
        13⤵
        
        PID:2816
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1736
        
        C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LkcfmFI5TJ.bat"
        15⤵
        
        PID:3012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1876
        
        C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qsbi9TUILn.bat"
        17⤵
        
        PID:2272
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3000
        
        C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat"
        19⤵
        
        PID:2184
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1564
        
        C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrNnSCw4rJ.bat"
        21⤵
        
        PID:2788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1012
        
        C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Zqs8041Oe.bat"
        23⤵
        
        PID:608
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3028
        
        C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5DPJyftqFq.bat"
        25⤵
        
        PID:2112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2920
        
        C:\Program Files (x86)\Uninstall Information\wininit.exe
        
        "C:\Program Files (x86)\Uninstall Information\wininit.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\ja-JP\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\ja-JP\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\ja-JP\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\System\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\Vss\Writers\System\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Default User\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\TAPI\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Uninstall Information\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Uninstall Information\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3009bef03c644542059d5d658565cc75

SHA1
f5010472c6c49d25df80ecd8683bce439b59b1fc

SHA256
4c0903e687c30e6af8acc3a7ad96ac8763ec06fc1dfecf7f7860f64ea3eb5b79

SHA512
9b8246c251092fe55e9ebe8ff11d94c9ae4ddace79c7585eb2dfb39cefde13b14c088833cddb54aba56244b966911a876aae83e664ad309611dd1bd8d92665d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22358e5f1a2c45061a9cfc7755f9b71b

SHA1
49f53857d8942bb50b3b64d6b87aaaf412b59eb6

SHA256
8824ef7aeaa2a378f75ffcd92622d2713d1ff7c5c61d67bb8e7c208569f7cf54

SHA512
bb843756ab79bbd4908de49e15010bf2d503e92d0da9fe760eb35fa853292fcdbe63de156baa73b3cc88e4180dfecd55b253137b649f14aece6bd3f338988bc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21e8af2740ac60e3ba2506b2a40b01c2

SHA1
b108432d6c98d137973ecc1a6b240930995639c8

SHA256
ec452bb03adf4913d291441a42cbc3bdb44060ee54c7797254f08e6a9ac0d94d

SHA512
74521d40f0d1bc6c6fe97933624b2f2921326624d07138a2d07ce6ce0af651a0446c6c2f37f1762477f66fd168082d8cd5134550e4e14f04012f2af54a00122b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90e72b068d215edb824d802ec3f61ab7

SHA1
2515e26031a4b3325ab92f1d4e731dddeecaab7d

SHA256
6614a2750ca693c80da683f9307de24e64da2a68be8573af543ebdbc6e5630ff

SHA512
8fef321091043f80fd3db9ab28b9631af122d4523a381ac8cbdf7f83d73ece73953f4b3abe10b5fed034f92632086074936120ee0c15f53bd2c4635a17799ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d19a2a2e00b395996691b6fdddb6b81e

SHA1
7d09755119e5c79efd0696d37b8e98b3345e4724

SHA256
41f66b5c0ce6804155d146393c442762125ee169830eec4775db0656764c9a69

SHA512
3c7be32cd6e1a62c6e6086a914670d93ade11afb7a7248fd8a447aee01228e73035507b7bfef0212a06798cde0eefd552347983ef1e2564a9e3f661a66eed031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64c82e78b19f092c8b16551c6257f099

SHA1
1e177c6fd7222c1773727b01ad8894e370c05fd6

SHA256
2bad9da133ec8c48c3a9ddda4861cfc2457f8251c7560310fc672e49bfb7ad33

SHA512
8277aacdb30060fe26bf94b9559ff22e83f3347d1b63420ad12604ccc1c21b44f60f027d6be4521fa1c73da5e7e87b22bafe19bb16c7338784dce40626796a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d35972798b12e1b31c21884f590093aa

SHA1
50521aa67c88d08bd0786f4b72ce983d07b9c3ff

SHA256
5c45b268b011b14c69f2f04d3276f62767ae0cade92bac5bcfcdf832fa910595

SHA512
4040d60e0829822eaee0870358b59c59a628cdc163fc7a2f7fb0f0a29210c584fc263f01dcd2870110e16ab0115015b7812330364893a61b83b8d642ecf71a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f04030446d7910c516edd9678121aa0

SHA1
9a3c19639be6db08d72e0afb81920a78f0172f76

SHA256
51147e2eb86b1badd2d3c9a9725c8e1f854a643e9dc86bba11172d652443f20f

SHA512
d29d5cafe610d517eff668a08b348350fea430df99e268b045a62c498f72cb8cf4fac64ddf36c69982eb883e7611d980c4e0b46af00e08ef7a3666be0b3292f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cf16e4bb4e4725711069d00564d6f46

SHA1
dfc60e766df60c0c5f2eaa19dcb82da931c69b7c

SHA256
89a5c3ae7386b62aa3f34290acfba17d82f16e5f18264ae44b4efb5a233c5019

SHA512
0dfb79bfc77ddb2934aa528541f2abe79f42613be4b62d4f11ae67dd05268bacd393b60de2d3d6eba0a4f8002fbda76c8a20c0431cc056aa83e0ce5fa9530e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\5AjNu1Vgdj.bat

Filesize
221B

MD5
56f7fc557664ca2da347031e60b8f8f9

SHA1
5125a9f0f89f8d3cd1261d1deafe621a91c3d728

SHA256
4b477c53c31903a016d42ee37d13a00bc3100b1556af7679ef332c61dccf2af0

SHA512
f613d2eab3122a8e90502bb1c09403ddacd8852cbc0bab7c8eeef686a7f3267a35d5b9b9d77ebb17203382099c73601d2e623ee0997b9acf081d8066b23a0e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\5DPJyftqFq.bat

Filesize
221B

MD5
71d1e3814ff64532c60f3f246e1fcfbd

SHA1
204d31039d73abe19c1a29d856f8304ad7d6297b

SHA256
e0b2d250d2aab26463dfb7a2693ccd954e08f9798b7ebf1def44dd9e3f26077e

SHA512
26c0229feac95e85bc3a31bc01dc656a893bbea5e0784ebb69018f911584925d358609b8101c331fd45b7ec77f4d84512e259b13d1d35e1f6c245f4d0ba2f372

Download Submit
C:\Users\Admin\AppData\Local\Temp\6Zqs8041Oe.bat

Filesize
221B

MD5
348f368fa1d1f80648a4280cc09657a2

SHA1
255c23020c6582664f0a1bc051a71c62ad2bf3cb

SHA256
9569c8d23b0d643a8b43481ddabbd4120628fc6c382c485a1e65c696aa6fe5d1

SHA512
6c0ae5bdb0bf2b2932d3099d86cdf674eb32141ba0a415d30c023158ccee652fe53c5e41ce0573c84cd13e367fabc06f580ddc18fc61b09521c5d3e926d315ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\8YXrskW4JY.bat

Filesize
221B

MD5
bccf5ac42d3075df2884cebeaae0a737

SHA1
7d1834969d80b964413691845c8fc18a99245d02

SHA256
4e285d4035cb15fb6961a841605ff70247492e7bc3fd3ca8f96e8986e670e022

SHA512
ddb0f78776719dc70198b1ddb75300b446fd0c3e15b566b6240d198bbb1f24c4f713d1292fd946c4b4ccc73c30dd1c0de021e81db3d13f1cc768db4496d7ec5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\8okcwczJrd.bat

Filesize
221B

MD5
cfae7258e5280fa3f96a380509c860ec

SHA1
3855cc294aa06c84f0da019705ae246a5638b8e0

SHA256
a4f17b70fc7e7515a85997c7a0ef1a905e3c5d371443951d16b9038bdcacc60f

SHA512
3dd1768c2341f946617627fec272dfddbfb56fcf59f960eb01ed9693dc1b9d6c1ef954ccd6dce8302a7906e3d9f1401c4d7ceca761fbf8a822d16edadc953148

Download Submit
C:\Users\Admin\AppData\Local\Temp\8tyQ25hERL.bat

Filesize
221B

MD5
473da60e7267883907f7317509fa71e0

SHA1
91abb0d223d58804a53239c490a6b4f4bd3dccd6

SHA256
2b631251505b3965fd0d83abf75546e5108f67e3d20c7ebbf0f4afe7b828a043

SHA512
5907043949b1df65f041f080f84f224847873df58d96e02390c01ee6c7339742d113f5850feeb1012f52142572e192bb998f29bdbc850796733da909070b7003

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab389F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IrNnSCw4rJ.bat

Filesize
221B

MD5
37943127725b384ae0269d1f9cb044e0

SHA1
55a7ccbb9a5edd67f68d87980462257e5c3d35ea

SHA256
a6cafd1b9ee5e12adb2338714f39758be512722ab0d171bcabe93698fcc09596

SHA512
b0e89d1181b89bdbb445a6027cb6425e5c0d1677d550781229bbe5b8aa57d1477d1eaa46a78bde195e92d3a29cdbc248a516858bd5fcff85ac70ef9bdcf1fb9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\LkcfmFI5TJ.bat

Filesize
221B

MD5
2f27ffec1869dd7fce54245b5b907832

SHA1
0cec4a7615136d1a42f576d6d376e5ffe374a5d4

SHA256
29e2ca7c3b2ab84bed20acd58145a05fde1bb19fe6520701f6d3a9d83ed8fd81

SHA512
062f624dadcb70c6d0f3e146a86bb3a37af5907c765cc6f8538beed579cedde2521d1d0bfdf090dd3de14dfa69771c6b15dfd52dcb251d35871c0ae712497095

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q3ZRkRg4YZ.bat

Filesize
221B

MD5
2f5727b3d29e198211e5a5324789bf70

SHA1
df57979ba43fd93260c20d84408e634e4d13cd42

SHA256
6badd514225c83190c37b490486c08584ee3c2def501d6638248f6ad48f249ba

SHA512
14e2b1b21ac50eb48fb320ee91f3e5967bc7f10507013bc4afa5731f4d7125d896daf1ea9fcd3d2dffa5e7bb3a9f0084c47147be35c76a6c88f1a8d0c0595755

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38B2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\jFR8woBO6B.bat

Filesize
221B

MD5
dd64d5e4295c18e2900685be6b588d29

SHA1
b55a1d92157e63a19d28e317e0ec5c11626ec1e6

SHA256
5fc65f706da913e094691f313695c41f792816593fa62947426b47208e7b2077

SHA512
8bc051d9d1ada503af69078db7d5d6a1b0b36d5ce1285f493bbdcf94a2fe4b46e5189f43b367871eee4c4251dbb6fe2113f5eeed45d5a1c3fd2b4d7ed0b9c388

Download Submit
C:\Users\Admin\AppData\Local\Temp\qsbi9TUILn.bat

Filesize
221B

MD5
850718f663996b0bb275a3ae3eccc446

SHA1
94de000a62dab2642ad15f6dd9e89fbdde9323b7

SHA256
d7ffa514a9e8300f4d111730a10f5c6d7bbb75829ca803a0fa6f4e43c2536099

SHA512
64c004d5ab80a105c1219bbc5675fb4ed8cc63b2a4b81eae16de180e7071d2595f66f833a96ce2b09a8229f82a264eda89b05d2ed27af466fa55b493f4703f43

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7b721177f34b625d9b0184f80bb8bcfb

SHA1
49b31943bc098544235f5ad94025e4c0b7492cd7

SHA256
d128f33feb20e821c58cf1c54158bfb8ffebea339568ffd3b8080cfaf4a59fe8

SHA512
fd26a45d79afd289fc6b25a07eb7d5fe819bd45374e6dfa37243bb1a549597acf8744c8b059890bc98e59a6e236d8a57dea06bc16a6cf4da26339bd51f52e4b1

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/332-227-0x0000000001310000-0x0000000001420000-memory.dmp

Filesize
1.1MB

Download
memory/916-527-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/916-526-0x00000000002A0000-0x00000000003B0000-memory.dmp

Filesize
1.1MB

Download
memory/1244-647-0x0000000000310000-0x0000000000420000-memory.dmp

Filesize
1.1MB

Download
memory/1512-108-0x00000000009B0000-0x0000000000AC0000-memory.dmp

Filesize
1.1MB

Download
memory/1656-287-0x00000000001A0000-0x00000000002B0000-memory.dmp

Filesize
1.1MB

Download
memory/1704-347-0x0000000000EF0000-0x0000000001000000-memory.dmp

Filesize
1.1MB

Download
memory/1880-63-0x0000000002990000-0x0000000002998000-memory.dmp

Filesize
32KB

Download
memory/1908-61-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2432-587-0x0000000000A50000-0x0000000000B60000-memory.dmp

Filesize
1.1MB

Download
memory/2444-167-0x00000000001C0000-0x00000000002D0000-memory.dmp

Filesize
1.1MB

Download
memory/2564-17-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download
memory/2564-16-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/2564-15-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2564-14-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/2564-13-0x0000000000C60000-0x0000000000D70000-memory.dmp

Filesize
1.1MB

Download
memory/2768-707-0x0000000000C70000-0x0000000000D80000-memory.dmp

Filesize
1.1MB

Download
memory/2768-708-0x0000000000B80000-0x0000000000B92000-memory.dmp

Filesize
72KB

Download
memory/2924-407-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download