dcrat | e953a8067a619a9c6e8440f3514163c4dd39ab5d289e7712786083ae08b12c01

Analysis

max time kernel
146s
max time network
141s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e953a8067a619a9c6e8440f3514163c4dd39ab5d289e7712786083ae08b12c01.exe
Size

1.3MB
MD5

64cf013904c6d1650a646bea5cafb120
SHA1

776de25cb7d86935dbfd51e69aafd12b9c5447bd
SHA256

e953a8067a619a9c6e8440f3514163c4dd39ab5d289e7712786083ae08b12c01
SHA512

6401ce4d7778627bb3bcab3a0a1d2ee25562ca5fa6bc938f490d02784b5cff38053aee4c5a80f236cbd7f62c6445e83da008e494b0571d11eaa13f1374cb9609
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2704	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2704	schtasks.exe	35

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000019246-9.dat	dcrat
behavioral1/memory/2136-13-0x00000000001A0000-0x00000000002B0000-memory.dmp	dcrat
behavioral1/memory/2320-123-0x0000000001200000-0x0000000001310000-memory.dmp	dcrat
behavioral1/memory/1720-301-0x0000000000390000-0x00000000004A0000-memory.dmp	dcrat
behavioral1/memory/2560-362-0x0000000000900000-0x0000000000A10000-memory.dmp	dcrat
behavioral1/memory/896-422-0x00000000003D0000-0x00000000004E0000-memory.dmp	dcrat
behavioral1/memory/568-483-0x00000000002F0000-0x0000000000400000-memory.dmp	dcrat
behavioral1/memory/1648-544-0x00000000011E0000-0x00000000012F0000-memory.dmp	dcrat
behavioral1/memory/3008-604-0x00000000012F0000-0x0000000001400000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1708	powershell.exe
1812	powershell.exe
2140	powershell.exe
2268	powershell.exe
2728	powershell.exe
2472	powershell.exe
2996	powershell.exe
696	powershell.exe
2984	powershell.exe
1480	powershell.exe
2176	powershell.exe
1512	powershell.exe
2448	powershell.exe
2860	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2136	DllCommonsvc.exe
2320	taskhost.exe
2460	taskhost.exe
2204	taskhost.exe
1720	taskhost.exe
2560	taskhost.exe
896	taskhost.exe
568	taskhost.exe
1648	taskhost.exe
3008	taskhost.exe
2672	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2108	cmd.exe
2108	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
19	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
27	raw.githubusercontent.com
31	raw.githubusercontent.com
34	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\5940a34987c991	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\addins\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Windows\addins\24dbde2999530e	DllCommonsvc.exe
File created	C:\Windows\Panther\actionqueue\lsm.exe	DllCommonsvc.exe
File created	C:\Windows\Panther\actionqueue\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\es-ES\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\es-ES\cc11b995f2a76d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e953a8067a619a9c6e8440f3514163c4dd39ab5d289e7712786083ae08b12c01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
836	schtasks.exe
1596	schtasks.exe
2648	schtasks.exe
2236	schtasks.exe
1308	schtasks.exe
1720	schtasks.exe
2392	schtasks.exe
2576	schtasks.exe
2840	schtasks.exe
2496	schtasks.exe
1756	schtasks.exe
748	schtasks.exe
1808	schtasks.exe
1320	schtasks.exe
2600	schtasks.exe
2520	schtasks.exe
952	schtasks.exe
1572	schtasks.exe
2664	schtasks.exe
1856	schtasks.exe
2444	schtasks.exe
2736	schtasks.exe
2244	schtasks.exe
800	schtasks.exe
2192	schtasks.exe
2608	schtasks.exe
1952	schtasks.exe
1288	schtasks.exe
2324	schtasks.exe
1852	schtasks.exe
2876	schtasks.exe
1816	schtasks.exe
3024	schtasks.exe
2624	schtasks.exe
332	schtasks.exe
1352	schtasks.exe
2712	schtasks.exe
2460	schtasks.exe
2780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2136	DllCommonsvc.exe
2136	DllCommonsvc.exe
2136	DllCommonsvc.exe
1812	powershell.exe
2448	powershell.exe
2728	powershell.exe
2140	powershell.exe
1708	powershell.exe
1512	powershell.exe
2984	powershell.exe
2860	powershell.exe
2472	powershell.exe
696	powershell.exe
1480	powershell.exe
2176	powershell.exe
2996	powershell.exe
2268	powershell.exe
2320	taskhost.exe
2460	taskhost.exe
2204	taskhost.exe
1720	taskhost.exe
2560	taskhost.exe
896	taskhost.exe
568	taskhost.exe
1648	taskhost.exe
3008	taskhost.exe
2672	taskhost.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	DllCommonsvc.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	696	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	2320	taskhost.exe
Token: SeDebugPrivilege	2460	taskhost.exe
Token: SeDebugPrivilege	2204	taskhost.exe
Token: SeDebugPrivilege	1720	taskhost.exe
Token: SeDebugPrivilege	2560	taskhost.exe
Token: SeDebugPrivilege	896	taskhost.exe
Token: SeDebugPrivilege	568	taskhost.exe
Token: SeDebugPrivilege	1648	taskhost.exe
Token: SeDebugPrivilege	3008	taskhost.exe
Token: SeDebugPrivilege	2672	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2116	1384	JaffaCakes118_e953a8067a619a9c6e8440f3514163c4dd39ab5d289e7712786083ae08b12c01.exe	31
PID 1384 wrote to memory of 2116	1384	JaffaCakes118_e953a8067a619a9c6e8440f3514163c4dd39ab5d289e7712786083ae08b12c01.exe	31
PID 1384 wrote to memory of 2116	1384	JaffaCakes118_e953a8067a619a9c6e8440f3514163c4dd39ab5d289e7712786083ae08b12c01.exe	31
PID 1384 wrote to memory of 2116	1384	JaffaCakes118_e953a8067a619a9c6e8440f3514163c4dd39ab5d289e7712786083ae08b12c01.exe	31
PID 2116 wrote to memory of 2108	2116	WScript.exe	32
PID 2116 wrote to memory of 2108	2116	WScript.exe	32
PID 2116 wrote to memory of 2108	2116	WScript.exe	32
PID 2116 wrote to memory of 2108	2116	WScript.exe	32
PID 2108 wrote to memory of 2136	2108	cmd.exe	34
PID 2108 wrote to memory of 2136	2108	cmd.exe	34
PID 2108 wrote to memory of 2136	2108	cmd.exe	34
PID 2108 wrote to memory of 2136	2108	cmd.exe	34
PID 2136 wrote to memory of 1708	2136	DllCommonsvc.exe	75
PID 2136 wrote to memory of 1708	2136	DllCommonsvc.exe	75
PID 2136 wrote to memory of 1708	2136	DllCommonsvc.exe	75
PID 2136 wrote to memory of 1812	2136	DllCommonsvc.exe	76
PID 2136 wrote to memory of 1812	2136	DllCommonsvc.exe	76
PID 2136 wrote to memory of 1812	2136	DllCommonsvc.exe	76
PID 2136 wrote to memory of 696	2136	DllCommonsvc.exe	78
PID 2136 wrote to memory of 696	2136	DllCommonsvc.exe	78
PID 2136 wrote to memory of 696	2136	DllCommonsvc.exe	78
PID 2136 wrote to memory of 1512	2136	DllCommonsvc.exe	79
PID 2136 wrote to memory of 1512	2136	DllCommonsvc.exe	79
PID 2136 wrote to memory of 1512	2136	DllCommonsvc.exe	79
PID 2136 wrote to memory of 2984	2136	DllCommonsvc.exe	80
PID 2136 wrote to memory of 2984	2136	DllCommonsvc.exe	80
PID 2136 wrote to memory of 2984	2136	DllCommonsvc.exe	80
PID 2136 wrote to memory of 2448	2136	DllCommonsvc.exe	83
PID 2136 wrote to memory of 2448	2136	DllCommonsvc.exe	83
PID 2136 wrote to memory of 2448	2136	DllCommonsvc.exe	83
PID 2136 wrote to memory of 1480	2136	DllCommonsvc.exe	85
PID 2136 wrote to memory of 1480	2136	DllCommonsvc.exe	85
PID 2136 wrote to memory of 1480	2136	DllCommonsvc.exe	85
PID 2136 wrote to memory of 2728	2136	DllCommonsvc.exe	86
PID 2136 wrote to memory of 2728	2136	DllCommonsvc.exe	86
PID 2136 wrote to memory of 2728	2136	DllCommonsvc.exe	86
PID 2136 wrote to memory of 2268	2136	DllCommonsvc.exe	88
PID 2136 wrote to memory of 2268	2136	DllCommonsvc.exe	88
PID 2136 wrote to memory of 2268	2136	DllCommonsvc.exe	88
PID 2136 wrote to memory of 2140	2136	DllCommonsvc.exe	89
PID 2136 wrote to memory of 2140	2136	DllCommonsvc.exe	89
PID 2136 wrote to memory of 2140	2136	DllCommonsvc.exe	89
PID 2136 wrote to memory of 2860	2136	DllCommonsvc.exe	90
PID 2136 wrote to memory of 2860	2136	DllCommonsvc.exe	90
PID 2136 wrote to memory of 2860	2136	DllCommonsvc.exe	90
PID 2136 wrote to memory of 2996	2136	DllCommonsvc.exe	91
PID 2136 wrote to memory of 2996	2136	DllCommonsvc.exe	91
PID 2136 wrote to memory of 2996	2136	DllCommonsvc.exe	91
PID 2136 wrote to memory of 2176	2136	DllCommonsvc.exe	92
PID 2136 wrote to memory of 2176	2136	DllCommonsvc.exe	92
PID 2136 wrote to memory of 2176	2136	DllCommonsvc.exe	92
PID 2136 wrote to memory of 2472	2136	DllCommonsvc.exe	93
PID 2136 wrote to memory of 2472	2136	DllCommonsvc.exe	93
PID 2136 wrote to memory of 2472	2136	DllCommonsvc.exe	93
PID 2136 wrote to memory of 1988	2136	DllCommonsvc.exe	103
PID 2136 wrote to memory of 1988	2136	DllCommonsvc.exe	103
PID 2136 wrote to memory of 1988	2136	DllCommonsvc.exe	103
PID 1988 wrote to memory of 2464	1988	cmd.exe	105
PID 1988 wrote to memory of 2464	1988	cmd.exe	105
PID 1988 wrote to memory of 2464	1988	cmd.exe	105
PID 1988 wrote to memory of 2320	1988	cmd.exe	106
PID 1988 wrote to memory of 2320	1988	cmd.exe	106
PID 1988 wrote to memory of 2320	1988	cmd.exe	106
PID 2320 wrote to memory of 2832	2320	taskhost.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e953a8067a619a9c6e8440f3514163c4dd39ab5d289e7712786083ae08b12c01.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e953a8067a619a9c6e8440f3514163c4dd39ab5d289e7712786083ae08b12c01.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\actionqueue\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\es-ES\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre7\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hcz86GUHd3.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1988
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2464
      - C:\Users\Public\Documents\taskhost.exe
        
        "C:\Users\Public\Documents\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UZ6jdsJyxg.bat"
        7⤵
        
        PID:2832
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1740
        
        C:\Users\Public\Documents\taskhost.exe
        
        "C:\Users\Public\Documents\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n3vYZhDjEH.bat"
        9⤵
        
        PID:3052
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2864
        
        C:\Users\Public\Documents\taskhost.exe
        
        "C:\Users\Public\Documents\taskhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat"
        11⤵
        
        PID:2268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2688
        
        C:\Users\Public\Documents\taskhost.exe
        
        "C:\Users\Public\Documents\taskhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat"
        13⤵
        
        PID:316
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1824
        
        C:\Users\Public\Documents\taskhost.exe
        
        "C:\Users\Public\Documents\taskhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cRRFCwJQFV.bat"
        15⤵
        
        PID:1940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1956
        
        C:\Users\Public\Documents\taskhost.exe
        
        "C:\Users\Public\Documents\taskhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uZApDsIgYI.bat"
        17⤵
        
        PID:2568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2328
        
        C:\Users\Public\Documents\taskhost.exe
        
        "C:\Users\Public\Documents\taskhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FBiR4PpyYA.bat"
        19⤵
        
        PID:328
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2744
        
        C:\Users\Public\Documents\taskhost.exe
        
        "C:\Users\Public\Documents\taskhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat"
        21⤵
        
        PID:2500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:536
        
        C:\Users\Public\Documents\taskhost.exe
        
        "C:\Users\Public\Documents\taskhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"
        23⤵
        
        PID:872
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:696
        
        C:\Users\Public\Documents\taskhost.exe
        
        "C:\Users\Public\Documents\taskhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Documents\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\addins\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Windows\addins\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Public\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Public\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Windows\Panther\actionqueue\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Panther\actionqueue\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Windows\Panther\actionqueue\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows NT\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\DigitalLocker\es-ES\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jre7\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre7\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44aea431b8c2af85e60f142497c6d26d

SHA1
3d37eba379c3532bf934ad30d7666cc3c7006e92

SHA256
0835fdc77a376d8c2cfe20070be89903f2342505d1b05b28c434e915d0fdda5d

SHA512
ada79e312d8dbf12527e81c77bb8b3b2fca60cc825a6715ba132ff5af86a20d3d5e1a547851966a8ad815c34eb250d151ff2089fbeae51a3a5f6404cc7c96773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
259a66140bb802ea3b2c0c67aedf0d04

SHA1
8f592290da14ae884484952ff14a9c5b30486949

SHA256
442ad8d38d8bfbd7cf3640706388a53edd3de5892cb91f3b77eabf7b87214ff7

SHA512
6f345ad7d1f7b1fc57608f601156f85ea689dffc941ab9b4d9f5c4b0e072697478f4880ae54d648e25cefc48c232664219cac0d554873272c6b16395438bfdcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
253b012ce143caba09c2502a77c12be0

SHA1
18bf32987c409e0e2988744b8bf4ad43502347c0

SHA256
0254b90002983dd34c2b97125a654eaa0449fbb4f8d72e2c797f6a4b246bbc20

SHA512
86f89d8313e85f9e4731b7baeb26545fbf6407d6e1f75fa9e961b26fb6badda0475d9b737f4aa46f79c4c6368910a2dd5f061226824725cbaf605b259f15a68e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3acb7c7ef8a5fa76c11c7bff190acfac

SHA1
34b219cc2d02d0f82c6a5825f017d26c698e4f2f

SHA256
9d25f85c8f0d08c277924de41adbb9c5ab67bc205849a748ca505b1154f86eb6

SHA512
522cb9ab58015454a3effec768b0eaf99adc6b34c2b7f77db2317e62bfc5ab4a3be6bc4f441d4054223cc762f5327f80010e915c04cac9ab9e09ea19dfe16b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d2a4f14b851eddfa86029a9a4baf46c

SHA1
6789de7d924b80b725d9170b77522656c9e202c5

SHA256
5c6d83608892a8226ff5ccff9a9e921773f521641aa2208989c1ea2ee9c4b2d7

SHA512
a700a73ad0d08f1db3715b598009e0fc7397a9def60a68cfe5d66bb7442110a5c231f3472de5bb58e983c751124ea0cd3e5f5f771e576b75f67ee3e1b4184208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea1d2bba5473f52d8106d1b39636e776

SHA1
12aff08e15321329aec121b897e59edaced56c0d

SHA256
38d75a82f57f5ddbc5baf7afbce3043698cf7211712ad130303e864a07bb99c9

SHA512
7f95f2ccf5470607bf1a2d12d59aa832e3b30e200c3fceb4091aed85b5b68177a11b07fc7b12931ad7c1d42b8d5efc9540d5e34f8335fbd75871a9061185c85d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8710ae7cbe400ff31951ad7e9b918d56

SHA1
fa8013e205dce32712991504ebfd1e385c7c9b00

SHA256
141c92fc6eac9ab16cf8e4ff8a9e4d2fffc339522f0ff36dea663da9e3b5e9c1

SHA512
7d36a4cdfd52a12081979ca79d4e62b555c1f5f1dd6848805a12fa0ff0997ab33f86a81110e240f5d1e8c2aa785602419fc3fc02d5136dd0aa29636949b2b27e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad878b5c7cf5b88786ddea422f4f2d3b

SHA1
951f4e7b6cbd36ee61c44c4aa1e56ebc833ca221

SHA256
3e1be5a8879eeaab1085014f3c05aeaa2ad20e3e15350cb858bac09ebbb339e1

SHA512
886d11133e3fc4d8e32f5681b458105a2f1e804ac47e26dd128d275672c52289c50d27b35f04f28e7831c64d6f2b737515090ffac485f32ac52a7f5462bc79ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FC0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat

Filesize
203B

MD5
4930409e19e67dc821003a24139bed42

SHA1
a96283b9fde6f06df5e0bd8909b46a9453aed571

SHA256
ab09cfac1ad8213b8c250a02bbf82318f0a109aaeadcfa008d7c3efe456e7bfa

SHA512
39b5a1144fb5c15c3e1335b9aa0f229788462eb990438de047da6f368f51fcfcce6191cbd8fbdc720281951dc9275db8cef6b79732b8d83fe28be5cd253fbfdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBiR4PpyYA.bat

Filesize
203B

MD5
bee6404e49a8583c897310c15efd78fd

SHA1
fc73908ff35d0d758653803bcedd101368de9ddf

SHA256
b512546d12faf947782a80ace7b3079f14b10cfb1c9b1429e2ba9854c50f80c4

SHA512
e8a580b5fd0c085528fce3d7ad28095d4ecb839ca7b6de96b8d57c311d88b064d429fb5e0fc04b407cc72e798ae7987a01ff5143ff873adc840045320f14a1f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3FD3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UZ6jdsJyxg.bat

Filesize
203B

MD5
a2619e45b248256d40d7bfc2fa47da2a

SHA1
5978cf30d8d6713532f3a8dad64e782f2ac22905

SHA256
4c8d5fa911c0995d5a1a04a5fe865922363d091b69db3827176af7c369c099d8

SHA512
522fff0ec1e051e05748d686e052bb6474c87460e2fe26ec14a2c7c48255bcd75775ec696b0217d92fdcd358af5c7d9b250ca0045adfa720963d3177945dbd12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y23Kn3rQqK.bat

Filesize
203B

MD5
9ef01494ee4172ca0972126dbe444a87

SHA1
11cd2080bca630f4a82c7b2ec59bcb3ca9e5eebc

SHA256
c4118e769bd7f4eb9929eb4dcff2b61382220dff5aca77f4ef4a8df684a670d3

SHA512
31d402cc346da62dff5e34ecc527d147dbb7439b60619e46bf37c7430626fcf0010420237de40e053d06b711ef0b9d7f9af29694747d058532d3a49cd97915de

Download Submit
C:\Users\Admin\AppData\Local\Temp\cRRFCwJQFV.bat

Filesize
203B

MD5
3e96d254a2d071d1ffc51c1e96af16a5

SHA1
7ccdf14191bc2666cf4f238cac3e895a5fa8491e

SHA256
c0726a56d0c6014dc2e3ce928025e34bd6fc6a9721a8fbcb2d4fce8426399ffc

SHA512
c86c4ceb34995a360fd85db9545abf9c30443c549fee86d4000c3988200187549bfd05a248beb7f117e8565b0b7469b9a4e276c173b1b78c14a090f13042234e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hcz86GUHd3.bat

Filesize
203B

MD5
78eb5b09f8504d6633d959994600c953

SHA1
2e182a7e87120938cb477d851d658fa8f82b28d2

SHA256
54df2e935dfb4d9b6045dc0e11d8f07abca76725dde5270e8fab5cbe27b17ed2

SHA512
a8ef36a739d71be1558c23e2ca6be7f53180be8fed67974904a72bb2d53094b8ad936bcef85ffc8f7230be2c28022bbc080ce54d7ea05e251aa99426e49f9ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat

Filesize
203B

MD5
324bd1792703a733c59c84074c31d0f8

SHA1
47c95a6b190ea45eabee01d93e6bbb3536a3930e

SHA256
704edb76330aea74a94eec31eb7f95bd5508f532cd76199f45cadbae1b9e32fd

SHA512
cd910d6d0117f98956d5087dd391008c078e7a9966c4a4540f5fa8623240c2843a4ce1c5e0ff12d3427efcc0c512a11668903d29ad801e3a5e5ce48dfeedd746

Download Submit
C:\Users\Admin\AppData\Local\Temp\n3vYZhDjEH.bat

Filesize
203B

MD5
48fe12cc101291df40bc7bafc0b4b395

SHA1
59c5d00cf9fe99b13fe558956ec618f553686043

SHA256
2ed980a68b4a568c9a400295191e12a6493e9703d4fbdd99c3a77fadc0cc47f9

SHA512
e0c7d7c0e65d9c3e69b161b8c984e4467698aa5d90ffc69c75817605c6f084fd6b5c334977d5e1c4efc8b5b7ad5f5403911db490129fb78edb7b377fcdc4f5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\uZApDsIgYI.bat

Filesize
203B

MD5
3bcb0ba63aca52b0523f5cf6a9f5c6a9

SHA1
cc9cd1151eec4e05c7df6df723863269ffeda6df

SHA256
b74e441317518f566c72ba45dd469973823f8edb79a2be46065344860d71cc7b

SHA512
d132e0376a5210d2420d0c605022216ab2b6662f5c6bc848963f125cb5c59a35ab3601de0328db92a133a58bf8427e38323ca7ad593d28727eb8e5ea2b4084ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat

Filesize
203B

MD5
e0665370b7e87dd3c2ede2966682d073

SHA1
6bb419afa87a874ca0c3f7ae2b6b2da7ab577c55

SHA256
48f0b7a8085bac57eb694ec5f2a0ec3bfce99efa131cd71efeb08c1dd18fee21

SHA512
879619f39dcb6d1f60f914bf126f104508595f984feb7198af148dfe87fd13941609d1a0d1b58e42e20700a97f2c37010bf1241ab348576128ed72f0e33e664f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
41c9145923cb28ec84f9ebf61405f615

SHA1
b64a0047ce95fc90d95c0ea406357d37597e83cc

SHA256
718cc89a2ebada87bcf8c3c6e9497952c044ed1bc2881b989efa06008ab7ca9d

SHA512
2ceca3229772ead002c79ed47e871eca88ccd4884bca64e0358410cfa0e320790d81de106fe4c4cd05b2482c049a991bb431960952fe2c62d497e58274eb0192

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/568-483-0x00000000002F0000-0x0000000000400000-memory.dmp

Filesize
1.1MB

Download
memory/568-484-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/896-423-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/896-422-0x00000000003D0000-0x00000000004E0000-memory.dmp

Filesize
1.1MB

Download
memory/1648-544-0x00000000011E0000-0x00000000012F0000-memory.dmp

Filesize
1.1MB

Download
memory/1720-301-0x0000000000390000-0x00000000004A0000-memory.dmp

Filesize
1.1MB

Download
memory/1720-302-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/1812-56-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/1812-55-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2136-17-0x0000000002010000-0x000000000201C000-memory.dmp

Filesize
48KB

Download
memory/2136-16-0x0000000002000000-0x000000000200C000-memory.dmp

Filesize
48KB

Download
memory/2136-15-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2136-14-0x00000000003E0000-0x00000000003F2000-memory.dmp

Filesize
72KB

Download
memory/2136-13-0x00000000001A0000-0x00000000002B0000-memory.dmp

Filesize
1.1MB

Download
memory/2320-123-0x0000000001200000-0x0000000001310000-memory.dmp

Filesize
1.1MB

Download
memory/2460-182-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2560-362-0x0000000000900000-0x0000000000A10000-memory.dmp

Filesize
1.1MB

Download
memory/3008-604-0x00000000012F0000-0x0000000001400000-memory.dmp

Filesize
1.1MB

Download