dcrat | f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe
Size

1.3MB
MD5

fd9aa1eb485121846732067f4cdd0bc5
SHA1

a7a4ed018767a96f084fd838311a5d47d45927ee
SHA256

f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce
SHA512

48a82c9c7333e305634db26afc5d45127d60e1ba1f8945d3ded614bd947b3ccaabcfec60c57537fd0dfbbd3002eb00fe31f51a7ac3030ea35001cb52b66eeef4
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2524	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2524	schtasks.exe	32

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000014b28-9.dat	dcrat
behavioral1/memory/2904-13-0x0000000000940000-0x0000000000A50000-memory.dmp	dcrat
behavioral1/memory/768-80-0x0000000000CB0000-0x0000000000DC0000-memory.dmp	dcrat
behavioral1/memory/2588-139-0x00000000011B0000-0x00000000012C0000-memory.dmp	dcrat
behavioral1/memory/2056-199-0x0000000001220000-0x0000000001330000-memory.dmp	dcrat
behavioral1/memory/2384-259-0x0000000000360000-0x0000000000470000-memory.dmp	dcrat
behavioral1/memory/2928-320-0x0000000000FC0000-0x00000000010D0000-memory.dmp	dcrat
behavioral1/memory/2236-381-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat
behavioral1/memory/2680-442-0x00000000003A0000-0x00000000004B0000-memory.dmp	dcrat
behavioral1/memory/2716-502-0x00000000011E0000-0x00000000012F0000-memory.dmp	dcrat
behavioral1/memory/1940-621-0x00000000002E0000-0x00000000003F0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2008	powershell.exe
1540	powershell.exe
2968	powershell.exe
1872	powershell.exe
2040	powershell.exe
1536	powershell.exe
664	powershell.exe
2996	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2904	DllCommonsvc.exe
768	wininit.exe
2588	wininit.exe
2056	wininit.exe
2384	wininit.exe
2928	wininit.exe
2236	wininit.exe
2680	wininit.exe
2716	wininit.exe
552	wininit.exe
1940	wininit.exe

Loads dropped DLL 2 IoCs

pid	Process
2760	cmd.exe
2760	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
22	raw.githubusercontent.com
28	raw.githubusercontent.com
25	raw.githubusercontent.com
32	raw.githubusercontent.com
35	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
15	raw.githubusercontent.com
19	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\7a0fd90576e088	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\wsearchidxpi\wininit.exe	DllCommonsvc.exe
File created	C:\Windows\inf\wsearchidxpi\56085415360792	DllCommonsvc.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Windows\Prefetch\System.exe	DllCommonsvc.exe
File created	C:\Windows\Prefetch\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Windows\inf\wsearchidxpi\wininit.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2832	schtasks.exe
2456	schtasks.exe
1824	schtasks.exe
604	schtasks.exe
2796	schtasks.exe
1664	schtasks.exe
1112	schtasks.exe
1836	schtasks.exe
1560	schtasks.exe
2864	schtasks.exe
1808	schtasks.exe
1728	schtasks.exe
1340	schtasks.exe
1492	schtasks.exe
1660	schtasks.exe
2488	schtasks.exe
2036	schtasks.exe
2756	schtasks.exe
2520	schtasks.exe
2808	schtasks.exe
2868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2904	DllCommonsvc.exe
664	powershell.exe
2968	powershell.exe
1872	powershell.exe
2040	powershell.exe
2996	powershell.exe
1536	powershell.exe
2008	powershell.exe
1540	powershell.exe
768	wininit.exe
2588	wininit.exe
2056	wininit.exe
2384	wininit.exe
2928	wininit.exe
2236	wininit.exe
2680	wininit.exe
2716	wininit.exe
552	wininit.exe
1940	wininit.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	DllCommonsvc.exe
Token: SeDebugPrivilege	664	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	768	wininit.exe
Token: SeDebugPrivilege	2588	wininit.exe
Token: SeDebugPrivilege	2056	wininit.exe
Token: SeDebugPrivilege	2384	wininit.exe
Token: SeDebugPrivilege	2928	wininit.exe
Token: SeDebugPrivilege	2236	wininit.exe
Token: SeDebugPrivilege	2680	wininit.exe
Token: SeDebugPrivilege	2716	wininit.exe
Token: SeDebugPrivilege	552	wininit.exe
Token: SeDebugPrivilege	1940	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2964	1044	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe	28
PID 1044 wrote to memory of 2964	1044	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe	28
PID 1044 wrote to memory of 2964	1044	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe	28
PID 1044 wrote to memory of 2964	1044	JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe	28
PID 2964 wrote to memory of 2760	2964	WScript.exe	29
PID 2964 wrote to memory of 2760	2964	WScript.exe	29
PID 2964 wrote to memory of 2760	2964	WScript.exe	29
PID 2964 wrote to memory of 2760	2964	WScript.exe	29
PID 2760 wrote to memory of 2904	2760	cmd.exe	31
PID 2760 wrote to memory of 2904	2760	cmd.exe	31
PID 2760 wrote to memory of 2904	2760	cmd.exe	31
PID 2760 wrote to memory of 2904	2760	cmd.exe	31
PID 2904 wrote to memory of 1536	2904	DllCommonsvc.exe	54
PID 2904 wrote to memory of 1536	2904	DllCommonsvc.exe	54
PID 2904 wrote to memory of 1536	2904	DllCommonsvc.exe	54
PID 2904 wrote to memory of 664	2904	DllCommonsvc.exe	55
PID 2904 wrote to memory of 664	2904	DllCommonsvc.exe	55
PID 2904 wrote to memory of 664	2904	DllCommonsvc.exe	55
PID 2904 wrote to memory of 2996	2904	DllCommonsvc.exe	57
PID 2904 wrote to memory of 2996	2904	DllCommonsvc.exe	57
PID 2904 wrote to memory of 2996	2904	DllCommonsvc.exe	57
PID 2904 wrote to memory of 2040	2904	DllCommonsvc.exe	59
PID 2904 wrote to memory of 2040	2904	DllCommonsvc.exe	59
PID 2904 wrote to memory of 2040	2904	DllCommonsvc.exe	59
PID 2904 wrote to memory of 1872	2904	DllCommonsvc.exe	61
PID 2904 wrote to memory of 1872	2904	DllCommonsvc.exe	61
PID 2904 wrote to memory of 1872	2904	DllCommonsvc.exe	61
PID 2904 wrote to memory of 2968	2904	DllCommonsvc.exe	62
PID 2904 wrote to memory of 2968	2904	DllCommonsvc.exe	62
PID 2904 wrote to memory of 2968	2904	DllCommonsvc.exe	62
PID 2904 wrote to memory of 1540	2904	DllCommonsvc.exe	63
PID 2904 wrote to memory of 1540	2904	DllCommonsvc.exe	63
PID 2904 wrote to memory of 1540	2904	DllCommonsvc.exe	63
PID 2904 wrote to memory of 2008	2904	DllCommonsvc.exe	64
PID 2904 wrote to memory of 2008	2904	DllCommonsvc.exe	64
PID 2904 wrote to memory of 2008	2904	DllCommonsvc.exe	64
PID 2904 wrote to memory of 1792	2904	DllCommonsvc.exe	70
PID 2904 wrote to memory of 1792	2904	DllCommonsvc.exe	70
PID 2904 wrote to memory of 1792	2904	DllCommonsvc.exe	70
PID 1792 wrote to memory of 1784	1792	cmd.exe	72
PID 1792 wrote to memory of 1784	1792	cmd.exe	72
PID 1792 wrote to memory of 1784	1792	cmd.exe	72
PID 1792 wrote to memory of 768	1792	cmd.exe	73
PID 1792 wrote to memory of 768	1792	cmd.exe	73
PID 1792 wrote to memory of 768	1792	cmd.exe	73
PID 768 wrote to memory of 1868	768	wininit.exe	74
PID 768 wrote to memory of 1868	768	wininit.exe	74
PID 768 wrote to memory of 1868	768	wininit.exe	74
PID 1868 wrote to memory of 2800	1868	cmd.exe	76
PID 1868 wrote to memory of 2800	1868	cmd.exe	76
PID 1868 wrote to memory of 2800	1868	cmd.exe	76
PID 1868 wrote to memory of 2588	1868	cmd.exe	77
PID 1868 wrote to memory of 2588	1868	cmd.exe	77
PID 1868 wrote to memory of 2588	1868	cmd.exe	77
PID 2588 wrote to memory of 2720	2588	wininit.exe	80
PID 2588 wrote to memory of 2720	2588	wininit.exe	80
PID 2588 wrote to memory of 2720	2588	wininit.exe	80
PID 2720 wrote to memory of 1744	2720	cmd.exe	82
PID 2720 wrote to memory of 1744	2720	cmd.exe	82
PID 2720 wrote to memory of 1744	2720	cmd.exe	82
PID 2720 wrote to memory of 2056	2720	cmd.exe	83
PID 2720 wrote to memory of 2056	2720	cmd.exe	83
PID 2720 wrote to memory of 2056	2720	cmd.exe	83
PID 2056 wrote to memory of 444	2056	wininit.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1c6ac525be349e111b668fac6fa90458cc3b7db0549b54d87837cd396d1adce.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\inf\wsearchidxpi\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft\Assistance\Client\1.0\fr-FR\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J4Xd3ofT6n.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1792
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1784
      - C:\Windows\inf\wsearchidxpi\wininit.exe
        
        "C:\Windows\inf\wsearchidxpi\wininit.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mMyBvdYgq2.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2800
        
        C:\Windows\inf\wsearchidxpi\wininit.exe
        
        "C:\Windows\inf\wsearchidxpi\wininit.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1744
        
        C:\Windows\inf\wsearchidxpi\wininit.exe
        
        "C:\Windows\inf\wsearchidxpi\wininit.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat"
        11⤵
        
        PID:444
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1536
        
        C:\Windows\inf\wsearchidxpi\wininit.exe
        
        "C:\Windows\inf\wsearchidxpi\wininit.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CooinIVsng.bat"
        13⤵
        
        PID:1484
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:648
        
        C:\Windows\inf\wsearchidxpi\wininit.exe
        
        "C:\Windows\inf\wsearchidxpi\wininit.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat"
        15⤵
        
        PID:2748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:852
        
        C:\Windows\inf\wsearchidxpi\wininit.exe
        
        "C:\Windows\inf\wsearchidxpi\wininit.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat"
        17⤵
        
        PID:1240
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1520
        
        C:\Windows\inf\wsearchidxpi\wininit.exe
        
        "C:\Windows\inf\wsearchidxpi\wininit.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fELEOgu8eF.bat"
        19⤵
        
        PID:1036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1588
        
        C:\Windows\inf\wsearchidxpi\wininit.exe
        
        "C:\Windows\inf\wsearchidxpi\wininit.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat"
        21⤵
        
        PID:1140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1760
        
        C:\Windows\inf\wsearchidxpi\wininit.exe
        
        "C:\Windows\inf\wsearchidxpi\wininit.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QqrgVo7Q94.bat"
        23⤵
        
        PID:2340
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1528
        
        C:\Windows\inf\wsearchidxpi\wininit.exe
        
        "C:\Windows\inf\wsearchidxpi\wininit.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eXOrkcF5G0.bat"
        25⤵
        
        PID:2668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\inf\wsearchidxpi\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\inf\wsearchidxpi\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\inf\wsearchidxpi\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft\Assistance\Client\1.0\fr-FR\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Assistance\Client\1.0\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Microsoft\Assistance\Client\1.0\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Prefetch\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\Prefetch\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\CrashReports\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\CrashReports\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29f12b49fd0a8c6e3916b7edbe19f4f4

SHA1
7d6a82c32a3ab0b1b20cc6c21ab3eb35d51d7c0d

SHA256
f9b5fa95dfda0000bc5460b0043aafba88c49b5047d092c4a1154f9e52260d73

SHA512
e854dad0477bf0e71c6a40e54bde4d5af961a8d586cb0cfdb9536921492eb935502b1076069435b5b882ea2d72fcaa378b61346d909b9697e04c7ea32c185e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44d3a1b24ec267e73dad02a7e31d0a14

SHA1
ca37888e46b91a88bf0a3e20f1b70a2aaa13fc75

SHA256
afb2003ec8c22564ec7ef44488393ad24aff70d24431b77c86bc9bf09bc8ff12

SHA512
f4306d8044e6e52476e0c95edec537208bee18df8df5b60d155415ca811b329d08ff534455bcf137eb9fba3ae957856a41d0c6bcddb3fb929ec50d6ca456c576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89dcb3ffc02f86870b98b7ff8f191e2f

SHA1
0cfaf223ac2606e1618d4a4d4c455a4417f082ad

SHA256
e3239ddd150f2676b1819b33b185ff81e86bdfe0358331cc5ab5c6d354cf5904

SHA512
fc9336c5439886152cdf616e031b0ddaf9ce4310b119342d4fcdd0af30b4a0b7aa2f79004933d7acd2d60a0975931e1b82a9a700437bbac66b45a6b90189edcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
743f0250042ca412f7e12e1275661abb

SHA1
7bfc807aae77d3bbb8eb4cd97a4c9daa7ac398be

SHA256
b7dd59818af4d9bfb14fdaef96c29f99d31322ee93cd6582ed468b66c965cc6e

SHA512
c5a51c2370fdd484cf0cffecbe29e13a63a75ba3283485dc5379e62b6c1a37368681100d0710320b030713dc91e4b0b66b119037ad85bf38f4ed6ead2b9c9628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4122a26008f4a3771d968e7aca3b960e

SHA1
083476a686dbc55a69f39c5bcfb89714471f6587

SHA256
90583945bddc72010a0f2f11aff0b90ba85ce6e15d38f6647e2655d9c6652535

SHA512
f8f48047c21606afbf4d29ae75b29d4f17029edeab4de5403d764e8dbaf1273d27ebb24e8533bd2154cc030bed16861cabf268b925f33673efc296c0ac4cb1ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d9502ab27db4560b7ac90b972c7107c

SHA1
a16aa3ea5416176f3da9773aa041db78a4507633

SHA256
2aa7a34958d4c738a527d1ec87299a095991e6e703a8ac8d064bd8248d1da081

SHA512
cd6ce9ddde2fd33eb7e2a2926b0407986c9b82b0313d74825a420241d5dcf5ebe69bc3c0b396d1afde67b8c473a6be791acab634b007e3b464b80988ac0127b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b9a93b91c8739baefaa5b0a4bdaf454

SHA1
87edf62f9ccc939f6c877484ee61994f614ac05f

SHA256
c1da6b2291b9ec25cd6b88f71acc308b2d5a45293ffb54250f0b3f37791076c4

SHA512
a8aef4c525135ce23da6338aa779f45522e3ebee5715485d51b790d90cd357713f745f27bd207441d6fe71a7bd0742679d99763d58c8e402942ed6dabc8515ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9928b36ad318ffeeff8d34b526cc226a

SHA1
61acc235cc892f012223029d90ccc7416f603f99

SHA256
3b063ee72e6b9b527715408b932e25566cd5257967a41db42d9bd46dfdbdd5f4

SHA512
e20f980a31d553755dfc7c89483a330eb4d8dc5cd4ddfd1d6509d556760f13ab80b45133145dde847f205d87203ce9eb1d151f50b0d6d0e2b1c8dcb3da6efca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c3f176336cf079bcbbdda5f6fbf497c

SHA1
324acc2a98fd3eff09be90b9b4c90cd716f1b626

SHA256
e1a08d21a35fb619f4e5a65555894bbb772b2c4d7428ea29f646964d7b4e7274

SHA512
6b7e31765824f9ffb14bee1956edc7be8fd8b272f7f66ae17507bb33b15758ba716a5d4de5b66c0a02400dc8fa897c98f72568975cbed37db59497108f896d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab96B6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CooinIVsng.bat

Filesize
204B

MD5
4cf7faec918c44c1693ddcabf88372ef

SHA1
7aeff8270a436266dc3107f15d3427413215d9b6

SHA256
87fce5b9cd67e8641ffb468b4015ef6696320748c681e6466e0ed1967c63e917

SHA512
d5c474c6c1e374b895e959850a2eaa03f72867b0b3ffd3ee33d23e059b034468ccdf4580af31928fd4a4d6e0fd1e91a1fb6aa3e9442d8425c6b4da6ba9596851

Download Submit
C:\Users\Admin\AppData\Local\Temp\J4Xd3ofT6n.bat

Filesize
204B

MD5
6c13039597d94a033336d08d21ccc639

SHA1
8214356b2f5dec643b460d510d7b79d6e2b58222

SHA256
45d517ad00ea56dcab2cb3d598bb0f5dea69e4d4fd7196dc62938a63bcde2770

SHA512
89cb086eb96bf916d46663b6e4299a0a3b8053df0adcdf901a4b6b043affc61ebb3d0a85e8f828d17ff239e4b27840fe45ac1031b91906b492981f919d0eebfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\QqrgVo7Q94.bat

Filesize
204B

MD5
a3f8e8d8a0f6cc32b9b65671b3935206

SHA1
a14f100a39632dbf83097b4f7e14b3bdf89cc095

SHA256
5c939e593e99b0ed2c6f6954dac1e09a9eb31cc1b2b9f99f20b958987538f5de

SHA512
7218767c6498518349f03fb516d2ba2acde189b5e51f340ff9da816a07aaba424da614223c1fa8cd4d1f11ebc4ef9af7f57e8920f5a549253d9f8f61767558d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat

Filesize
204B

MD5
0fe5e4550d47cbbadcfe13d65554465e

SHA1
500e61ced360a05ef0923dc6395428b150424aee

SHA256
0a16672bae3caac1d18b1ff4e06ed789db1c0f8e720e4b17842685948cd065b9

SHA512
fa7c0d5d85dcab0fe1455d3cbf2f88b450b867fac8c46fea968103b951f626babe0f1652bb34badbded7f19569a3c78cab1fcdc7a030c0382dc1ec128adc2136

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar96C8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Urxb3wPgb0.bat

Filesize
204B

MD5
bb179319a9a90860c666e386eca3ee32

SHA1
39f987af4e9e94fa611d8d90f49b2ab7dc8af283

SHA256
20fb4a8eb29ca3838442d69b6bb4644bae41c48fabf145910a44726cc1d3960f

SHA512
2c320414f29bc6df1d82e7bfa4fba045fcde8526b0f7234f06bcc2f77a0da84eb2c772197766654f997efdcdffc4fca9eb04e7098b681006ce8f72fd44084bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat

Filesize
204B

MD5
b6b4e9cc70c905dec7c92e2174cd8248

SHA1
a7d651f4f4a40bc5b43118899d8b312e269c0aa3

SHA256
e179b25a2e1323de8beeefe1ff04e6e15205c37c52236aaaf84d9860af908ef8

SHA512
aee395add2b42ee3dd0f1f0a21653624765311dbf1783b207ee9e16b1ba2072f2583c3716501ce48234968a80226a69474a1d4cbfd2e0aaa6826c19f6c303722

Download Submit
C:\Users\Admin\AppData\Local\Temp\eXOrkcF5G0.bat

Filesize
204B

MD5
f914cdad17dec1ba90cb12bdb84f33b2

SHA1
f1400902c36efd98b0cd462c6de1f105ceb34bfa

SHA256
6fff931706329f3a267385adda45102c987ec71f39019563f21032579b5d2e3c

SHA512
7a26c830bf59d24e1bab63c81b2723235d3560cb247dd00f955c7a109276b8da4014fec82cd387cf602fe3e68df4ebcceebf69aa5920dc48f40071f1a668999f

Download Submit
C:\Users\Admin\AppData\Local\Temp\fELEOgu8eF.bat

Filesize
204B

MD5
74331f7293371319e18c3b77ad5d3f45

SHA1
f943ab4205698d22dfe6e739aed6e737ae04fcb1

SHA256
2e7cae9e22a196dd15acf7aacea1a15b7c0d45a756ea071578ba2ffdc167aaba

SHA512
a5bc33d392e7e999d68620afb376a2ae1eb72acac072d2ab54dac34a6c5b8907ea998060e40a89f41510c986124f2518a2e24abe5226f0f4eb0b95a70640e192

Download Submit
C:\Users\Admin\AppData\Local\Temp\mMyBvdYgq2.bat

Filesize
204B

MD5
b654cb03f87571eef8389b6cfd9cce81

SHA1
1d4b73667383ba395c3a9036f96421e3f4678266

SHA256
a71c1522dc100a208805667fd339aa488a7b1e9c6b0c66df0e417a32acac7261

SHA512
7492697f0741043e474cbeb6f562c5269ca63aedc713ad1f9fad78b816bb24653185939ba0e9a717a384637a60868b03a6c818c3348afa455db022776f16a853

Download Submit
C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat

Filesize
204B

MD5
c0e9a2e0e78c7df8c546b4d1f335e70a

SHA1
1f7adabf1573bb811b02309fe7530ec4ecea95d6

SHA256
a242b61bdd9e883e3880b80cbaa186badb1f8e1283f169ae1d060f0c8a250a5d

SHA512
ee363b254f8b4ff82299ed3394577e177772213227a3cce9cbd547ad55b6a6bde068b77f54abd28c411ec4ae5aff3aaa614e6a54535608f82489ce7948afc8f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\paq62miIo8.bat

Filesize
204B

MD5
09c5259970cca930aad499adb565d2f2

SHA1
f05c8b9f884ca58e37eecbc72d16eb9915c3e34b

SHA256
8eba49ea7b1614d2508cb7d6a9a1784bba04aca8463834e231dea5586c91ea14

SHA512
78680e2da3f99106511529fa639467221f9a1999ecb68f62a096e2114d38defebf60a66e006282a5043cdd6266f047687bb4218b4fd1ed9f12f0294462795644

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
06daffc7d9f81bea64c6a3be4e0880cc

SHA1
e3aa3f0eca523b3aa7a7bd3db138c14109a90b62

SHA256
57d86b914482641094764bd80a0a7b9846dfa3ff5513c551115bdcdbf3e02e53

SHA512
923ef40f4965184a1c5967501d0377e45ff212b2db9633d17654ecec3f7e07b4dc3bbc596bef5f48421ac98d65446341ac20640a00a8ad6b4a415a72d1b112aa

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/664-54-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/664-55-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/768-80-0x0000000000CB0000-0x0000000000DC0000-memory.dmp

Filesize
1.1MB

Download
memory/1940-622-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1940-621-0x00000000002E0000-0x00000000003F0000-memory.dmp

Filesize
1.1MB

Download
memory/2056-199-0x0000000001220000-0x0000000001330000-memory.dmp

Filesize
1.1MB

Download
memory/2236-382-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2236-381-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download
memory/2384-259-0x0000000000360000-0x0000000000470000-memory.dmp

Filesize
1.1MB

Download
memory/2384-260-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2588-139-0x00000000011B0000-0x00000000012C0000-memory.dmp

Filesize
1.1MB

Download
memory/2680-442-0x00000000003A0000-0x00000000004B0000-memory.dmp

Filesize
1.1MB

Download
memory/2716-502-0x00000000011E0000-0x00000000012F0000-memory.dmp

Filesize
1.1MB

Download
memory/2904-16-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2904-15-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/2904-14-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2904-13-0x0000000000940000-0x0000000000A50000-memory.dmp

Filesize
1.1MB

Download
memory/2904-17-0x00000000002F0000-0x00000000002FC000-memory.dmp

Filesize
48KB

Download
memory/2928-321-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2928-320-0x0000000000FC0000-0x00000000010D0000-memory.dmp

Filesize
1.1MB

Download