dcrat | ec633413317c712592ea2c50b3fa8d062eb91afd3679ce30651076931e82b2f2

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ec633413317c712592ea2c50b3fa8d062eb91afd3679ce30651076931e82b2f2.exe
Size

1.3MB
MD5

c077e372fb469c583d958ac9e9e27007
SHA1

37e9af372245e82705edfad94958cb559360dc17
SHA256

ec633413317c712592ea2c50b3fa8d062eb91afd3679ce30651076931e82b2f2
SHA512

75907f58af78c15e4c9979725b5e26f886b237eea0c9f94ed96674da275cf2c4a4c9b2cc3cf0d9551f8e6b3dc704979824e0d7b0b562af1f26b27af79d80623e
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2888	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2888	schtasks.exe	35

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016c58-9.dat	dcrat
behavioral1/memory/2096-13-0x0000000001290000-0x00000000013A0000-memory.dmp	dcrat
behavioral1/memory/2300-115-0x0000000000110000-0x0000000000220000-memory.dmp	dcrat
behavioral1/memory/2328-174-0x0000000000E60000-0x0000000000F70000-memory.dmp	dcrat
behavioral1/memory/2392-234-0x00000000002B0000-0x00000000003C0000-memory.dmp	dcrat
behavioral1/memory/1432-294-0x0000000000B90000-0x0000000000CA0000-memory.dmp	dcrat
behavioral1/memory/2056-354-0x0000000001000000-0x0000000001110000-memory.dmp	dcrat
behavioral1/memory/3060-475-0x0000000001180000-0x0000000001290000-memory.dmp	dcrat
behavioral1/memory/1988-535-0x0000000000300000-0x0000000000410000-memory.dmp	dcrat
behavioral1/memory/2248-595-0x0000000001260000-0x0000000001370000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2244	powershell.exe
728	powershell.exe
1352	powershell.exe
1584	powershell.exe
868	powershell.exe
1208	powershell.exe
3052	powershell.exe
1688	powershell.exe
680	powershell.exe
1852	powershell.exe
1404	powershell.exe
2568	powershell.exe
2092	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2096	DllCommonsvc.exe
2300	taskhost.exe
2328	taskhost.exe
2392	taskhost.exe
1432	taskhost.exe
2056	taskhost.exe
532	taskhost.exe
3060	taskhost.exe
1988	taskhost.exe
2248	taskhost.exe
564	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2316	cmd.exe
2316	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
16	raw.githubusercontent.com
27	raw.githubusercontent.com
24	raw.githubusercontent.com
31	raw.githubusercontent.com
35	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
13	raw.githubusercontent.com
20	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\de-DE\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\de-DE\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\6ccacd8608530f	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\RemotePackages\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\RemotePackages\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ec633413317c712592ea2c50b3fa8d062eb91afd3679ce30651076931e82b2f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1928	schtasks.exe
2988	schtasks.exe
1136	schtasks.exe
2652	schtasks.exe
2680	schtasks.exe
1600	schtasks.exe
1556	schtasks.exe
1924	schtasks.exe
1976	schtasks.exe
2588	schtasks.exe
2848	schtasks.exe
524	schtasks.exe
2416	schtasks.exe
2500	schtasks.exe
1692	schtasks.exe
1856	schtasks.exe
1872	schtasks.exe
1536	schtasks.exe
1672	schtasks.exe
2700	schtasks.exe
1276	schtasks.exe
2628	schtasks.exe
2620	schtasks.exe
1596	schtasks.exe
1616	schtasks.exe
2208	schtasks.exe
1244	schtasks.exe
308	schtasks.exe
1448	schtasks.exe
2392	schtasks.exe
1360	schtasks.exe
2844	schtasks.exe
3000	schtasks.exe
1940	schtasks.exe
1424	schtasks.exe
1292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2096	DllCommonsvc.exe
2096	DllCommonsvc.exe
2096	DllCommonsvc.exe
2244	powershell.exe
1688	powershell.exe
2092	powershell.exe
1404	powershell.exe
680	powershell.exe
3052	powershell.exe
868	powershell.exe
1352	powershell.exe
1208	powershell.exe
1584	powershell.exe
1852	powershell.exe
2568	powershell.exe
728	powershell.exe
2300	taskhost.exe
2328	taskhost.exe
2392	taskhost.exe
1432	taskhost.exe
2056	taskhost.exe
532	taskhost.exe
3060	taskhost.exe
1988	taskhost.exe
2248	taskhost.exe
564	taskhost.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	DllCommonsvc.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	2300	taskhost.exe
Token: SeDebugPrivilege	2328	taskhost.exe
Token: SeDebugPrivilege	2392	taskhost.exe
Token: SeDebugPrivilege	1432	taskhost.exe
Token: SeDebugPrivilege	2056	taskhost.exe
Token: SeDebugPrivilege	532	taskhost.exe
Token: SeDebugPrivilege	3060	taskhost.exe
Token: SeDebugPrivilege	1988	taskhost.exe
Token: SeDebugPrivilege	2248	taskhost.exe
Token: SeDebugPrivilege	564	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2508	2408	JaffaCakes118_ec633413317c712592ea2c50b3fa8d062eb91afd3679ce30651076931e82b2f2.exe	31
PID 2408 wrote to memory of 2508	2408	JaffaCakes118_ec633413317c712592ea2c50b3fa8d062eb91afd3679ce30651076931e82b2f2.exe	31
PID 2408 wrote to memory of 2508	2408	JaffaCakes118_ec633413317c712592ea2c50b3fa8d062eb91afd3679ce30651076931e82b2f2.exe	31
PID 2408 wrote to memory of 2508	2408	JaffaCakes118_ec633413317c712592ea2c50b3fa8d062eb91afd3679ce30651076931e82b2f2.exe	31
PID 2508 wrote to memory of 2316	2508	WScript.exe	32
PID 2508 wrote to memory of 2316	2508	WScript.exe	32
PID 2508 wrote to memory of 2316	2508	WScript.exe	32
PID 2508 wrote to memory of 2316	2508	WScript.exe	32
PID 2316 wrote to memory of 2096	2316	cmd.exe	34
PID 2316 wrote to memory of 2096	2316	cmd.exe	34
PID 2316 wrote to memory of 2096	2316	cmd.exe	34
PID 2316 wrote to memory of 2096	2316	cmd.exe	34
PID 2096 wrote to memory of 1688	2096	DllCommonsvc.exe	72
PID 2096 wrote to memory of 1688	2096	DllCommonsvc.exe	72
PID 2096 wrote to memory of 1688	2096	DllCommonsvc.exe	72
PID 2096 wrote to memory of 2244	2096	DllCommonsvc.exe	73
PID 2096 wrote to memory of 2244	2096	DllCommonsvc.exe	73
PID 2096 wrote to memory of 2244	2096	DllCommonsvc.exe	73
PID 2096 wrote to memory of 680	2096	DllCommonsvc.exe	74
PID 2096 wrote to memory of 680	2096	DllCommonsvc.exe	74
PID 2096 wrote to memory of 680	2096	DllCommonsvc.exe	74
PID 2096 wrote to memory of 1208	2096	DllCommonsvc.exe	77
PID 2096 wrote to memory of 1208	2096	DllCommonsvc.exe	77
PID 2096 wrote to memory of 1208	2096	DllCommonsvc.exe	77
PID 2096 wrote to memory of 728	2096	DllCommonsvc.exe	78
PID 2096 wrote to memory of 728	2096	DllCommonsvc.exe	78
PID 2096 wrote to memory of 728	2096	DllCommonsvc.exe	78
PID 2096 wrote to memory of 868	2096	DllCommonsvc.exe	79
PID 2096 wrote to memory of 868	2096	DllCommonsvc.exe	79
PID 2096 wrote to memory of 868	2096	DllCommonsvc.exe	79
PID 2096 wrote to memory of 3052	2096	DllCommonsvc.exe	80
PID 2096 wrote to memory of 3052	2096	DllCommonsvc.exe	80
PID 2096 wrote to memory of 3052	2096	DllCommonsvc.exe	80
PID 2096 wrote to memory of 1584	2096	DllCommonsvc.exe	81
PID 2096 wrote to memory of 1584	2096	DllCommonsvc.exe	81
PID 2096 wrote to memory of 1584	2096	DllCommonsvc.exe	81
PID 2096 wrote to memory of 1852	2096	DllCommonsvc.exe	82
PID 2096 wrote to memory of 1852	2096	DllCommonsvc.exe	82
PID 2096 wrote to memory of 1852	2096	DllCommonsvc.exe	82
PID 2096 wrote to memory of 2092	2096	DllCommonsvc.exe	83
PID 2096 wrote to memory of 2092	2096	DllCommonsvc.exe	83
PID 2096 wrote to memory of 2092	2096	DllCommonsvc.exe	83
PID 2096 wrote to memory of 2568	2096	DllCommonsvc.exe	85
PID 2096 wrote to memory of 2568	2096	DllCommonsvc.exe	85
PID 2096 wrote to memory of 2568	2096	DllCommonsvc.exe	85
PID 2096 wrote to memory of 1352	2096	DllCommonsvc.exe	87
PID 2096 wrote to memory of 1352	2096	DllCommonsvc.exe	87
PID 2096 wrote to memory of 1352	2096	DllCommonsvc.exe	87
PID 2096 wrote to memory of 1404	2096	DllCommonsvc.exe	89
PID 2096 wrote to memory of 1404	2096	DllCommonsvc.exe	89
PID 2096 wrote to memory of 1404	2096	DllCommonsvc.exe	89
PID 2096 wrote to memory of 2552	2096	DllCommonsvc.exe	98
PID 2096 wrote to memory of 2552	2096	DllCommonsvc.exe	98
PID 2096 wrote to memory of 2552	2096	DllCommonsvc.exe	98
PID 2552 wrote to memory of 1664	2552	cmd.exe	100
PID 2552 wrote to memory of 1664	2552	cmd.exe	100
PID 2552 wrote to memory of 1664	2552	cmd.exe	100
PID 2552 wrote to memory of 2300	2552	cmd.exe	101
PID 2552 wrote to memory of 2300	2552	cmd.exe	101
PID 2552 wrote to memory of 2300	2552	cmd.exe	101
PID 2300 wrote to memory of 444	2300	taskhost.exe	102
PID 2300 wrote to memory of 444	2300	taskhost.exe	102
PID 2300 wrote to memory of 444	2300	taskhost.exe	102
PID 444 wrote to memory of 2472	444	cmd.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ec633413317c712592ea2c50b3fa8d062eb91afd3679ce30651076931e82b2f2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ec633413317c712592ea2c50b3fa8d062eb91afd3679ce30651076931e82b2f2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2096
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Pictures\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\de-DE\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Application Data\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sWIIaz4T59.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2552
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1664
      - C:\Users\Public\Documents\My Pictures\taskhost.exe
        
        "C:\Users\Public\Documents\My Pictures\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:444
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2472
        
        C:\Users\Public\Documents\My Pictures\taskhost.exe
        
        "C:\Users\Public\Documents\My Pictures\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\U4eMIZxK0W.bat"
        9⤵
        
        PID:2424
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2436
        
        C:\Users\Public\Documents\My Pictures\taskhost.exe
        
        "C:\Users\Public\Documents\My Pictures\taskhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat"
        11⤵
        
        PID:2232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1920
        
        C:\Users\Public\Documents\My Pictures\taskhost.exe
        
        "C:\Users\Public\Documents\My Pictures\taskhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WPmuDeaX4D.bat"
        13⤵
        
        PID:1628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1700
        
        C:\Users\Public\Documents\My Pictures\taskhost.exe
        
        "C:\Users\Public\Documents\My Pictures\taskhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oqEnL4f5pl.bat"
        15⤵
        
        PID:884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1276
        
        C:\Users\Public\Documents\My Pictures\taskhost.exe
        
        "C:\Users\Public\Documents\My Pictures\taskhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oS12nhm3yC.bat"
        17⤵
        
        PID:844
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1644
        
        C:\Users\Public\Documents\My Pictures\taskhost.exe
        
        "C:\Users\Public\Documents\My Pictures\taskhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gW6qUMg8Bu.bat"
        19⤵
        
        PID:2692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1552
        
        C:\Users\Public\Documents\My Pictures\taskhost.exe
        
        "C:\Users\Public\Documents\My Pictures\taskhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vkfoWdc5zM.bat"
        21⤵
        
        PID:2080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1564
        
        C:\Users\Public\Documents\My Pictures\taskhost.exe
        
        "C:\Users\Public\Documents\My Pictures\taskhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b7oBPqXqtO.bat"
        23⤵
        
        PID:2808
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:752
        
        C:\Users\Public\Documents\My Pictures\taskhost.exe
        
        "C:\Users\Public\Documents\My Pictures\taskhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Pictures\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Pictures\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\My Pictures\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\de-DE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\de-DE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\de-DE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\RemotePackages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b52aa2f105dfc86f9f5d5357435ada95

SHA1
100834a6de8537a4bfe2b26a1f17a3aa599465cd

SHA256
0be8e7306db577c80b7491318b5a659cc8f654e67ab4f6439411e286c19d42e4

SHA512
8211435ed87acc52e12217253c3849eaad5f72a6c5acf0ef486d5300c952df6b1cbd846c0f3eedac5d8a9c9c2dae18bb611767b2022d88b692da72be590def3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45ecf7d2db7674424e30040f5d00af22

SHA1
06e38574f59de0175690cb8d4d25caa02db09453

SHA256
3137fd95d3550ece5033a4fe752fb1fba9dc77f9277c06172dc67d18b17534b3

SHA512
438f2fc40eebd592a7ada751b12ab4ff64c4982861ee2a9b1d94f2acc6a7df2d08dc561785943f2b8f9a775dc9f695d72cf9341e571d033698b5c69ac9983bea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe5800c49093772e2a609bded67396b2

SHA1
4999b8f59d28e5a75013beabb5d203ff17ff56cd

SHA256
976744382977109f0ad03e6d1c4dd6e37feb5f005aa3d32dd7e46cc03ece367f

SHA512
fa5208a79cbe484eb79cd4507d6823f4615e24f9051f860f6ee892949676a811d5d856fe8d18fd7ba97ddebad3c3703b0b20208f9a803e742eb4236ea4657470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df4b8637d3627ff7aa4b555bb4eb3257

SHA1
e9c8b9b2012b9e350b0a5b9027792154ae296fe0

SHA256
a1785dd40ab40cb15d5a3f7ced779bb2a6beeeb96e104f3f0be6c1f474056334

SHA512
f4942b2734c87b84815da1c357ac7b253b2233e58c6cfb825e065757d12e2b43d580fd7578d8e32b6beb9cd92c0cae5d868d327431b20109b2061a738d5ec6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bf7756600ba9d89b3a7fcea913df065

SHA1
106302ceea9a52b192a5a3801a3eb473e4d6bd69

SHA256
865b30673a588532e36e29471108432e07787f81f2ecc17cc4fce4ddd5ef6c58

SHA512
1b82625742831629227dae15aa6d17d8cd746e51b0c17bcffad2abffb409ea13fa62ef254311925b73154224ed88e5974199acb70cd82fb120ddd3a675e4cf7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
413a8e94bc19a6fd99661114cd2ed62e

SHA1
76766b77fe66c1d3c83fa687529d6af19eba0847

SHA256
c76d8a5159113b59dd63c74369f37c05f6cac328bd346f7edb0ef673e0986578

SHA512
b98197d06d65cd7c4ca716542d1d3e629348bc5320174addb87b63355b333fd5d3bcc6f91e16b6fedc2949775b498c1d98543839808994d5570046fd772ed86c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa8c32ebad68cd04ac2c2df9b05e3b16

SHA1
8c8a5a324a397e459788fd83489d3a914071ff43

SHA256
c06bfe1971d634e244f56be5929eea3389a2177182d8c216412ab43f68c05a00

SHA512
ef0f1726c35017787e0f2ed10d8a6c1c52bb1080aaf03c690928edb6e5860d452b5155fe52b19ce6cec5e96875607441e04913485a25a3aba008f5ab38e1b3cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7743c1b7d737b9ebcbea41c4f5c80579

SHA1
f066283ea36aecc354d48bf4dbf72eae1a37fa51

SHA256
601b52f0a075412107ec29630de1968eb0baa25c4c8e6db7c3c4b5968a43b611

SHA512
ea040f345eefe76163bcb7b0c8d73b74c72b65a9c11546bb8714cce95cb42eb2d9b2b5dafd870fccf98048daf7e2bf449ed1ca47a5cf8245cb66ba2e2f9c461a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27FC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat

Filesize
215B

MD5
bd1a2a68a57c30f83bb9be771d9e1131

SHA1
c7060406a8d17d8fca7a29ed092779bfc3dcbfac

SHA256
a5469072d6a023ac0565afe8d2b3fb61bf6ea3a2ad77164a5086ac1c0832403f

SHA512
e9f631dc320b744f7ab3f02c9a6a7079db1e27aab98b39436cfcc7c45dbb003d6490d791f7dd8018b7c3718004ca0f8ac420200a729c1a8d40713325c73d1941

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar282E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\U4eMIZxK0W.bat

Filesize
215B

MD5
fca34358284aba14a6f321b1eac5e754

SHA1
f321be346f97c34ac4d537c364f867e7360464e9

SHA256
feb84de502840bdc90c7f33860e76852f07a397fee5ef4f68c0cd90cd8f9c23e

SHA512
b596a6eccc9baf8e05849b35455010e8202aec83cb14f6ecda87cc1348be805e38bbd0b49c725bc7e93763ef6ba28e1600bc29a5a917617c8e5801b7662a488d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPmuDeaX4D.bat

Filesize
215B

MD5
919b647c61ba7e9654842b8a2fa34b08

SHA1
259298508cd8a59871c44e8259e7aa8267ae8a86

SHA256
295df17e574c3a2bc9155c3dc9b54324722982a59c5df5ca0398f3d0e8e76cc4

SHA512
81d955d81fd80732e0e15014b26926f387c51ed5789e03a782854ceaefc22c97ee45403a3e4c9c8c932a6dfac1753920468b456171658e0d734dda8fb802059d

Download Submit
C:\Users\Admin\AppData\Local\Temp\b7oBPqXqtO.bat

Filesize
215B

MD5
362d4f3bd8aa57cf9c1bb5732d04577b

SHA1
c02e1ce9a10816910281401d510c2810531f477c

SHA256
07c8dd7b488bab5272769b56d85d7f848a88af38234b90a559884dd0a1dcacfa

SHA512
62bb3c481415a5d42a93a8ca192faadd86094a4ab00d27111868698adb644f86b59dd7df4318a9ab3801c2797292292898e4f03c67c18dca15c9dfe4b4e23436

Download Submit
C:\Users\Admin\AppData\Local\Temp\gW6qUMg8Bu.bat

Filesize
215B

MD5
f8985419c7514e41c1193871053407fd

SHA1
37fcf3b9afc812d5524c397055bb07e2718d9743

SHA256
70b2957e32696e8e8106387882f8de5a88e831e1dec07d1df63ad9432e2c1635

SHA512
a44b8bcf1609f002da62ca49de02a4af23c4850f02eda1544cc968f56596d388211c50da0eef678e1b3153bdbf3743ff9d52a0edbd8a0709911c24657fec0fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat

Filesize
215B

MD5
2e3efa335ebe41b2d8a052b61b7f769d

SHA1
020d64a27f2d4f0bf0a6bbd58ecbed7b6a002be1

SHA256
bfb2fe8642b54b564948028379678c38f58f088174881b4e19fac9a6922127c6

SHA512
078ebfbbee4725c3ff655b4e75c6d92e6a379922daf8d5eecc9e08d82ca9784578edb86831126ba0ac051f053762d6341101e1cd53fd4a201b5b5a08cee479a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\oS12nhm3yC.bat

Filesize
215B

MD5
19d6388afb545c342487622b10fef62c

SHA1
aa7247f9ca6110c1138221da1780905fa01c7b85

SHA256
f19093e698100f37095a7b58f1c6666ed66e9494f551a88d475f1a74bf3fac11

SHA512
564d02c08de03f5fffa3bd93d9dbe81f56140c8cff85b263c515dc27c061dc7138ac1313c3d4e150f8fa474ab41079525075af70efce785c5ef5cba680dd4581

Download Submit
C:\Users\Admin\AppData\Local\Temp\oqEnL4f5pl.bat

Filesize
215B

MD5
8dff2713d57f10a9f51db104f6d91a55

SHA1
bb1afb67050a8b7050422e9cf1f864153f8ed140

SHA256
c4c00acbadb79db921bbf7f803730e961b4523bbabb81f76f5b63708175d7f2d

SHA512
ff023309fd7f803f26a6cc5876412853d9e63953d622a8b299a6bd7ec970f3d79df6a3d9a407ad60394d4afd582843d1694bdbb43d5f6a16cfad3a97381d21ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\sWIIaz4T59.bat

Filesize
215B

MD5
a441b32fed9e67729fbac38acb5c0cd0

SHA1
2161eb0d87a93d748c030874c9f16a584a5cc67d

SHA256
12fc20ba4c9665f722c67c84684f1bdd321683d7c46ba0f9a80e841a9b2e8504

SHA512
896f042485d86ed0b6f5e51ad1540ee861c6e71a624c6fb39d5c76c7121c34794d17d549494e296472bf15cde7638d08cc8b7517c4c9f31811343c51c90673f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vkfoWdc5zM.bat

Filesize
215B

MD5
4711e6b443a7e11b73fc884b94011b27

SHA1
24ed3eab472a914e76989ffd923805bde44580e5

SHA256
fe41f3024f4dc85cc44bb2116c6a19a575d5a79573eb6257fc8225449c4e81e1

SHA512
e845bca5fad088ffcfe304a580220a0e8686466255b98289e9a15ee5f3e8721ad1238e5b6ccdb0a3bdab234df30ffbc768d7a412b5bbe7865d8f7d6e96000885

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
893656282b27d4070c3c13134f9fc659

SHA1
21228a6c98e0fc3f6165d33fce5fd06a8745177b

SHA256
1354fd6b51d423c1e870feb9241ac25c759765790d49d1f0c93cf7f54de42bb6

SHA512
557b4c19ac041fcdb260371e5116484e7f6d543e61cb02ee03f9e0be649f34d3a30e764ed2c307de88d2f03cfdf285b779ff8c30ac3df011bfcacc7ba3425d25

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/532-415-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/1432-294-0x0000000000B90000-0x0000000000CA0000-memory.dmp

Filesize
1.1MB

Download
memory/1988-535-0x0000000000300000-0x0000000000410000-memory.dmp

Filesize
1.1MB

Download
memory/2056-354-0x0000000001000000-0x0000000001110000-memory.dmp

Filesize
1.1MB

Download
memory/2056-355-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2096-13-0x0000000001290000-0x00000000013A0000-memory.dmp

Filesize
1.1MB

Download
memory/2096-15-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

Filesize
48KB

Download
memory/2096-17-0x0000000000B00000-0x0000000000B0C000-memory.dmp

Filesize
48KB

Download
memory/2096-16-0x0000000000AF0000-0x0000000000AFC000-memory.dmp

Filesize
48KB

Download
memory/2096-14-0x0000000000AD0000-0x0000000000AE2000-memory.dmp

Filesize
72KB

Download
memory/2244-50-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2244-51-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2248-595-0x0000000001260000-0x0000000001370000-memory.dmp

Filesize
1.1MB

Download
memory/2300-115-0x0000000000110000-0x0000000000220000-memory.dmp

Filesize
1.1MB

Download
memory/2328-174-0x0000000000E60000-0x0000000000F70000-memory.dmp

Filesize
1.1MB

Download
memory/2392-234-0x00000000002B0000-0x00000000003C0000-memory.dmp

Filesize
1.1MB

Download
memory/3060-475-0x0000000001180000-0x0000000001290000-memory.dmp

Filesize
1.1MB

Download