dcrat | 4ae33cae4341e6aec82d49653a498f26264734527571c61386a40215b4aaaa11

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4ae33cae4341e6aec82d49653a498f26264734527571c61386a40215b4aaaa11.exe
Size

1.3MB
MD5

094d2cb319f98577ac7b3ef1f3b6a299
SHA1

a982e74596a5b8ba7dff0769ac24a7e4e1a2c9cb
SHA256

4ae33cae4341e6aec82d49653a498f26264734527571c61386a40215b4aaaa11
SHA512

3b5180bf2e1127e424d7327b6ac0d7bb6c2e880a91e93ce73313303b60301591d701c3b7f0a476042cd230dd7e62e3cd1edd20c13b1e5aacae670abb74941673
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	572	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	572	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016d70-11.dat	dcrat
behavioral1/memory/2660-13-0x00000000010D0000-0x00000000011E0000-memory.dmp	dcrat
behavioral1/memory/1440-113-0x0000000000A60000-0x0000000000B70000-memory.dmp	dcrat
behavioral1/memory/2236-172-0x0000000001350000-0x0000000001460000-memory.dmp	dcrat
behavioral1/memory/1288-350-0x0000000000300000-0x0000000000410000-memory.dmp	dcrat
behavioral1/memory/1504-410-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat
behavioral1/memory/2548-470-0x0000000000290000-0x00000000003A0000-memory.dmp	dcrat
behavioral1/memory/2256-531-0x0000000000F60000-0x0000000001070000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2580	powershell.exe
1072	powershell.exe
2520	powershell.exe
2004	powershell.exe
2576	powershell.exe
1908	powershell.exe
1884	powershell.exe
1876	powershell.exe
2424	powershell.exe
108	powershell.exe
2280	powershell.exe
2040	powershell.exe
884	powershell.exe
3008	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2660	DllCommonsvc.exe
1440	explorer.exe
2236	explorer.exe
1828	explorer.exe
1976	explorer.exe
1288	explorer.exe
1504	explorer.exe
2548	explorer.exe
2256	explorer.exe
2844	explorer.exe
2096	explorer.exe

Loads dropped DLL 2 IoCs

pid	Process
2828	cmd.exe
2828	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com
30	raw.githubusercontent.com
4	raw.githubusercontent.com
23	raw.githubusercontent.com
33	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\de-DE\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\it-IT\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\it-IT\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\de-DE\lsass.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Help\Windows\en-US\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Help\Windows\en-US\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\PLA\Templates\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\PLA\Templates\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4ae33cae4341e6aec82d49653a498f26264734527571c61386a40215b4aaaa11.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
700	schtasks.exe
1616	schtasks.exe
1740	schtasks.exe
1124	schtasks.exe
2292	schtasks.exe
2232	schtasks.exe
2624	schtasks.exe
1624	schtasks.exe
624	schtasks.exe
1448	schtasks.exe
1540	schtasks.exe
2696	schtasks.exe
3000	schtasks.exe
2076	schtasks.exe
1472	schtasks.exe
2360	schtasks.exe
2508	schtasks.exe
2096	schtasks.exe
1912	schtasks.exe
2052	schtasks.exe
2620	schtasks.exe
836	schtasks.exe
2344	schtasks.exe
1632	schtasks.exe
576	schtasks.exe
472	schtasks.exe
2588	schtasks.exe
936	schtasks.exe
2380	schtasks.exe
1724	schtasks.exe
2000	schtasks.exe
2356	schtasks.exe
2036	schtasks.exe
2184	schtasks.exe
3068	schtasks.exe
2124	schtasks.exe
1188	schtasks.exe
852	schtasks.exe
1696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2660	DllCommonsvc.exe
884	powershell.exe
2280	powershell.exe
1072	powershell.exe
2580	powershell.exe
2004	powershell.exe
1884	powershell.exe
2040	powershell.exe
3008	powershell.exe
2576	powershell.exe
1908	powershell.exe
108	powershell.exe
2424	powershell.exe
2520	powershell.exe
1876	powershell.exe
1440	explorer.exe
2236	explorer.exe
1828	explorer.exe
1976	explorer.exe
1288	explorer.exe
1504	explorer.exe
2548	explorer.exe
2256	explorer.exe
2844	explorer.exe
2096	explorer.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	DllCommonsvc.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	108	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	1440	explorer.exe
Token: SeDebugPrivilege	2236	explorer.exe
Token: SeDebugPrivilege	1828	explorer.exe
Token: SeDebugPrivilege	1976	explorer.exe
Token: SeDebugPrivilege	1288	explorer.exe
Token: SeDebugPrivilege	1504	explorer.exe
Token: SeDebugPrivilege	2548	explorer.exe
Token: SeDebugPrivilege	2256	explorer.exe
Token: SeDebugPrivilege	2844	explorer.exe
Token: SeDebugPrivilege	2096	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2744	2872	JaffaCakes118_4ae33cae4341e6aec82d49653a498f26264734527571c61386a40215b4aaaa11.exe	30
PID 2872 wrote to memory of 2744	2872	JaffaCakes118_4ae33cae4341e6aec82d49653a498f26264734527571c61386a40215b4aaaa11.exe	30
PID 2872 wrote to memory of 2744	2872	JaffaCakes118_4ae33cae4341e6aec82d49653a498f26264734527571c61386a40215b4aaaa11.exe	30
PID 2872 wrote to memory of 2744	2872	JaffaCakes118_4ae33cae4341e6aec82d49653a498f26264734527571c61386a40215b4aaaa11.exe	30
PID 2744 wrote to memory of 2828	2744	WScript.exe	31
PID 2744 wrote to memory of 2828	2744	WScript.exe	31
PID 2744 wrote to memory of 2828	2744	WScript.exe	31
PID 2744 wrote to memory of 2828	2744	WScript.exe	31
PID 2828 wrote to memory of 2660	2828	cmd.exe	33
PID 2828 wrote to memory of 2660	2828	cmd.exe	33
PID 2828 wrote to memory of 2660	2828	cmd.exe	33
PID 2828 wrote to memory of 2660	2828	cmd.exe	33
PID 2660 wrote to memory of 2580	2660	DllCommonsvc.exe	74
PID 2660 wrote to memory of 2580	2660	DllCommonsvc.exe	74
PID 2660 wrote to memory of 2580	2660	DllCommonsvc.exe	74
PID 2660 wrote to memory of 884	2660	DllCommonsvc.exe	75
PID 2660 wrote to memory of 884	2660	DllCommonsvc.exe	75
PID 2660 wrote to memory of 884	2660	DllCommonsvc.exe	75
PID 2660 wrote to memory of 2576	2660	DllCommonsvc.exe	76
PID 2660 wrote to memory of 2576	2660	DllCommonsvc.exe	76
PID 2660 wrote to memory of 2576	2660	DllCommonsvc.exe	76
PID 2660 wrote to memory of 3008	2660	DllCommonsvc.exe	77
PID 2660 wrote to memory of 3008	2660	DllCommonsvc.exe	77
PID 2660 wrote to memory of 3008	2660	DllCommonsvc.exe	77
PID 2660 wrote to memory of 2520	2660	DllCommonsvc.exe	79
PID 2660 wrote to memory of 2520	2660	DllCommonsvc.exe	79
PID 2660 wrote to memory of 2520	2660	DllCommonsvc.exe	79
PID 2660 wrote to memory of 1884	2660	DllCommonsvc.exe	80
PID 2660 wrote to memory of 1884	2660	DllCommonsvc.exe	80
PID 2660 wrote to memory of 1884	2660	DllCommonsvc.exe	80
PID 2660 wrote to memory of 1072	2660	DllCommonsvc.exe	82
PID 2660 wrote to memory of 1072	2660	DllCommonsvc.exe	82
PID 2660 wrote to memory of 1072	2660	DllCommonsvc.exe	82
PID 2660 wrote to memory of 1908	2660	DllCommonsvc.exe	83
PID 2660 wrote to memory of 1908	2660	DllCommonsvc.exe	83
PID 2660 wrote to memory of 1908	2660	DllCommonsvc.exe	83
PID 2660 wrote to memory of 2424	2660	DllCommonsvc.exe	84
PID 2660 wrote to memory of 2424	2660	DllCommonsvc.exe	84
PID 2660 wrote to memory of 2424	2660	DllCommonsvc.exe	84
PID 2660 wrote to memory of 108	2660	DllCommonsvc.exe	86
PID 2660 wrote to memory of 108	2660	DllCommonsvc.exe	86
PID 2660 wrote to memory of 108	2660	DllCommonsvc.exe	86
PID 2660 wrote to memory of 2280	2660	DllCommonsvc.exe	87
PID 2660 wrote to memory of 2280	2660	DllCommonsvc.exe	87
PID 2660 wrote to memory of 2280	2660	DllCommonsvc.exe	87
PID 2660 wrote to memory of 2040	2660	DllCommonsvc.exe	88
PID 2660 wrote to memory of 2040	2660	DllCommonsvc.exe	88
PID 2660 wrote to memory of 2040	2660	DllCommonsvc.exe	88
PID 2660 wrote to memory of 1876	2660	DllCommonsvc.exe	89
PID 2660 wrote to memory of 1876	2660	DllCommonsvc.exe	89
PID 2660 wrote to memory of 1876	2660	DllCommonsvc.exe	89
PID 2660 wrote to memory of 2004	2660	DllCommonsvc.exe	91
PID 2660 wrote to memory of 2004	2660	DllCommonsvc.exe	91
PID 2660 wrote to memory of 2004	2660	DllCommonsvc.exe	91
PID 2660 wrote to memory of 2340	2660	DllCommonsvc.exe	102
PID 2660 wrote to memory of 2340	2660	DllCommonsvc.exe	102
PID 2660 wrote to memory of 2340	2660	DllCommonsvc.exe	102
PID 2340 wrote to memory of 584	2340	cmd.exe	104
PID 2340 wrote to memory of 584	2340	cmd.exe	104
PID 2340 wrote to memory of 584	2340	cmd.exe	104
PID 2340 wrote to memory of 1440	2340	cmd.exe	105
PID 2340 wrote to memory of 1440	2340	cmd.exe	105
PID 2340 wrote to memory of 1440	2340	cmd.exe	105
PID 1440 wrote to memory of 836	1440	explorer.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ae33cae4341e6aec82d49653a498f26264734527571c61386a40215b4aaaa11.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ae33cae4341e6aec82d49653a498f26264734527571c61386a40215b4aaaa11.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\it-IT\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\Windows\en-US\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Templates\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\de-DE\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\23h8ayMt11.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2340
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:584
      - C:\Program Files\Windows Mail\it-IT\explorer.exe
        
        "C:\Program Files\Windows Mail\it-IT\explorer.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xkGYwzkQoc.bat"
        7⤵
        
        PID:836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2100
        
        C:\Program Files\Windows Mail\it-IT\explorer.exe
        
        "C:\Program Files\Windows Mail\it-IT\explorer.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CrTeqwt2Oo.bat"
        9⤵
        
        PID:2392
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1504
        
        C:\Program Files\Windows Mail\it-IT\explorer.exe
        
        "C:\Program Files\Windows Mail\it-IT\explorer.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TEfATY8not.bat"
        11⤵
        
        PID:2296
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:940
        
        C:\Program Files\Windows Mail\it-IT\explorer.exe
        
        "C:\Program Files\Windows Mail\it-IT\explorer.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W3ML2JPNvQ.bat"
        13⤵
        
        PID:1440
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1028
        
        C:\Program Files\Windows Mail\it-IT\explorer.exe
        
        "C:\Program Files\Windows Mail\it-IT\explorer.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8KwMxVG80h.bat"
        15⤵
        
        PID:2276
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1748
        
        C:\Program Files\Windows Mail\it-IT\explorer.exe
        
        "C:\Program Files\Windows Mail\it-IT\explorer.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0xFiNVDkrN.bat"
        17⤵
        
        PID:2748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2344
        
        C:\Program Files\Windows Mail\it-IT\explorer.exe
        
        "C:\Program Files\Windows Mail\it-IT\explorer.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CSN9cxKiet.bat"
        19⤵
        
        PID:2080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1928
        
        C:\Program Files\Windows Mail\it-IT\explorer.exe
        
        "C:\Program Files\Windows Mail\it-IT\explorer.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ST975DOJvB.bat"
        21⤵
        
        PID:1920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:108
        
        C:\Program Files\Windows Mail\it-IT\explorer.exe
        
        "C:\Program Files\Windows Mail\it-IT\explorer.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat"
        23⤵
        
        PID:1992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3056
        
        C:\Program Files\Windows Mail\it-IT\explorer.exe
        
        "C:\Program Files\Windows Mail\it-IT\explorer.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\it-IT\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\it-IT\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\it-IT\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\Windows\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Help\Windows\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\Windows\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\PLA\Templates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\PLA\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\en-US\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\de-DE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f697d0043deb4162591b9fca2de15311

SHA1
37d956108341db4659ac24722fb03de52d331b46

SHA256
926646b98134e01d18bc1ff78c0f2ff0d6fc908aa187d407afb755c33b320840

SHA512
9e36e69a5c33681c7cf90711427875da09e334bb227e654be4f506e010875fa62c17057ef08d82249ee917f872139ec2d9b2b0107722cf3b81ce22ab5b65538e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e8c0bf5350558752b5ad3d12f3d1de1

SHA1
e1d743252a649aa8bd0681ecef3c95ba4f4ca750

SHA256
e464900f87e600693d32cb8b4364bc17b01b88f2e38f27947b40afc157ca6f6e

SHA512
cd01ec144ddc511c3664d46eeff8c0f52274e86d01f86eab8feae3055ab3935d03d55c4b110774d809933ef780210fa06d2fe3469910308c82c34f085c6111b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3a4e66fa336b77602987560ce86d62b

SHA1
7616622f11efe707363fba537b376696deb76ada

SHA256
41c5b865d565c751267379bf5099b89103564f35f75650d798a37cee2470f1d2

SHA512
47c81246275abce46feb92b828b7587b19198e919af4c4196fb6e2d236d31dbcf30dc95c8f2d0b8ac054f0cdc210584b1f66079813beffec52da69ba7768b397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70bc0561823288aeedf6736fce5d1140

SHA1
742c5b3a851e24d58f1919b40a64b8eb1bc1b2da

SHA256
3d686b5bc3bb70d0afd1730f8aa52c2df58d520c66c546ff7e6d1597d604b233

SHA512
42edc7771cd215bc017236f8987359eb639777db4a12a6a606e3a3d8c0df059617fde9312df96810652b8eef0e7a516b03a925c02681b3ae64312630050a5d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
130e6a694f8289e22548958d36a7af22

SHA1
ebe1866dd1e842982650aa1bb95beefeab6954e5

SHA256
79f9724f0df36ccf2e4951f96f40dfd0af4f4d35844fc8636446fc32a4c07173

SHA512
6f72c7b061a07e5a9bd5c5c91bf633d6ab48a3e835d411b4009521656126f5d18c32d209921c2f90ff4bc1ddad8065ecdb745994d27f8459a68a513505c770a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
141a920177707303b20058fd624eb6b0

SHA1
d97dedf0a88e265b5ebece4534a892fb9be139db

SHA256
90a014a3c83d4b8ba233154c138c2f13c7a2192ddc3c2a02c6132fc07dd1fbee

SHA512
04e0acde407f3762b933cde11c581bfc90d99564c87761e60341beb8a58c80720073892380ed2a048b8d1f9ae12b51e916d2be0c802d824d9f43e591a3798b46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc7f2569d79ade8e0fffb2942fe760d5

SHA1
b33ae241508b4142bd582ec84a655007b6f43ebd

SHA256
2de0fe69fcd208fb34bd43aca31314ec10390ca17c2e13092f04b7490202f1cc

SHA512
a56afc40948abd2d953a25d5b7fde8a6186c5fcc265c533293095d04150b102def2e5647ecf2b923c92539116dbdab39803701c284269490bce1fdaee38144f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cc43ec6acc117fa19432932408693e2

SHA1
2ae769fef529694ba29f0f99de265981cb60bcad

SHA256
88d53ee50e511e86fe4e39d6b5d838ce5943e7ad0a0ba629d96f4213bc39e172

SHA512
1ce13dd9bbebc48d375b680d398175618add3a381d1060cca5f5be2cf3161611963d314020b86f9618ac07cad308168271498b9a1a6ef9ce26011e3c8bdd6931

Download Submit
C:\Users\Admin\AppData\Local\Temp\0xFiNVDkrN.bat

Filesize
213B

MD5
bf70d961f51b79f4dd7a9998c413d0b9

SHA1
9484825d96ee4f791e23139713123a182cd245de

SHA256
89bf37d50486efa0221802197aba9bd9192b3de37daf93cfcf25a6878367e79f

SHA512
6951c903e021ca80a17e82b6a43dee11b894862c0a64e5e6862e6761a6eea88c865763ab466ac185b3f76b03f7461601f354ce234f891e2d8245bacdc1d0feaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\23h8ayMt11.bat

Filesize
213B

MD5
7e56952f807b7cc0ba96612ca224b904

SHA1
2b5919c0e1c09531b089d0bbae945853cfcb7d30

SHA256
c693c0e7d5c781baafa257b6788d73f5b5e33c62b889d54259937c32d2aeb739

SHA512
247510e9a6e1089189059bbfe994b915ea2583cdf91586b5d7dc637362d813cd03b27814270caf574f362c5b02784c8ac277229b02ac971764ed612c73f6c33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8KwMxVG80h.bat

Filesize
213B

MD5
7f0bb75d810341db5016c77cda8407d0

SHA1
61e80787c05831566154a0aef022df3eea45eaed

SHA256
a1b2fc5f1bd58d5ca364a7aaaa360108b90bde630b017e9c942d6248de219f1c

SHA512
1fb3c626735009b2e0fec8e37c1f3ec8d209e1c3a3b204e13882506ec9e46ef9dcad5333bcda423b515ed791b4a0ef5699eea3e437a605996c6d677c53255ec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CSN9cxKiet.bat

Filesize
213B

MD5
d14f24f0eef65fd919da8f9200c8bafc

SHA1
9b3d65e1b3e81081a1e88811fcbc60236e9c0df2

SHA256
261072be55f662d5a28688ce06f94ff9aebdbc96fe2a3d1be1cadc0d7981347d

SHA512
098fb8b0a6a2900b520eaf5d6c1ae6225291edd24f3036765e85a0fd84d2c183390e5e89cac7123fd0efaed17e0aab389160c0a828104a70ae0fd55143a23634

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA843.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CrTeqwt2Oo.bat

Filesize
213B

MD5
0cf67f6c7ecb8dfe2a95c517f7d39d01

SHA1
664142f068696c8151ab2b490ff20d0c48eab37a

SHA256
a46c998af77d1592ff15c8949c9cd4ca17db43bade3be3f7fe7ab521878a9d7c

SHA512
8d729a4c9ba63e737c3fc33d2ab483946454f7c2bf8b8fb304e357b982e1337326f70b8dc707cd52c6bee56da089637bee68edc898dc1a30bef18e716c6e17c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ST975DOJvB.bat

Filesize
213B

MD5
3a3c866e99dca125fc500a6e0c70cb2d

SHA1
7ea636cc819f2d0fafb8f98ddebf947cfa111a23

SHA256
318e8c47ee4006f2a99d9e3e8a309eb734af5752a2addf633370c92929738ec4

SHA512
aef199572b7ea48a589ea643c1f41762c3fb8944b4d7b30e757fe1d1562da3cf9db55fb130966664b48958df74a2ffc99741aec1984eefe5d10443ed24f649ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\TEfATY8not.bat

Filesize
213B

MD5
5075366135a84c3ed80fc0eb8556fe73

SHA1
77d88aed8b8b0a31f7d5f9bcab7daaba63b83f3f

SHA256
e78a1473f394f2a1a8c5c65ee2d33aa16cd6abfcbc7502ba588b62dcb0df4a99

SHA512
bb13ed0527f336d2fa86d79d915d9317c296a8923f8feec9c179a8342dc1472bfbe5aff0c68552082df312ada19bc8bea6cfef380b92b380cb0ee1d0561eea48

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA884.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\W3ML2JPNvQ.bat

Filesize
213B

MD5
0bec9315f570db94275cf3d9ee7f4604

SHA1
1f62c2e0f407462926c491c5df84eadb24771140

SHA256
3e4c3422775ceced6c57ca1286e34098c64fb1921aeb8ddf9fb9c73fe97a280d

SHA512
e5123bb0f0ad97f5fa6255544a5df900f46a9d60d147ad64f22d8e6fffd47e181875fc5af96ba82e25cccfc438bbff4d0f3184f6b2748abb1d1e80281b57ae98

Download Submit
C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat

Filesize
213B

MD5
feb16c52e2047e33937446e9672ad583

SHA1
6afd3c3c5f82570fbf138e800d4a31554172f729

SHA256
355a2981571ea161f38e0030850166c4c7a9804e27b54db638d7203780cde273

SHA512
7ed4bfe15d20baae7543563a35d742d15a051e2bfcaabfdfaf56ed8890362a58d144f80719320c6fa44c750d8447acf3311857f96d70b9a72a1ed59e6f3071e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\xkGYwzkQoc.bat

Filesize
213B

MD5
7e30aa1dd900631152193f71e9b4b3f5

SHA1
4331b13adc45d29db935b5fbd0c002d9631b8a71

SHA256
91948a5c112cde4e84e3491ee1b493381806388810763042fd4b8cc41e5fd2b2

SHA512
ac5fad310cc7ff0a8a784acf0258cacc48a35e5a1aa9cd59f11eea7be8179cc558d2857e02e5418b5dfe7461541b0d72cefb0905c77cdbff417b39bd2e5bc901

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a1b41e6c25470d36802804744b8d1251

SHA1
4c83a8fbf9f0ccc6b0f38d200adedf795af75dd5

SHA256
6f835078c370562708978f7cb0620390eed1432ac6f0f1b6e531f3d630b94177

SHA512
422703233ae2cfb1b8c45413369b03f76a4d8f8372d0856273e0ea609ffb985f20855d6fe84a8dfa0a9fe47b772e430bf9a83a7e25b06f28cd161d27d97f0d8b

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/884-99-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/1288-350-0x0000000000300000-0x0000000000410000-memory.dmp

Filesize
1.1MB

Download
memory/1440-113-0x0000000000A60000-0x0000000000B70000-memory.dmp

Filesize
1.1MB

Download
memory/1504-410-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/2096-651-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2236-172-0x0000000001350000-0x0000000001460000-memory.dmp

Filesize
1.1MB

Download
memory/2256-531-0x0000000000F60000-0x0000000001070000-memory.dmp

Filesize
1.1MB

Download
memory/2548-470-0x0000000000290000-0x00000000003A0000-memory.dmp

Filesize
1.1MB

Download
memory/2548-471-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/2580-89-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

Filesize
2.9MB

Download
memory/2660-16-0x00000000005E0000-0x00000000005EC000-memory.dmp

Filesize
48KB

Download
memory/2660-15-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2660-14-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2660-13-0x00000000010D0000-0x00000000011E0000-memory.dmp

Filesize
1.1MB

Download
memory/2660-17-0x0000000000A20000-0x0000000000A2C000-memory.dmp

Filesize
48KB

Download
memory/2844-591-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download