dcrat | 1230a11d8f6e8555c8c8a18083659ee91e4749283f8f908f428399ada45470da

Analysis

max time kernel
147s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1230a11d8f6e8555c8c8a18083659ee91e4749283f8f908f428399ada45470da.exe
Size

1.3MB
MD5

a0f9dc5d7bf5378ec878f41180b9c876
SHA1

bdba0fc60ee92c340b57f28cce29c0ff55f829a1
SHA256

1230a11d8f6e8555c8c8a18083659ee91e4749283f8f908f428399ada45470da
SHA512

799998fd3b865ce1237c2394b948a798e2fd7e34407d10d51efec0866a1d2324415f7bd6018b6ab981c0a2d82b76a8de3f0c1bc26b6ef6eee01e9ca284d5c213
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	480	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2204	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2204	schtasks.exe	34

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016855-9.dat	dcrat
behavioral1/memory/2696-13-0x0000000000940000-0x0000000000A50000-memory.dmp	dcrat
behavioral1/memory/2964-101-0x00000000001A0000-0x00000000002B0000-memory.dmp	dcrat
behavioral1/memory/2720-161-0x00000000011D0000-0x00000000012E0000-memory.dmp	dcrat
behavioral1/memory/2688-400-0x0000000000280000-0x0000000000390000-memory.dmp	dcrat
behavioral1/memory/2120-460-0x0000000000850000-0x0000000000960000-memory.dmp	dcrat
behavioral1/memory/872-520-0x00000000003F0000-0x0000000000500000-memory.dmp	dcrat
behavioral1/memory/1516-580-0x0000000000DD0000-0x0000000000EE0000-memory.dmp	dcrat
behavioral1/memory/1648-640-0x00000000000D0000-0x00000000001E0000-memory.dmp	dcrat
behavioral1/memory/2036-701-0x00000000000E0000-0x00000000001F0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1720	powershell.exe
1956	powershell.exe
948	powershell.exe
1352	powershell.exe
1148	powershell.exe
1304	powershell.exe
1124	powershell.exe
1260	powershell.exe
1184	powershell.exe
1712	powershell.exe
2480	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2696	DllCommonsvc.exe
2964	winlogon.exe
2720	winlogon.exe
1600	winlogon.exe
2728	winlogon.exe
2652	winlogon.exe
2688	winlogon.exe
2120	winlogon.exe
872	winlogon.exe
1516	winlogon.exe
1648	winlogon.exe
2036	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
1292	cmd.exe
1292	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
30	raw.githubusercontent.com
41	raw.githubusercontent.com
9	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
34	raw.githubusercontent.com
37	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\bin\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\en-US\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\it-IT\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files\DVD Maker\en-US\0a1fd5f707cd16	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Java\jre7\bin\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\it-IT\audiodg.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Prefetch\ReadyBoot\winlogon.exe	DllCommonsvc.exe
File created	C:\Windows\Prefetch\ReadyBoot\cc11b995f2a76d	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1230a11d8f6e8555c8c8a18083659ee91e4749283f8f908f428399ada45470da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3064	schtasks.exe
1516	schtasks.exe
1456	schtasks.exe
2616	schtasks.exe
2836	schtasks.exe
984	schtasks.exe
2216	schtasks.exe
480	schtasks.exe
2624	schtasks.exe
2632	schtasks.exe
2936	schtasks.exe
1072	schtasks.exe
1204	schtasks.exe
2576	schtasks.exe
2604	schtasks.exe
836	schtasks.exe
1536	schtasks.exe
2680	schtasks.exe
2224	schtasks.exe
1496	schtasks.exe
2060	schtasks.exe
3060	schtasks.exe
980	schtasks.exe
2828	schtasks.exe
1156	schtasks.exe
2112	schtasks.exe
2872	schtasks.exe
1500	schtasks.exe
1372	schtasks.exe
1548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2696	DllCommonsvc.exe
2696	DllCommonsvc.exe
2696	DllCommonsvc.exe
1260	powershell.exe
1720	powershell.exe
2480	powershell.exe
1124	powershell.exe
1184	powershell.exe
1712	powershell.exe
1304	powershell.exe
948	powershell.exe
1352	powershell.exe
1956	powershell.exe
1148	powershell.exe
2964	winlogon.exe
2720	winlogon.exe
1600	winlogon.exe
2728	winlogon.exe
2652	winlogon.exe
2688	winlogon.exe
2120	winlogon.exe
872	winlogon.exe
1516	winlogon.exe
1648	winlogon.exe
2036	winlogon.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	DllCommonsvc.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	2964	winlogon.exe
Token: SeDebugPrivilege	2720	winlogon.exe
Token: SeDebugPrivilege	1600	winlogon.exe
Token: SeDebugPrivilege	2728	winlogon.exe
Token: SeDebugPrivilege	2652	winlogon.exe
Token: SeDebugPrivilege	2688	winlogon.exe
Token: SeDebugPrivilege	2120	winlogon.exe
Token: SeDebugPrivilege	872	winlogon.exe
Token: SeDebugPrivilege	1516	winlogon.exe
Token: SeDebugPrivilege	1648	winlogon.exe
Token: SeDebugPrivilege	2036	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2500	812	JaffaCakes118_1230a11d8f6e8555c8c8a18083659ee91e4749283f8f908f428399ada45470da.exe	30
PID 812 wrote to memory of 2500	812	JaffaCakes118_1230a11d8f6e8555c8c8a18083659ee91e4749283f8f908f428399ada45470da.exe	30
PID 812 wrote to memory of 2500	812	JaffaCakes118_1230a11d8f6e8555c8c8a18083659ee91e4749283f8f908f428399ada45470da.exe	30
PID 812 wrote to memory of 2500	812	JaffaCakes118_1230a11d8f6e8555c8c8a18083659ee91e4749283f8f908f428399ada45470da.exe	30
PID 2500 wrote to memory of 1292	2500	WScript.exe	31
PID 2500 wrote to memory of 1292	2500	WScript.exe	31
PID 2500 wrote to memory of 1292	2500	WScript.exe	31
PID 2500 wrote to memory of 1292	2500	WScript.exe	31
PID 1292 wrote to memory of 2696	1292	cmd.exe	33
PID 1292 wrote to memory of 2696	1292	cmd.exe	33
PID 1292 wrote to memory of 2696	1292	cmd.exe	33
PID 1292 wrote to memory of 2696	1292	cmd.exe	33
PID 2696 wrote to memory of 1720	2696	DllCommonsvc.exe	65
PID 2696 wrote to memory of 1720	2696	DllCommonsvc.exe	65
PID 2696 wrote to memory of 1720	2696	DllCommonsvc.exe	65
PID 2696 wrote to memory of 1124	2696	DllCommonsvc.exe	66
PID 2696 wrote to memory of 1124	2696	DllCommonsvc.exe	66
PID 2696 wrote to memory of 1124	2696	DllCommonsvc.exe	66
PID 2696 wrote to memory of 1956	2696	DllCommonsvc.exe	67
PID 2696 wrote to memory of 1956	2696	DllCommonsvc.exe	67
PID 2696 wrote to memory of 1956	2696	DllCommonsvc.exe	67
PID 2696 wrote to memory of 1260	2696	DllCommonsvc.exe	68
PID 2696 wrote to memory of 1260	2696	DllCommonsvc.exe	68
PID 2696 wrote to memory of 1260	2696	DllCommonsvc.exe	68
PID 2696 wrote to memory of 1184	2696	DllCommonsvc.exe	69
PID 2696 wrote to memory of 1184	2696	DllCommonsvc.exe	69
PID 2696 wrote to memory of 1184	2696	DllCommonsvc.exe	69
PID 2696 wrote to memory of 1712	2696	DllCommonsvc.exe	70
PID 2696 wrote to memory of 1712	2696	DllCommonsvc.exe	70
PID 2696 wrote to memory of 1712	2696	DllCommonsvc.exe	70
PID 2696 wrote to memory of 948	2696	DllCommonsvc.exe	71
PID 2696 wrote to memory of 948	2696	DllCommonsvc.exe	71
PID 2696 wrote to memory of 948	2696	DllCommonsvc.exe	71
PID 2696 wrote to memory of 1352	2696	DllCommonsvc.exe	72
PID 2696 wrote to memory of 1352	2696	DllCommonsvc.exe	72
PID 2696 wrote to memory of 1352	2696	DllCommonsvc.exe	72
PID 2696 wrote to memory of 2480	2696	DllCommonsvc.exe	73
PID 2696 wrote to memory of 2480	2696	DllCommonsvc.exe	73
PID 2696 wrote to memory of 2480	2696	DllCommonsvc.exe	73
PID 2696 wrote to memory of 1148	2696	DllCommonsvc.exe	74
PID 2696 wrote to memory of 1148	2696	DllCommonsvc.exe	74
PID 2696 wrote to memory of 1148	2696	DllCommonsvc.exe	74
PID 2696 wrote to memory of 1304	2696	DllCommonsvc.exe	75
PID 2696 wrote to memory of 1304	2696	DllCommonsvc.exe	75
PID 2696 wrote to memory of 1304	2696	DllCommonsvc.exe	75
PID 2696 wrote to memory of 1852	2696	DllCommonsvc.exe	87
PID 2696 wrote to memory of 1852	2696	DllCommonsvc.exe	87
PID 2696 wrote to memory of 1852	2696	DllCommonsvc.exe	87
PID 1852 wrote to memory of 2664	1852	cmd.exe	89
PID 1852 wrote to memory of 2664	1852	cmd.exe	89
PID 1852 wrote to memory of 2664	1852	cmd.exe	89
PID 1852 wrote to memory of 2964	1852	cmd.exe	90
PID 1852 wrote to memory of 2964	1852	cmd.exe	90
PID 1852 wrote to memory of 2964	1852	cmd.exe	90
PID 2964 wrote to memory of 2404	2964	winlogon.exe	92
PID 2964 wrote to memory of 2404	2964	winlogon.exe	92
PID 2964 wrote to memory of 2404	2964	winlogon.exe	92
PID 2404 wrote to memory of 1972	2404	cmd.exe	94
PID 2404 wrote to memory of 1972	2404	cmd.exe	94
PID 2404 wrote to memory of 1972	2404	cmd.exe	94
PID 2404 wrote to memory of 2720	2404	cmd.exe	95
PID 2404 wrote to memory of 2720	2404	cmd.exe	95
PID 2404 wrote to memory of 2720	2404	cmd.exe	95
PID 2720 wrote to memory of 2656	2720	winlogon.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1230a11d8f6e8555c8c8a18083659ee91e4749283f8f908f428399ada45470da.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1230a11d8f6e8555c8c8a18083659ee91e4749283f8f908f428399ada45470da.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre7\bin\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\it-IT\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\en-US\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1304
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gKSvXanOy6.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1852
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2664
      - C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rmFq19iy8Y.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1972
        
        C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OyPKZ08zKl.bat"
        9⤵
        
        PID:2656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1928
        
        C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uZApDsIgYI.bat"
        11⤵
        
        PID:2908
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2216
        
        C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ph6jqiBtuj.bat"
        13⤵
        
        PID:1588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1584
        
        C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat"
        15⤵
        
        PID:2604
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1848
        
        C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat"
        17⤵
        
        PID:1692
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:372
        
        C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EOPCJ2Obyf.bat"
        19⤵
        
        PID:1148
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2668
        
        C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kyAhxuXJBD.bat"
        21⤵
        
        PID:2676
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2300
        
        C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\N4rS0hE0df.bat"
        23⤵
        
        PID:1320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2016
        
        C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat"
        25⤵
        
        PID:2828
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2920
        
        C:\Windows\Prefetch\ReadyBoot\winlogon.exe
        
        "C:\Windows\Prefetch\ReadyBoot\winlogon.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat"
        27⤵
        
        PID:1816
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\Prefetch\ReadyBoot\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jre7\bin\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre7\bin\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Journal\it-IT\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Journal\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\DVD Maker\en-US\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\DVD Maker\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\providercommon\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caeb2e85e0a8cb3fc5f1c557834a025d

SHA1
d8d6c62bf3e5156b8ebbf029757549702f14aa54

SHA256
b177d8030e015ebe36d96fa1a8125b8f122040d99acf82d8f884a304bfcbd36f

SHA512
8236d0ed85e1e7a61d1b03f1d5819e7c5e578996f17842bd957e81e574014f24ed7368342672830e03666a3ac3e9422b384b7acb420a4cf1c6c7a46f43ea1d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
774be9d4c7a95584cc2fca607311df6b

SHA1
96cbf8e0a9ef365b33233f17a0643ae77771299f

SHA256
d8da223af60cc2996b63f67c9b80088ecc71804881394e694fb484c4c82e1e92

SHA512
aeea52458d816661b8220e4990b4a5fc2364813397e772373700953a7aca25a982e733e8520687c1356966516fbbbcd2928616b1d766b49af687009219481e8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
156bb4b1b18c1397c367d2b2507fb786

SHA1
b353992c05cca4bcf7cd2da8539547a1e6e1d2f7

SHA256
ee5ae8f2c5ef8af8e1916946678bb497cde0e9c95b7ff3ba0e63043acc4a3383

SHA512
7e0fc44be4fee14dcb397fd6fbf93f7a4238b8ab4e5ecfbcf3cabe95d8b6d87f750f081a7f97d3fddf7f8a90866edb7c9ce8cf73f252aed270e5570c1eb5cdd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2afe4dc92800307fd7fe0e9cdbffd4e7

SHA1
702a2f3cac84e97064272e0b269d9caca24a5133

SHA256
def4c8d741933e38c940e66bc42d49e3f52aa5acb73569619aadc732a201de81

SHA512
afc9a8c61aaf3782ff8908c415cb8465a9f812cda6781ec446dd8a453d6dc111a5b9033574fb11fe21880dff1e4feac5f3af86145b3cc956a14e63cd8e3f66e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5658e64ac4786fec4c535e40e22da8f1

SHA1
763dd1000d884dbffa7efa55d4c09023c4a906d2

SHA256
62c3e1ccef140c89bc3f96de9aacbb9b2baae13be7a54e27f25f8fd02100f35a

SHA512
483053e9197bd8a46f7e9b83525bc6e89a73c2d7527ee5de228481e434f9956f7d6d335480b207007caaff4196e88b35a911ee0c231ad2fb679428029a4b23f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c352ffce357dcddea5603db2e3dd355

SHA1
a450bf561e52c091f3139283fbb6563cc9c3fa95

SHA256
7bfba0f6249350ac7211fd0a12dc915075766d941aca939ed51b4e6804cd1bf5

SHA512
0b6b56172481d33804ec7c20538b9640eb532c123972acd3cca17c277621b6425eaee129d12bc9d991c48b421f7bd41304a2c0a9449997a88d612e2eeb962ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ff7fff6a2c1a49f43a4a7593739e384

SHA1
410bc976a30760b001ca823c7bbbab5c331f8d29

SHA256
b5a33116ca170196e235476012377e75117b238ce21c167b17dda21843cb3c1a

SHA512
f5a83f1330988278f16397dadf10c74148cb336e3586bf158579410085d6f25d7be4320343b460cbd5209d3162ef5e1be13913afbcc57cd14d7f9ca2fbc0cc46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
892ac6e301a6d23be29136ad9d1ecb4b

SHA1
4bfb6c133049120e7a065bd567ff34450e6dc1d6

SHA256
b8789a70c886d11c9e0c126d58a99c007cccef3a8836107fd523bc9aca9c1dee

SHA512
85c86b4e6d575c0d541ce39901b91470a25864697ed5fd45209e6a47d634c3d240080cf54c03854b9edd866c3f53f8223078baaec40f5bf7ef0d63d8d9f68013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b80c734a6f76f85856c166a2ca10b4c2

SHA1
42e7b9353b944869d8a7dc3a8f6d29e0ebaeb976

SHA256
a226e4fc8baf2ca3b13128b18cdfcb3cc046058e9bc94aec1a273ed2863bc929

SHA512
6e24e897f4d50079de468f34705b77448c5a8301c34ce4bf809570c0555318484e3e11fd8429d0e50ecebfe5b3f89737c6efb97fc2cd6e3305297be55c951f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c238e393458089fd0a69fee165705b61

SHA1
cda9dc1cae0888f8b1f45152084ef371375effea

SHA256
bded76ffa717287e31d17bfa4fef09fd083fe9bfc35a3233d32bfe6a02b6bff0

SHA512
072f208758098df2a82ec5fc4f8d392d9bb90f110bb924ba030f2fa29dd13346e1c443eb6623a89385e0d27ec9f514962d9d8144a2e575a6918d42f4b9fa5ea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\BAdWWGXi7E.bat

Filesize
207B

MD5
664fe4e3bef7360dedce8c0aceb4d746

SHA1
c91d010725e20eee5e1d021e9b73bd6c0f973404

SHA256
1c3b67f2acaa0cde01e643ccb1db377c97c5087c725c8bc8ac255b94691d0d3b

SHA512
60223f19e442b92df52bb411e90c1353ea6994c6a9336450c034d4399194c94530bf09f912e065410d3afacd0ececc55617d63424483786381538dcd2df0ed7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\BmKXfVMxAz.bat

Filesize
207B

MD5
92dca89726636caee8d1c57c8003f731

SHA1
40b15a2ad18f1d883c7a792c173f14a67f109328

SHA256
022df413e2b5fba9455f4c6e25375e1a01f406bae950b7f79ef4cfd5d861b2b5

SHA512
f4c8d888833c70ebec6b8630278d713a7698720c287d33f43bae7d31c2fc51fcacae0a2b8747b1dc6b5278b87e20fb9418bfbf36f0233fcf2e216a50cb2fae6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB44.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EOPCJ2Obyf.bat

Filesize
207B

MD5
645567495d0d1b4ab8d6c6a601290bdb

SHA1
b40c8272a732c430f173792d3d5396f8f841c53a

SHA256
532253ed56f453d4b5fd5f4928a6f90f52d364d32d80a6e21cb475cf37cd6bb5

SHA512
225e4341d7c9614df33efcdb61c110532e79dfd0e8590d65cf0fbd3cb3a1cba43417381e71a2051d1c03d79c97b2a12c3b935cbc0f4974f2ff82908a9da5b669

Download Submit
C:\Users\Admin\AppData\Local\Temp\N4rS0hE0df.bat

Filesize
207B

MD5
bb7e3a623098774e7481c8ceaef9140c

SHA1
8242cca4fd56e088bc9516da32b948e6b43ab9d6

SHA256
81ab5ebe843dea0a7c06d3ec37001019852a23ef6d3f6f56783c61d2f7cb156d

SHA512
9cbf700075a25f04a0b87d2c2febdeb21494c563e6d6fc71244253598b1f9e83c8fa20f03d0983be26d52631888c1749f80a3a9e22401aa77df1a9d27d40d900

Download Submit
C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat

Filesize
207B

MD5
9ccd5541f9ed8b45cc57f7a8d349c16b

SHA1
36a018878aebb09bbc0bf3657f4ab336d033cb92

SHA256
2e4694c305a2adc983bfc6a1b230faa9c32865a8634fb0b1b205f8e7c41bb494

SHA512
18e4430324e24099224550dca451bbe9506edfebad3637671adc9469f27f54eb8279806ef53ad43c639db5d4f0ca7c03b0da5bc97eb2097c9acb0623e0ec61b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\OyPKZ08zKl.bat

Filesize
207B

MD5
e351ef45695020a03884431310365709

SHA1
d8f26f2d8cfdb8b4fb5df2966dab50045564b31d

SHA256
9848fcecef71afa8dc5681d3667f76cedc445139339bcda0f93aff05cd4018e9

SHA512
efd78c970631654cfb993ba7b37012c83f6eb6d236a160622eee159c7f8f69a97aa40fe08ef5bc102eb4255ed744859b488cecfe5199abf21a361c9d756e4a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB56.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gKSvXanOy6.bat

Filesize
207B

MD5
29dc0fbdd58c17a5e653796dc3f3acc0

SHA1
9782be887ce0c74f8ebfc104f6c060ed45feb0c3

SHA256
1ec3b883e7d467e3a83394b3c6fd2d4f869e1aa5f12fc17a2d09887c22abdce8

SHA512
100229c30dd4f027837dc33c947f52d3ff82b8571234381cdfd35ac01663d3003918621f2a19e507f072360ad95e24b0c6a9dd04a89e0ef79061c8bcefe47c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\kyAhxuXJBD.bat

Filesize
207B

MD5
d1fb1cd58de999e817b1b8c514c77dab

SHA1
35e77021766a708304b264d8206183fccde10c44

SHA256
22ce4dd060f43e170520e79a99e0d078c720031e0012851c44f73a230aecfdcd

SHA512
0a64e0168318edf54c7b474a231295f9ead82db133221c94c8d7d00c64326de0f7644907ce95c52e2d917d9c7ee1b80a880ebb7edbc489fb977cd715a0b6d502

Download Submit
C:\Users\Admin\AppData\Local\Temp\ph6jqiBtuj.bat

Filesize
207B

MD5
481da633282f9375b989942433f67d4a

SHA1
04ec3109534965231d0f4a8b2c6735f517ee5498

SHA256
aa1f08175db25e6efa6ae54ffc021f41a6d05b5d0d195df7c1403f8852d709e6

SHA512
09e66f67e6a186718b78795d32d1c884e361dc94048f523bd158da0a36a4f09f75b2bea5387c5c3ae0193e7301b252341ee55f676a38b6cffdde1b6ce7ebfb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\rmFq19iy8Y.bat

Filesize
207B

MD5
a117235ac8e66792439e8189397428aa

SHA1
7cddb720aa088a266afbed47ec76a69073565f62

SHA256
7bf8440e56b6b1a6532dc7366d84c98c5f909a1fded2781d0a51ae6c41ebd186

SHA512
5407d0db2d1df8f7ddf04797b772096913b2571d9bdc0101d8dc147298424f7b8b4820b4f96598e47ed1a2c166a0c2c8d32ef954925949b2be6545734551a037

Download Submit
C:\Users\Admin\AppData\Local\Temp\uZApDsIgYI.bat

Filesize
207B

MD5
3ea4a96db4f987d3d80ab0db9bbce102

SHA1
3da814b93aa9f3930851bd330712e2c39051afaa

SHA256
80ad6384d5020ed2384b668b33de89c4e6b80fc2c1694c7d2d909885da4e61d1

SHA512
f496a9c9e09cfb2f396e65d2c0d4eb34276dd66d69ced6830e3b15704e1ad8f235e1859d25fc204fb3d6aca0b23c90c854526062aa3de227f5aaf6cfa81b07cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7NMDIU9PKUZR9SWLG2S8.temp

Filesize
7KB

MD5
a5daecff808b678ebe65397c208ccbc9

SHA1
15f77fbc96eed762e5d127bab9e386694b0d3182

SHA256
0f3d5fb5fa140ad33c5724448b2e6eb18668d4b276e4e5175b81898481ef315f

SHA512
f75e104d94a1760bdce962fc7f6642967159d8968cda614014a40a3ac86566030e89e16efd7409015f2c1ed83a2b1e88d965c4e8769b558f4d997620b9ae9cc3

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/872-520-0x00000000003F0000-0x0000000000500000-memory.dmp

Filesize
1.1MB

Download
memory/1260-66-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/1516-580-0x0000000000DD0000-0x0000000000EE0000-memory.dmp

Filesize
1.1MB

Download
memory/1600-221-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/1648-640-0x00000000000D0000-0x00000000001E0000-memory.dmp

Filesize
1.1MB

Download
memory/1648-641-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/1712-47-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2036-702-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2036-701-0x00000000000E0000-0x00000000001F0000-memory.dmp

Filesize
1.1MB

Download
memory/2120-460-0x0000000000850000-0x0000000000960000-memory.dmp

Filesize
1.1MB

Download
memory/2652-340-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2688-400-0x0000000000280000-0x0000000000390000-memory.dmp

Filesize
1.1MB

Download
memory/2696-14-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/2696-15-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/2696-16-0x0000000000550000-0x000000000055C000-memory.dmp

Filesize
48KB

Download
memory/2696-13-0x0000000000940000-0x0000000000A50000-memory.dmp

Filesize
1.1MB

Download
memory/2696-17-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2720-161-0x00000000011D0000-0x00000000012E0000-memory.dmp

Filesize
1.1MB

Download
memory/2964-101-0x00000000001A0000-0x00000000002B0000-memory.dmp

Filesize
1.1MB

Download
memory/2964-102-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download