Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-12-2024 21:51

General

  • Target

    JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe

  • Size

    1.3MB

  • MD5

    56bf1c5e7ebee7b693c076b7ce915bfc

  • SHA1

    59e16c886da3ab440f5e3b2df4e9a97f0af411ea

  • SHA256

    6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a

  • SHA512

    43d90d2cabff9b39d951565d1e4d8ac0f763bdb0ec5234b1b51ec3ce8e1ead298474fb2ba646a8d31e75f2ec69711b4eeb84b3a318d2014248f3002f3a136ea2

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 21 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6200304e01bf04f6296375c4a993626d63f944dcb784959487ede238d23c104a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2208
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2944
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2932
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2916
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2924
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2928
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3056
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3028
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2372
          • C:\Program Files\Uninstall Information\conhost.exe
            "C:\Program Files\Uninstall Information\conhost.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1212
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BGyPdaK1JU.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1500
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:2660
                • C:\Program Files\Uninstall Information\conhost.exe
                  "C:\Program Files\Uninstall Information\conhost.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2028
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YpSpsobUXT.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:780
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:2952
                      • C:\Program Files\Uninstall Information\conhost.exe
                        "C:\Program Files\Uninstall Information\conhost.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1808
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5EJ4eIa89C.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2228
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:2244
                            • C:\Program Files\Uninstall Information\conhost.exe
                              "C:\Program Files\Uninstall Information\conhost.exe"
                              11⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3028
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DGa94wSM8j.bat"
                                12⤵
                                  PID:1964
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    13⤵
                                      PID:1168
                                    • C:\Program Files\Uninstall Information\conhost.exe
                                      "C:\Program Files\Uninstall Information\conhost.exe"
                                      13⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2584
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MKE9IzBoeI.bat"
                                        14⤵
                                          PID:2420
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            15⤵
                                              PID:1444
                                            • C:\Program Files\Uninstall Information\conhost.exe
                                              "C:\Program Files\Uninstall Information\conhost.exe"
                                              15⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2300
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RnBkS9jGYw.bat"
                                                16⤵
                                                  PID:2140
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    17⤵
                                                      PID:2916
                                                    • C:\Program Files\Uninstall Information\conhost.exe
                                                      "C:\Program Files\Uninstall Information\conhost.exe"
                                                      17⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2896
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cRRFCwJQFV.bat"
                                                        18⤵
                                                          PID:1656
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            19⤵
                                                              PID:2624
                                                            • C:\Program Files\Uninstall Information\conhost.exe
                                                              "C:\Program Files\Uninstall Information\conhost.exe"
                                                              19⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2056
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EH4KCibIlQ.bat"
                                                                20⤵
                                                                  PID:2892
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    21⤵
                                                                      PID:948
                                                                    • C:\Program Files\Uninstall Information\conhost.exe
                                                                      "C:\Program Files\Uninstall Information\conhost.exe"
                                                                      21⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:700
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat"
                                                                        22⤵
                                                                          PID:2152
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            23⤵
                                                                              PID:2908
                                                                            • C:\Program Files\Uninstall Information\conhost.exe
                                                                              "C:\Program Files\Uninstall Information\conhost.exe"
                                                                              23⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1260
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat"
                                                                                24⤵
                                                                                  PID:2060
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    25⤵
                                                                                      PID:2688
                                                                                    • C:\Program Files\Uninstall Information\conhost.exe
                                                                                      "C:\Program Files\Uninstall Information\conhost.exe"
                                                                                      25⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2784
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2764
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2888
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2624
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2868
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1168
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2612
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OSPPSVC.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2772
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1936
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1068
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dwm.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1572
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1652
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2860
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1812
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:800
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1496
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2508
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1808
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:388
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1588
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1640
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1916

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      bf9af3c6280a01a4897e5e546f9c3b07

                                      SHA1

                                      67738086ca84032629b2dc4c586f5fd6f31d2377

                                      SHA256

                                      01961287dee9a4ebd0a6a7e1d7b155d82a2a70f4e9116f4c2ec1ee723a776ea5

                                      SHA512

                                      43b00396bd261caee47ab29671fbe884116013b4ea4ce4868d5229207a0e195b45815c8a0660d4680427278c6f51e4e313f88a40c222078c93cc5deeea9926cb

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      043c901fee71b315582d6a6f461f07bd

                                      SHA1

                                      43fa4bf47732d6facb1434464b3325e0c4afbd64

                                      SHA256

                                      cd6a2cf19081935896c52ee31ab72a30757551b2ff41f6650d5fdce3c8e8d5fd

                                      SHA512

                                      60e0e623c136d49aba6d345860bd92cc44e6590d8a6f20660751a35f1ff46660119b20288e3a907fb14ba609ffb828fd000cc25e8479a3d868325eea31e3de5f

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      5d8f9f0c1988a5481d70b33416fa4d43

                                      SHA1

                                      be042de028ff4c901796028b41deab94a6f12904

                                      SHA256

                                      eaad537dc4161e7757c030c26578559529975e27677f1f401ec4545f2e2250e7

                                      SHA512

                                      e629def52f463eaa13e028161289a59c711950eaf885a3afefaeb73a38fe74a96ea5a1711f4bf6fe4abcf98c7b1cab9c2baacb5f0f4e648a6915636574f8fcb0

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      3e8c2eaca4b327b3e28ff3206cfadd0c

                                      SHA1

                                      fbe39b279086fb37ec873e531395aa42e50492a5

                                      SHA256

                                      7be10c3e2d51ea2f75a4e410d512d0a64757a962ac72701002494d69b921a071

                                      SHA512

                                      1096d64e8b5f016f91e0e457db66fbf0f66b828c26f8d984dc251791a441625789c4fb89474731e9f89b33719ac65963892945d404d0ff5466da31b4dab35d8e

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      efb168673f4a00d0e882617e1a7b1682

                                      SHA1

                                      6c2d09a9248f07c36fd1d17014b9a4ce9d6a80cc

                                      SHA256

                                      f0a89638ae887b6183e0a4a026719cbab9134a54610adfdfc50481b0d2117db4

                                      SHA512

                                      0e7665cb27ff76c1c752ab940a046ae06e07ad55bc8b37e6fb16f164c963d9e8760eacffa92a8b28d7a2be2f8e225830e9af61870b751644150bb669b32d24b3

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      f3fab6832fbe69a864d09d991986a7d9

                                      SHA1

                                      a172367f2daf7369b551e980fcbc1d77215348d8

                                      SHA256

                                      9f87cd35f1cfca03c380c2466506c1b30f249445211a1f7c0448908b364c7c42

                                      SHA512

                                      8a2a570e3b31ce01ac53cad3490d1d1b398806df5483fe1b23472d9d64a6a64d58848d7d8a2f8a7ebffff1630a98f5efc07285dfcc82139a8b7d925402c7dc81

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      413f4ca3f097aaea3e6f91fe7620c40b

                                      SHA1

                                      7815d42f5aa21aee460b7185bfcd7d3e9628a52f

                                      SHA256

                                      f1e0f569a1c1689b9874cab1db8bcae67189588d4d83b9df57dea54d2cfffc86

                                      SHA512

                                      3d43cb42f5f9b84b2db1b666d1cb0b903b146887d3961150357f9a7712480e9d5ed7ea571ab881ff9bf3d690aae549a1f253b4ea824ea64f46b6baf401d41f97

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      55d44eb47316117bc1d9989244002bde

                                      SHA1

                                      fec65d19e9f307e12075c93b5e438208ae6de57e

                                      SHA256

                                      608f0b4b60bffec2ea11429c83f07db655732d980791b22834af5e47dc0969f3

                                      SHA512

                                      2ee0e3c1cef679dbb8b0cbb6e38b0f72be2a7e5ea5f81336c86a600686027d4c3ed12139156a2e335e3ec55b059daefec3005a1cf25e50f70628d7e07b78bce9

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      342B

                                      MD5

                                      fa8a4d7b6025d9810e7417548416d821

                                      SHA1

                                      ba68cd1c0b984d1d5216b3261671f9e998059aef

                                      SHA256

                                      788f3b3e2206f705499fc4a97f539ad674875f7ed6625b4d10c17478427347ca

                                      SHA512

                                      38f18674c9e9cd14c07d43463c26f106ca0511bbd62f3b2f49f5abcec76a5893e5b3ebe0577c248f515519c390346c524c9daec67b711c1d7fae6ebfebeec968

                                    • C:\Users\Admin\AppData\Local\Temp\5EJ4eIa89C.bat

                                      Filesize

                                      215B

                                      MD5

                                      8269fb1db1719402c52efe2bbefa5fe4

                                      SHA1

                                      361680a0580339b5b454f176386fffcedea07659

                                      SHA256

                                      29b545e99976b72b1380f75fb199d5d157884056a37eaaeb8bb935b44ea0a4cd

                                      SHA512

                                      25ecc48cb6029cd05bc116f408e973b34dd48fc2fad699cdba2cb16ea32e9a85d281bf70674a6a7ac11c0eca824f50e7d76e69d3e5ae20e44a87817ad9ddf166

                                    • C:\Users\Admin\AppData\Local\Temp\BGyPdaK1JU.bat

                                      Filesize

                                      215B

                                      MD5

                                      75de50e85f5d8b7ae9f830f7a7f141b4

                                      SHA1

                                      f28bd29363af4c0301cc5e078f5f015c42de0b7f

                                      SHA256

                                      fb1e8fcc0af82d53d744c2083b58bba5533ad0ffc35e34b13ecfa12dba480e7c

                                      SHA512

                                      190ed839e76e07b0bd43020e8c834c4e20c278cc8b09dbce38a6059b3034a79005f55f0b9df701206cf6133983e1be1cb06a088736e4da441f1eec1cc4bed809

                                    • C:\Users\Admin\AppData\Local\Temp\CabD461.tmp

                                      Filesize

                                      70KB

                                      MD5

                                      49aebf8cbd62d92ac215b2923fb1b9f5

                                      SHA1

                                      1723be06719828dda65ad804298d0431f6aff976

                                      SHA256

                                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                      SHA512

                                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                    • C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat

                                      Filesize

                                      215B

                                      MD5

                                      95c29853478f3af65e75ecab410a646a

                                      SHA1

                                      e1cf570dbc151ef90d89932fb848becf15b657eb

                                      SHA256

                                      6e3d693f9340899d1152285fc3e3778c1d9701e839b3bad0b9f1674eedd11673

                                      SHA512

                                      a766a935116d2287c724441995a3e5ae9758e9b6c0f54b1f97791d497620ae9aeee035e688beb7e98b87b8aefa768b6be63ef57f7360d7e66e07f760023b99f8

                                    • C:\Users\Admin\AppData\Local\Temp\DGa94wSM8j.bat

                                      Filesize

                                      215B

                                      MD5

                                      e9d044b809db4fd1019d72038a1e51c1

                                      SHA1

                                      bcd454b38e9de230ddd36114d90d2e0868d5e7b1

                                      SHA256

                                      f0581397446eab4d5f5a9b43ab510bcff08f7a025fe9a27fcb8b238d93224da0

                                      SHA512

                                      955620eee07ad20d46152ebacd38c46a60bc140a764fc1daf5218eae6570069f8bc9274395caeecd42d67a5baceac8635fedfe7ae51c793f17b84ec3512c78f5

                                    • C:\Users\Admin\AppData\Local\Temp\EH4KCibIlQ.bat

                                      Filesize

                                      215B

                                      MD5

                                      73dd4ffc6a3460b037d4a867885e0968

                                      SHA1

                                      a82d7f8e9f3659d12313221e35425260f104ef3a

                                      SHA256

                                      dd1a83780542bcbe2a9f6974a98a5a47788ef02b16a561b859e97b9c366b7fbf

                                      SHA512

                                      2e43353743b0c40df6c4492e370c5fb1c943f1005ac25d4b114f96b2686029ed0fa5534c8a444a779d12b4b2973cf65b482e3d437369f25aa816f3f4454398c4

                                    • C:\Users\Admin\AppData\Local\Temp\MKE9IzBoeI.bat

                                      Filesize

                                      215B

                                      MD5

                                      a28512446fddd05537f6620223889055

                                      SHA1

                                      92a24a40b7e0f2f7c083f03dfac420afcf479f1d

                                      SHA256

                                      530f32ff5803669e9304e8214b1ec97e4af95bc7a084b5aa2d81629997ed32e2

                                      SHA512

                                      272fb8f0da7aef813767b2acb714d87af1e7dca1178bb89814e34daef8018eee38c59c955988ba3eeea2484876d2f573bafc839099f8fed0dd6b2c7a9235babb

                                    • C:\Users\Admin\AppData\Local\Temp\RnBkS9jGYw.bat

                                      Filesize

                                      215B

                                      MD5

                                      7f048eeb911aafbed5feb023af5ed9fb

                                      SHA1

                                      33796bc2522d2459b831986fd71ea2a6c8204caf

                                      SHA256

                                      79fa799823d90a5e08e9f4984e405525472c1554c1110d02dc8930006edeef61

                                      SHA512

                                      c9fd4abb840f48004e36045d2f23017801ce02da5de4b80e1aff9ee78c6f3eda59f027bb9adb201bf78bc93154a7047275e5be03260aded9f4311ff545a4a124

                                    • C:\Users\Admin\AppData\Local\Temp\TarD483.tmp

                                      Filesize

                                      181KB

                                      MD5

                                      4ea6026cf93ec6338144661bf1202cd1

                                      SHA1

                                      a1dec9044f750ad887935a01430bf49322fbdcb7

                                      SHA256

                                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                      SHA512

                                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                    • C:\Users\Admin\AppData\Local\Temp\YpSpsobUXT.bat

                                      Filesize

                                      215B

                                      MD5

                                      e58bae62af713a1234e6120663016889

                                      SHA1

                                      084caeb99678b0edb6af1712b773fd218801882d

                                      SHA256

                                      450eb648982f78dd785f9745b81a8b8fbfba2086dde7cbd8623e8be1bafae8d3

                                      SHA512

                                      a5eee4069ce0514177cd8ae376f15330108e9af43c2fb8fef60a83e2d5ef0d3aa0f955f6f1738ce652fad59e8adfdf07c94974251949f5b314b9c05c18004e4b

                                    • C:\Users\Admin\AppData\Local\Temp\cRRFCwJQFV.bat

                                      Filesize

                                      215B

                                      MD5

                                      bdd17119f24d70502d54b7a4e2b00f18

                                      SHA1

                                      4f71dbfdbf9c901a499478b691e9f2abb8d43a39

                                      SHA256

                                      9df68a83fe4f0501fdc02970e9cb6bd9d9f88ce95539d6992cd7781bcaba6492

                                      SHA512

                                      bcb06ccfd5cb8fc192258bdf96e8a8b4bd469e97d641886d4577183e9f1eb10380b68fc56b06b9753e015a96e1f890d2b7c6163d1b65ad0a34cf9f950dd1e3de

                                    • C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat

                                      Filesize

                                      215B

                                      MD5

                                      dad14a6c3fbd7491da4d17f33b6803bf

                                      SHA1

                                      370cbebd3cf09818191014748bf2b464febb40d2

                                      SHA256

                                      d8874a8342a56873b6e046f697aeae38518386ce1a714735c9b8d6a2f2a6b85d

                                      SHA512

                                      d757e24785354fb223686e3b645735fce332d199c884c0300cc0f954c95794c3dfff6b3b6a4b3ba50463a2424d21a5c777c6f3cb917bd9383fb5bd5476ffb4d0

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                      Filesize

                                      7KB

                                      MD5

                                      948d9487f1fd20f27d4b3a9c024a9b49

                                      SHA1

                                      f5f7297dea74657d9a207610df99811b36be1a29

                                      SHA256

                                      f22d2e2d36779e29a86ee1f6ffa703587a2120550315151b34543270b433dfdd

                                      SHA512

                                      5d4e38b76c8529911fbb6ca656e4f96b89e0a464dec517bd1ce53e53f975ff4903f7521581a42e5d4c7ba331c84cbb9e596f1004dfd8252aecf5416d997eca9d

                                    • C:\providercommon\1zu9dW.bat

                                      Filesize

                                      36B

                                      MD5

                                      6783c3ee07c7d151ceac57f1f9c8bed7

                                      SHA1

                                      17468f98f95bf504cc1f83c49e49a78526b3ea03

                                      SHA256

                                      8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                      SHA512

                                      c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                    • C:\providercommon\DllCommonsvc.exe

                                      Filesize

                                      1.0MB

                                      MD5

                                      bd31e94b4143c4ce49c17d3af46bcad0

                                      SHA1

                                      f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                      SHA256

                                      b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                      SHA512

                                      f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                    • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                      Filesize

                                      197B

                                      MD5

                                      8088241160261560a02c84025d107592

                                      SHA1

                                      083121f7027557570994c9fc211df61730455bb5

                                      SHA256

                                      2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                      SHA512

                                      20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                    • memory/700-551-0x00000000013A0000-0x00000000014B0000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/1212-76-0x00000000012B0000-0x00000000013C0000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/1808-194-0x00000000002B0000-0x00000000002C2000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/2056-491-0x0000000001260000-0x0000000001370000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2208-13-0x00000000013D0000-0x00000000014E0000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2208-16-0x00000000005A0000-0x00000000005AC000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/2208-14-0x0000000000540000-0x0000000000552000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/2208-15-0x0000000000550000-0x000000000055C000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/2208-17-0x00000000005B0000-0x00000000005BC000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/2896-431-0x0000000000200000-0x0000000000310000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2924-57-0x000000001B810000-0x000000001BAF2000-memory.dmp

                                      Filesize

                                      2.9MB

                                    • memory/2924-59-0x0000000001E00000-0x0000000001E08000-memory.dmp

                                      Filesize

                                      32KB