Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-12-2024 18:29

General

  • Target

    JaffaCakes118_08ca3c98f68a9ae9a0cc8d7ca065f186343cc4f301bea3bf2819587782fe1b1c.exe

  • Size

    1.3MB

  • MD5

    999dbca104982487d7c973d524634fb8

  • SHA1

    ca74174bfb55956f8801dabb3e685ebbfc3e1f50

  • SHA256

    08ca3c98f68a9ae9a0cc8d7ca065f186343cc4f301bea3bf2819587782fe1b1c

  • SHA512

    b963e6953441dc57a9c307c0e4ae1cec271e3d6c232c3b9e7c8063c4d522bb8c30e8f51a9ce5a507af1abb46a8e88312b5e3a3ff434b29dc0ea1d5af482fea88

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 11 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08ca3c98f68a9ae9a0cc8d7ca065f186343cc4f301bea3bf2819587782fe1b1c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08ca3c98f68a9ae9a0cc8d7ca065f186343cc4f301bea3bf2819587782fe1b1c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2252
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1464
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:344
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\es-ES\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1912
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1088
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PHda4ELHtF.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2520
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:2892
              • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:464
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2260
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:1720
                    • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                      "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                      8⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3064
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3032
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:2668
                          • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                            "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                            10⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2308
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m47JVZSxDi.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2988
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:1088
                                • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                                  "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                                  12⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2268
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vF7CrwxjwX.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1376
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:3044
                                      • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                                        "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                                        14⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2372
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ph6jqiBtuj.bat"
                                          15⤵
                                            PID:1468
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              16⤵
                                                PID:2352
                                              • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                                                "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                                                16⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1000
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TA6UjH3MJQ.bat"
                                                  17⤵
                                                    PID:2752
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      18⤵
                                                        PID:2600
                                                      • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                                                        "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                                                        18⤵
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1556
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5DPJyftqFq.bat"
                                                          19⤵
                                                            PID:2376
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              20⤵
                                                                PID:2004
                                                              • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                                                                "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                                                                20⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1600
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EzJh52oHEl.bat"
                                                                  21⤵
                                                                    PID:2400
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      22⤵
                                                                        PID:3008
                                                                      • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                                                                        "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                                                                        22⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2640
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IJ9EkrtYDM.bat"
                                                                          23⤵
                                                                            PID:1860
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              24⤵
                                                                                PID:1660
                                                                              • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                                                                                "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                                                                                24⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2356
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat"
                                                                                  25⤵
                                                                                    PID:704
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      26⤵
                                                                                        PID:2172
                                                                                      • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                                                                                        "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                                                                                        26⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1328
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GUMorhJGzB.bat"
                                                                                          27⤵
                                                                                            PID:1132
                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                              28⤵
                                                                                                PID:980
                                                                                              • C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe
                                                                                                "C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe"
                                                                                                28⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2260
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2560
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2704
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2588
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\es-ES\csrss.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2548
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2604
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\es-ES\csrss.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3020
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\explorer.exe'" /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3024
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\explorer.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1384
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\explorer.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:836

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          48de7ae9ee3f03f395ce655823467a95

                                          SHA1

                                          ffcdd3419e597ce6245e188969c620a0f43f1ab7

                                          SHA256

                                          7c5dba7149170705525106fe420b4d6cfc1ba47caa7126ef4f094ff63179f9ca

                                          SHA512

                                          49f926a1d6fab0d39ddbab836e4135c67be0818bd0d785292cfa5805c7b0a668b22e6fbcbbece269917709006514a91c6972bb064c0fc366967609f3d7be41cc

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          b471234e14eee159389b25f621574c4f

                                          SHA1

                                          561c34484c028bb27d4f01c6191b2563fb582886

                                          SHA256

                                          bffae90387d890a811f53e412a8cba2d1da7e4a517772c6e851be3305945b18d

                                          SHA512

                                          ac2d28ee07305dd2778d25a137e5706eeb2506db87c482092212401c95d5d60d2f03983aacf976dcf98880cff4933b79bae1e044fc088e8a36f943dba354d5d4

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          71f591bd9c341d6f9a531733c0b303ca

                                          SHA1

                                          65e8106e9e785ec766bd6b357319cf23d819f532

                                          SHA256

                                          f1ebaf98372e1019d2f8b10844f8834e88a6f311579fc95e9bbad1e81b1ddbbe

                                          SHA512

                                          9df82e03d5435a08ca0f1b7e47464515f6b1a9e28594519bb45732b39750fa15fc1200f84577c85ab6ca1f95e61a2915fe9d4212565adce9a5a3020e067f358f

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          08a3d52046ab185eadc89bdd549c80a4

                                          SHA1

                                          468b516297c425d70fbc333186df14dac613d3d0

                                          SHA256

                                          594361d8fadc28428a2b040ebe4ea405381a9e0a80f5bb41ffc08853353c0571

                                          SHA512

                                          5889bc21244fd845347c3a9e36ce05d71ad4e03a2d488b22d86f4ef302f6f8da3679fe920199408d72e0d150bdecc9f591f022556e398f7ffb73cf9fc3ce2b5a

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          a6027b721a87e9d59b9041bf1beb6586

                                          SHA1

                                          16846bb281ba76a22a7c8560c3bdb40fd4b3d470

                                          SHA256

                                          3c4d349fdcdbb5d01267a9fe8d5eb7c028989a2b833af204a490fc8b5748774f

                                          SHA512

                                          4cafa28327a3751e99b06fe5c9cf724497fc199c8b6695ba46e7576d1b5c4244b4a036b911514f02be38c6d77aabafe0b3ec1386f401fb60e92c1f4bc3a0287f

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          2f38e611a6b5b5d4a11f3ded39b4de3c

                                          SHA1

                                          b17f89aec3fa34a1d4929e6dcc57d3402fb8c780

                                          SHA256

                                          c169f9c2f89d4d0a88e11c39e1bdec696077564f6f40c21fd22cbe1a4ed46cba

                                          SHA512

                                          93661cc1fed161aca939d20269065ab9147a42c9bd304443d04642369d3069fdfae3ae2504968f00a49553423eb4768b2192a967b87851e337ed82cc0be95ac1

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          5fb57af6d3824856e37a8d91e0e698bf

                                          SHA1

                                          0da66b7b64a2086bd185d21d3975f1b36d7a2db3

                                          SHA256

                                          875794dfe07a90e92463ef55390dc2691efadddeec721cd44203a8dd4667a0e6

                                          SHA512

                                          4e98035aae416fe99fd4c6f14b40efa350716efc92893a885cf72343f51dcaf421fea018cb6e4640139eb54ea8f5776d683575aff08f4d1489ac7c82ac4fc033

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          303c6d0c66eabb64eeb915ad997533f1

                                          SHA1

                                          95ee60c58c7bd88ed3d62a1e2311f7467ea49266

                                          SHA256

                                          7d5ff84f2340759dda3d886906a09a77ccb73b570779bf97547153bd85029880

                                          SHA512

                                          82ae5a99fc779a44def04110d44264da89748cc835e0031894292219344077d986d9665504ef245bcf8207098f8d0ab481a8eae4a10703cf71dc0bbe2176fc59

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          b173a81470423843dd7de13a92797a3a

                                          SHA1

                                          e873ea08dc301be7bec68a29a32fb74a56470c7f

                                          SHA256

                                          1171275032c80889af9e2e33355fb2df0e0525ece5c7ae83f389cab8662cd5b8

                                          SHA512

                                          d363f2dc78a5663fe79f32307a069156c78433b8a0d16f8e33eeb7326e04a0b761ac9b8a75ef6a686b39d119f9efe6d2ab9964830418742cc0a22d4bcd0a213b

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                          Filesize

                                          342B

                                          MD5

                                          df594a6043496cfa5117e76eff2da5f2

                                          SHA1

                                          13f614f67332e000110aa6ff61b4dd23a006fe6f

                                          SHA256

                                          338c18cb0ea9165413e15da6b16acf33e69edf830e14294654fc27bfec97ac52

                                          SHA512

                                          8f6741be5c9bf1d2f6ddeb93a00ae2d280c966aa09864db48dbc5986cf7fc2063415326eca21e8b80a33c079ee5359127f340c55a59a35af6a824f3e7cf125b8

                                        • C:\Users\Admin\AppData\Local\Temp\5DPJyftqFq.bat

                                          Filesize

                                          226B

                                          MD5

                                          333b68de93ff41d74563b077a91e37a2

                                          SHA1

                                          e5c66c9cb734f92f961d26f12e89cc0825019607

                                          SHA256

                                          adf3179209607c0c56c6dd06f88933de9cf51a0075fa18aabf142b07dd9e6719

                                          SHA512

                                          f914db2403b22d49d8f4f61cbadd6d0d94188fc66902500ca6264f6b99eeae1b77186b9b732f3c8d13ad5cc7b56596d7eaf3cefc909636521b6771cd4aa6bf0e

                                        • C:\Users\Admin\AppData\Local\Temp\Cab2204.tmp

                                          Filesize

                                          70KB

                                          MD5

                                          49aebf8cbd62d92ac215b2923fb1b9f5

                                          SHA1

                                          1723be06719828dda65ad804298d0431f6aff976

                                          SHA256

                                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                          SHA512

                                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                        • C:\Users\Admin\AppData\Local\Temp\EzJh52oHEl.bat

                                          Filesize

                                          226B

                                          MD5

                                          36ae489fcbd4021d24aa0f4ffaf9158f

                                          SHA1

                                          52a2845d76e022fcdc7ea7816d2ce8bad11ae6b0

                                          SHA256

                                          0aaec10c4e5ba860f8ffced045f8bb48b1f2ff0ead0117933a3d1a48c1e167bd

                                          SHA512

                                          7cd23be7da0eaf20171ac12fc5e383d63af779a82b10b9867164f332cd26394917c9a29a20f51a996c5e688a5e8609064d831ff79fa34c78cd51f125a926271b

                                        • C:\Users\Admin\AppData\Local\Temp\GUMorhJGzB.bat

                                          Filesize

                                          226B

                                          MD5

                                          71d0684222a2aa13878cf42875436515

                                          SHA1

                                          b33bb115663dfdacaf6ec061c7e6be07db6a4161

                                          SHA256

                                          83e4c4b0d909f0a6d328697e015d4910e3bf066daa90b04d261d0d70cb1bd73b

                                          SHA512

                                          0a2c178ff6cbe5d6009f9c9e507e2e11b675ee794ffbe20f413e8ea4577fbb60b8f28971368eebc4eb6d33faea3561ad0dce155aa977802b0944feae8b03db75

                                        • C:\Users\Admin\AppData\Local\Temp\IJ9EkrtYDM.bat

                                          Filesize

                                          226B

                                          MD5

                                          361d56e4e533b36c4165cef8e7d07c9a

                                          SHA1

                                          0c913a585ad11e2f45c84ba4e841ff48ecf3f6ab

                                          SHA256

                                          2a209390827d9e356ce02ac8669234f29850111f3f0a7d774a47d553ea73790e

                                          SHA512

                                          fe2b280cfff0a55cd075ac44bd37db9b906bc0a0e1931c3ab0219ed77de668c862c2c71461068d192c8ee84b0b965964cd7196f65434250fc29a15ee1199d671

                                        • C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat

                                          Filesize

                                          226B

                                          MD5

                                          ff1334c6bc40a89dcede8918d62f6dc0

                                          SHA1

                                          eec75e26b7ee00eb99803404131724c6d3a06b19

                                          SHA256

                                          9d49ce24944a62e03eabdbefcc84772d6fdaf6a6d77ff95d834da86d2c7e43a9

                                          SHA512

                                          1b55a0d5e28c52c200adaefd9156fa59357f7ba4981c5a27d3dac453421622985dde962ce4f1f24905515ebbf38c5bc382bc9884167de60c91302d1d37801ac1

                                        • C:\Users\Admin\AppData\Local\Temp\PHda4ELHtF.bat

                                          Filesize

                                          226B

                                          MD5

                                          5d1cd61a299e0900bbd180135c7d71e2

                                          SHA1

                                          54df65349509a640cc9a3a09540b0cdce64aeb90

                                          SHA256

                                          847614d408ebcc9c9fe3e41c5de48687a08351167e1c0c77b3776fa32f78a574

                                          SHA512

                                          822d9a1c42ca1e47de502f95d7881e900cac53ae569053f5e43042714e1fb0d576dc8ce743e6ab30f7778f248eb451724b87eb029c37f334567c205dbf1658b0

                                        • C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat

                                          Filesize

                                          226B

                                          MD5

                                          5bcfb924c427b2133130d4212b581010

                                          SHA1

                                          e1d8cf267d5f7bf93b53a99ff0f989b5ccf06ea8

                                          SHA256

                                          07ab06308034abf8d1bf48c1edc69786b036b5f661db81c9df8943b67bf12550

                                          SHA512

                                          b65456419df8f8faef403c03e9932fce1a79e829acff8c61361891e248cdead7cb17a9b42e742fbef9273b32792ec2838f71c42b72c4b99e811da6113f8084d4

                                        • C:\Users\Admin\AppData\Local\Temp\TA6UjH3MJQ.bat

                                          Filesize

                                          226B

                                          MD5

                                          ad67f9926597218077b3eab70c38c09c

                                          SHA1

                                          e2560bb7f144b74bd724271664d988a7037fa189

                                          SHA256

                                          683f711ee0942abb5eba0b65dd76907851c41f64e7dbeffb5eef1ba9a42af4f2

                                          SHA512

                                          7972bf87bb9f68c356f0d6bff4e4358befc6a7d7474cefd6210353d1e6c4642a0095efaf46e502e6c6c424d60e74540e0ed83ba17e83f577b580a4dea574ddba

                                        • C:\Users\Admin\AppData\Local\Temp\Tar2226.tmp

                                          Filesize

                                          181KB

                                          MD5

                                          4ea6026cf93ec6338144661bf1202cd1

                                          SHA1

                                          a1dec9044f750ad887935a01430bf49322fbdcb7

                                          SHA256

                                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                          SHA512

                                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                        • C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat

                                          Filesize

                                          226B

                                          MD5

                                          536ce8115be9a656d80c588f34c23514

                                          SHA1

                                          fefa716c4d221de39b4b85157826f267e0fb8c79

                                          SHA256

                                          cefa97c529a58f51130d2773ccd85f41e73d1aa59c2061e9d62031ddafe8d425

                                          SHA512

                                          c7b0179752c2612247653a90172ecc0cbe6ef14810825f41084b525d010577d4f9dd7178fde3948849e98edeed9aeb68a32bbe7d71d498f8f31414950b76193e

                                        • C:\Users\Admin\AppData\Local\Temp\m47JVZSxDi.bat

                                          Filesize

                                          226B

                                          MD5

                                          16ce60a1e712f87a5d9852a803a2c5db

                                          SHA1

                                          639d64aac73ffef1397a6c20adf0fc49d24efea5

                                          SHA256

                                          6cd9d75a55be88e3319d8cc7bc7d97797ad8d5050ee3685c2c4342b0d03e9853

                                          SHA512

                                          4dfad06f109352f27dcd23c0d95235a0f1e3f9c39e672d9abcea3c425757fae373dae77731cdf86b19eec98a7c359c5e5f130cbc860efdb7dc8a02d9087afba7

                                        • C:\Users\Admin\AppData\Local\Temp\ph6jqiBtuj.bat

                                          Filesize

                                          226B

                                          MD5

                                          4a6276aa0acecc751bf0a981d640eb19

                                          SHA1

                                          e0064742bf355253b9c52545a03775942d2ea213

                                          SHA256

                                          dbcf44b3ce4da087dee9125c2eb850dd64f4dd8095a419b673e6bbc067c8405e

                                          SHA512

                                          71d69e1175e4777d7e7625e8ccd40e4237725c24750a54639d17c801e6e818edde8f54aff02f87f9c18772eb9b57afe8b3216db6440fcb484c062c04a99597f3

                                        • C:\Users\Admin\AppData\Local\Temp\vF7CrwxjwX.bat

                                          Filesize

                                          226B

                                          MD5

                                          22ccf2fb13a02906fe3699f02e3a3d1f

                                          SHA1

                                          573585e0130366b4018976922434414fe2cc7f37

                                          SHA256

                                          ed0621b946239d5c3cc7505e1890a16d9964baec0f6a370da749936b5a3e269b

                                          SHA512

                                          3fc6a71a5f06986f4a900f4a9d46276da83fc4a5bdb265ccc5b07f8fdc49ba442c44398701fcd748922031e1234e74fb715497edabdc179f9c45b7dcc90f4941

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                          Filesize

                                          7KB

                                          MD5

                                          dce258a458437cf9a6484ebef7999554

                                          SHA1

                                          d1563f248f0ca5945ee17db1b4589ccfc2b8f040

                                          SHA256

                                          7d1559441dcbc1a9ef1241ff02603d69fd308b58beb8e5079773734945fb4e25

                                          SHA512

                                          73dd2c03fe5b84edf4a17f696093cdd60e9833994a336bf878832d7b5cffc36405f31fcb281e47bd1b96e9cc49d49ff527d0c361065c2b6c276b78b27f04b017

                                        • C:\providercommon\1zu9dW.bat

                                          Filesize

                                          36B

                                          MD5

                                          6783c3ee07c7d151ceac57f1f9c8bed7

                                          SHA1

                                          17468f98f95bf504cc1f83c49e49a78526b3ea03

                                          SHA256

                                          8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                          SHA512

                                          c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                        • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                          Filesize

                                          197B

                                          MD5

                                          8088241160261560a02c84025d107592

                                          SHA1

                                          083121f7027557570994c9fc211df61730455bb5

                                          SHA256

                                          2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                          SHA512

                                          20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                        • \providercommon\DllCommonsvc.exe

                                          Filesize

                                          1.0MB

                                          MD5

                                          bd31e94b4143c4ce49c17d3af46bcad0

                                          SHA1

                                          f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                          SHA256

                                          b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                          SHA512

                                          f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                        • memory/464-53-0x0000000000350000-0x0000000000362000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/464-52-0x0000000000240000-0x0000000000350000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/1464-33-0x000000001B510000-0x000000001B7F2000-memory.dmp

                                          Filesize

                                          2.9MB

                                        • memory/1464-38-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/1556-413-0x0000000000350000-0x0000000000460000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/1600-473-0x00000000012E0000-0x00000000013F0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2268-234-0x0000000000D30000-0x0000000000E40000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2308-173-0x0000000000B50000-0x0000000000C60000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2308-174-0x0000000000530000-0x0000000000542000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/2356-593-0x0000000000F40000-0x0000000001050000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2372-294-0x0000000001000000-0x0000000001110000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2640-533-0x0000000000340000-0x0000000000450000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/2660-17-0x0000000000580000-0x000000000058C000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/2660-16-0x0000000000560000-0x000000000056C000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/2660-15-0x0000000000570000-0x000000000057C000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/2660-14-0x0000000000350000-0x0000000000362000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/2660-13-0x0000000000090000-0x00000000001A0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/3064-113-0x0000000000450000-0x0000000000462000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/3064-112-0x00000000001D0000-0x00000000002E0000-memory.dmp

                                          Filesize

                                          1.1MB