Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 05:50

General

  • Target

    JaffaCakes118_ec7b9f631ebf4c70ed7399d6d91efd09395e5de4490c6530f3ae53287a0abe6c.exe

  • Size

    1.3MB

  • MD5

    b3f7440c67beb19abf2e9579e0478b5a

  • SHA1

    505e8af58739465185edbb8e7867508a697aa48d

  • SHA256

    ec7b9f631ebf4c70ed7399d6d91efd09395e5de4490c6530f3ae53287a0abe6c

  • SHA512

    72740374c180c53d12c09f6a0999b7d283c6ebf6c1802619e45ea2a3c1b892d30a0be38737e244cc60328a9d757f445e95830aafb497709b07345716bf7958f7

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 10 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ec7b9f631ebf4c70ed7399d6d91efd09395e5de4490c6530f3ae53287a0abe6c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ec7b9f631ebf4c70ed7399d6d91efd09395e5de4490c6530f3ae53287a0abe6c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2664
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3044
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2600
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3016
          • C:\providercommon\csrss.exe
            "C:\providercommon\csrss.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2764
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6M87tNVNy8.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:696
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:2200
                • C:\providercommon\csrss.exe
                  "C:\providercommon\csrss.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:908
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ISA3vp411k.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1548
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:1988
                      • C:\providercommon\csrss.exe
                        "C:\providercommon\csrss.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2344
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcPyovVCSH.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1612
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:400
                            • C:\providercommon\csrss.exe
                              "C:\providercommon\csrss.exe"
                              11⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2732
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Tcsv1v0qfT.bat"
                                12⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2536
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  13⤵
                                    PID:1204
                                  • C:\providercommon\csrss.exe
                                    "C:\providercommon\csrss.exe"
                                    13⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:1180
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"
                                      14⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2188
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        15⤵
                                          PID:1680
                                        • C:\providercommon\csrss.exe
                                          "C:\providercommon\csrss.exe"
                                          15⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1520
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat"
                                            16⤵
                                              PID:2828
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                17⤵
                                                  PID:3020
                                                • C:\providercommon\csrss.exe
                                                  "C:\providercommon\csrss.exe"
                                                  17⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3068
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat"
                                                    18⤵
                                                      PID:2216
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        19⤵
                                                          PID:1124
                                                        • C:\providercommon\csrss.exe
                                                          "C:\providercommon\csrss.exe"
                                                          19⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:448
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SRNviAgREO.bat"
                                                            20⤵
                                                              PID:1744
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                21⤵
                                                                  PID:2448
                                                                • C:\providercommon\csrss.exe
                                                                  "C:\providercommon\csrss.exe"
                                                                  21⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2220
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X5pWA5YIY7.bat"
                                                                    22⤵
                                                                      PID:2920
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        23⤵
                                                                          PID:2660
                                                                        • C:\providercommon\csrss.exe
                                                                          "C:\providercommon\csrss.exe"
                                                                          23⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2668
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m1XclINWiF.bat"
                                                                            24⤵
                                                                              PID:2560
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                25⤵
                                                                                  PID:2384
                                                                                • C:\providercommon\csrss.exe
                                                                                  "C:\providercommon\csrss.exe"
                                                                                  25⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1696
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\providercommon\csrss.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2592
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2768
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2692
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\wininit.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2556
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Cursors\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2588
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\wininit.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2632

                                Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        5c945d6fd34d86fdba5ece72b8da428d

                                        SHA1

                                        9d85b7e81b5894861bd57119bc5e6c534853d430

                                        SHA256

                                        682307c5ae03e804fd1a05e5703eee457904dbb239706ca93c1041f36f3a2cce

                                        SHA512

                                        e29b5898f1825c773774300418c50cf7241b941972d643ed4fdc8553167456a6c09971f03cecab63e25bce15d173bfff7ec309519353d0ff559a657daf5531d3

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        7749a2a83c65f0fa69cbde858b6c4bff

                                        SHA1

                                        393d68816ce82a7fc07dc71f31ab2645a09f47f5

                                        SHA256

                                        0b84f15e217aae448a2341467fa731b645ece1534a710c2625eb8b33bebbd477

                                        SHA512

                                        4660b972648f61bfc30a8966e92ca7f2c67c22790bc380915c1a8cf4c325f228e6e34e9fb0995ef6df139168879a2d01a33be8e522c88ece7055f53104b20db8

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        fa0fe671b046c50282daa8f4a79fd67d

                                        SHA1

                                        f29ed9e4abb75f56c6bddaa33be8a9b8bfbfabff

                                        SHA256

                                        24d578aafb0facff906259ddeb6a10a7a3922768c922fb9aed3c628e3e5908f3

                                        SHA512

                                        3220ee5b8c1b7e7ecb4142ffedbcc8d82163067fd1e49b27de7b6349e08e484eb79686b4fc4ed60c0f6fbb6ae03c27ce13c8220ba013e4029e20fd14a9ac271e

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        c1ace3097a628436c2d1fcca992a98e7

                                        SHA1

                                        37d5dfb3223e6be6d5c145206fc1a802ad5578e3

                                        SHA256

                                        185898e6733dd5de25675e1726c6a6ab0c87621a2ce2eeddc769aa4cfb0be686

                                        SHA512

                                        c319e72f88c52e66434e8fd3d42fe39e8ff0882f0c5af27d9a56ae489cb17bc0c47f1739a93e2d64d5a0132b86bd04d9589eff4f03ae5d764293536c810065d7

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        9d5524e0591a6e9e569f60fff2106581

                                        SHA1

                                        ec47cf8d2367da4692c6d328040b4643d0a87d91

                                        SHA256

                                        2d9416cdfc7ba15e2708cc8022f2138fd2cc56d7e8b722fd4958bf742bc4b78b

                                        SHA512

                                        c02561ddd75f331ce8394e5619dc65267091a48bf92a940bcf7873096ff4dac51d8144ebb00f4e0df8b11d959a7b7ae7a07f06f17b571404e209917ace0cc36b

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        9ae097289ac53b52c9b78ff108241db0

                                        SHA1

                                        97c858e928c9fbee032b5f4a620073b8c1b6c028

                                        SHA256

                                        69e023ed0a75cf67d3388c1929dde10e056a546f13f1353f2eefaa4f54777176

                                        SHA512

                                        306ce8808f33e69a069afc13069549a874a8617909f0c6b42ca8724363434f62ecc4736a0e2be34d656b86f0264d0e6f58212a267c1acee143e82037864a5b6b

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        84ea15c38c86d13d18a36df01404914a

                                        SHA1

                                        4c9b9c5d81b4ce5ea8b9530f3b3b0887ea8429e9

                                        SHA256

                                        914e82c63a16efd7abfc0b3d80360dc548cfffb78b3ffe98dd7f583d7dd3076a

                                        SHA512

                                        fe2f09853cdd6cefaef03f4119bd1cac0549f7945114bf30b292fc043e16ec99017f56e3d590bd74aaa7bb6f01949f84ab8d13ee5b42fd280426e54c86bc00ff

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        13aaf6aa5a128e593a5bb5c196630fbb

                                        SHA1

                                        b1717c23364617a8f3356e17d07ba3d13f6ab181

                                        SHA256

                                        0800549b9fe9564c257c55b6c825ec90c20e202af47e66e1587d1aecff6c70ed

                                        SHA512

                                        463d226044b09e158c2d6b784c4ed41c291cda9790901d9a5420a6ca3826be7c8820e742b35e7045f2e7e193e1ec95c4473a7c02aedbe29688c0258c295a7acd

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        18b5d6a6d64fd8d18f449b6035cccd6f

                                        SHA1

                                        a2fa7f886e27b9ef42a5ed5f7cf05f2c4efab155

                                        SHA256

                                        388664452ff46a7e1e771159b4d5caab33696ba4f3d1761eb5db5e26e4e6bdc6

                                        SHA512

                                        47b858bba566c86313350ca745279e9938bb8e1c43834d5437f1e14a55e3c5defa92ed9f1f90dd35e9d6651f661611476aa678ee6485f2815a8aa4e66f03fc17

                                      • C:\Users\Admin\AppData\Local\Temp\6M87tNVNy8.bat

                                        Filesize

                                        192B

                                        MD5

                                        c57c0c3c9c35691063516378951aab28

                                        SHA1

                                        8d5800a5ea2d25f836ae63909e9903209fc4c17a

                                        SHA256

                                        ade057fabc175c2706967269a9b1699ae64e074fbfdee4fb8c48d8edc790854a

                                        SHA512

                                        cafad7875430db27585576e4451634f573d21678e0e9ae7b629c4ec9803b8ab9ca5ebba235fd1d251afab53e4d798ef67fd5f088d3e78ba477ad0ae189c17ec6

                                      • C:\Users\Admin\AppData\Local\Temp\BcPyovVCSH.bat

                                        Filesize

                                        192B

                                        MD5

                                        9f3666116f911279410abb42664f30e5

                                        SHA1

                                        8c4fb19860a79cd1a0105331684bd0f081c02258

                                        SHA256

                                        34f2480c1dd1142ffca373fc8065511c9c7d8fc4ba329e28e5fd3b9e63ba04ed

                                        SHA512

                                        58eecd041f75a305cc8bb1420d8502b211bbcd09371c833c0f114eb57357227ed83e186a4223d9a1fdc3b121c1b55c9def9edab9102522f453d06ee5065125dc

                                      • C:\Users\Admin\AppData\Local\Temp\CabFF19.tmp

                                        Filesize

                                        70KB

                                        MD5

                                        49aebf8cbd62d92ac215b2923fb1b9f5

                                        SHA1

                                        1723be06719828dda65ad804298d0431f6aff976

                                        SHA256

                                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                        SHA512

                                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                      • C:\Users\Admin\AppData\Local\Temp\ISA3vp411k.bat

                                        Filesize

                                        192B

                                        MD5

                                        d7c08357c28e432c5e757507302a73a7

                                        SHA1

                                        b2ef99cc07bde7a4e9d24b3caec28ffd18c2c6b5

                                        SHA256

                                        7f782a55bd10fd8f350b98e63f1e6c2d46d402e101bba7de456e066b534d807b

                                        SHA512

                                        9f6040b2f37e378b8d3d7e8f34fefe621f117bc7d66a1a3bf8458c7c48cb5de1c5586568440aa749f6393e1ba876b548b92c63bf6071f86f76d86b504d04f2d0

                                      • C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat

                                        Filesize

                                        192B

                                        MD5

                                        91be683feb4fcec1e8af4c76892027d3

                                        SHA1

                                        da83197b1b591b843f87fe6f0aa0e88cc86286e6

                                        SHA256

                                        aa0d536df4ada0fae244921a47b52aa6dfcc31c11dbdda7b7c7aeebd51e5605d

                                        SHA512

                                        7c88ff672e19c4108fafd2835ba05f8d46c5fbcb8b7491710ec0fe72bf0ea71c8cf0c20e2008275a7db6e8d6e99b3836a80fd46e23836cf9a91a9b5962dc0447

                                      • C:\Users\Admin\AppData\Local\Temp\SRNviAgREO.bat

                                        Filesize

                                        192B

                                        MD5

                                        899a308ffa82df257f6e4d1d7bc526bb

                                        SHA1

                                        3bcacc12d280736652951aba1149fd25d36b0c7b

                                        SHA256

                                        1b9daea704d74c4d21aea5c48fe19a99ff7692875bbe41b99239a07d409b0f5c

                                        SHA512

                                        f6fa3410833dc6e620ed4cacf759df721e6819d62ef37b1000678dca5cdab01ddfed914818c0977e7c8d4b07b814321d9a41bd3e04ec01bf3b294e9cc030f83d

                                      • C:\Users\Admin\AppData\Local\Temp\TarFF2B.tmp

                                        Filesize

                                        181KB

                                        MD5

                                        4ea6026cf93ec6338144661bf1202cd1

                                        SHA1

                                        a1dec9044f750ad887935a01430bf49322fbdcb7

                                        SHA256

                                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                        SHA512

                                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                      • C:\Users\Admin\AppData\Local\Temp\Tcsv1v0qfT.bat

                                        Filesize

                                        192B

                                        MD5

                                        bcefd3701a13ed76832fa41b239ca268

                                        SHA1

                                        ec95802bcf67723bb6cd2c62cabaa8df2e2b1166

                                        SHA256

                                        fd0771c0cfcd619645b5e3800f57e457a8b1931ad0e9748b25de8afd2b9229fe

                                        SHA512

                                        e808f7d92a1b1a45cbcd5dd7ab6df07e6ac69a7f2aac16cd9554da7d1214f40197d6a6ee5d256ff04e6c8b7a930e2299cfefaf04ed0aff3c6fb23c138de68ce6

                                      • C:\Users\Admin\AppData\Local\Temp\X5pWA5YIY7.bat

                                        Filesize

                                        192B

                                        MD5

                                        43ebdb9f9e37c15f3df21a7339e096af

                                        SHA1

                                        1b355739398bdb5b6cdc0042a105775b9520352b

                                        SHA256

                                        2b93a1c9314c5f53b3b1d33fe48b113883540eee72a5ec24bf8a814a75c83628

                                        SHA512

                                        5a60261204d7ee9cedd7c121d88ee81ce932c6be4a0127cb83d076d276cf8b5673da31871cc14e3546cbe7b3d88a24680e1ef87d8a8c4684a764fc56a90b9b83

                                      • C:\Users\Admin\AppData\Local\Temp\gZmmY05In2.bat

                                        Filesize

                                        192B

                                        MD5

                                        41b5eb4ae73e5f22a30ab383977532ab

                                        SHA1

                                        f62431f0c17c782f14d43418472225d9bd670dc4

                                        SHA256

                                        60e88fb7a079ba8f4e71f44c7d4765814eb0850d6132d2f6692620084642f043

                                        SHA512

                                        81afde79e9c13a24ede6628b333453dd57863f430aec85d6a8fb88379cc20c43a9aa876d38af158237f6ae7f48b42370309b2533b96732a0e8100900485b8df2

                                      • C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat

                                        Filesize

                                        192B

                                        MD5

                                        7cf6c4019a2618511bfcbc78469bc52d

                                        SHA1

                                        f06a5e0843a1a3b58fb7097cfee1c691b0a96ec0

                                        SHA256

                                        03d784f06b4a2a352dc0d36671dac6cbb3c8434f587f2cd5c6c894e70c88d0f3

                                        SHA512

                                        6a9fe9012f0a6a3a83ab2a4ad027b1086d145c65dcbd4a5307cdb16a95ff222b0515f525e8cf1286997a13a68c40bccfb5c0c1b268cc2a3739e177a68c380fd2

                                      • C:\Users\Admin\AppData\Local\Temp\m1XclINWiF.bat

                                        Filesize

                                        192B

                                        MD5

                                        a504e26eb62e2d22c4f62cbb8e8162cc

                                        SHA1

                                        21eefe4c567ba3a218889c779f51272c3a595762

                                        SHA256

                                        515e06b3b8ade5ade349258d1808e7a0604862f4c59d8ae7b8ef23048b3535e3

                                        SHA512

                                        db69236197596a3b1ba661da61bdbf73802e7d7c91c8fa996ec6c5e71c1d5ae18bb337091e840114bec7fd6f3a2407d6b02a42d01cb05a85a66520beff06118e

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                        Filesize

                                        7KB

                                        MD5

                                        13d7aba1400584676d5a53af31f8bd0c

                                        SHA1

                                        a7bfcb5b32e00bc3f1d832e32d866f87c75092ac

                                        SHA256

                                        580afdefe57a8a015d498dc31ba1054cc2c67830fc6003c53444be60483e70c1

                                        SHA512

                                        75cba61fd3c1f575ae4541c08103ac97889c4736286a08b95b3aad77edf7c6b1d12d22726dd01f759f716b210979f284299ebd218987ac8afe1c4ed285c18c9f

                                      • C:\providercommon\1zu9dW.bat

                                        Filesize

                                        36B

                                        MD5

                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                        SHA1

                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                        SHA256

                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                        SHA512

                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                        Filesize

                                        197B

                                        MD5

                                        8088241160261560a02c84025d107592

                                        SHA1

                                        083121f7027557570994c9fc211df61730455bb5

                                        SHA256

                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                        SHA512

                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                      • \providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • memory/448-463-0x0000000001050000-0x0000000001160000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/908-103-0x0000000000010000-0x0000000000120000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/1180-284-0x0000000000B20000-0x0000000000C30000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/2344-164-0x00000000002C0000-0x00000000002D2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2344-163-0x0000000000DF0000-0x0000000000F00000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/2600-40-0x0000000002890000-0x0000000002898000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/2600-38-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

                                        Filesize

                                        2.9MB

                                      • memory/2664-16-0x00000000001D0000-0x00000000001DC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2664-17-0x0000000000260000-0x000000000026C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2664-15-0x0000000000380000-0x000000000038C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2664-14-0x00000000001C0000-0x00000000001D2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2664-13-0x0000000000270000-0x0000000000380000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/2668-582-0x00000000010D0000-0x00000000011E0000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/2732-224-0x00000000003F0000-0x0000000000500000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/2764-37-0x0000000000C30000-0x0000000000D40000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/3068-403-0x0000000000CD0000-0x0000000000DE0000-memory.dmp

                                        Filesize

                                        1.1MB