Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 10:02 UTC

General

  • Target

    JaffaCakes118_080f4cef3580490cb80d2994f7c760aac5a89119efb0ad74b452faf47d81ef92.exe

  • Size

    1.3MB

  • MD5

    3238125d5b0e217b96771a01ea0b549e

  • SHA1

    0d9c0ddce60ad1feb5faeda5b189a1763053f930

  • SHA256

    080f4cef3580490cb80d2994f7c760aac5a89119efb0ad74b452faf47d81ef92

  • SHA512

    88f2c39ad0eec7397e879731b6709de200d7d88a161de62c1ebf98f65f970e078454ebf23381919adc1d5e472d80c9c756b8f5159274ebefd549d2e7c063bbe5

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_080f4cef3580490cb80d2994f7c760aac5a89119efb0ad74b452faf47d81ef92.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_080f4cef3580490cb80d2994f7c760aac5a89119efb0ad74b452faf47d81ef92.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2536
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2376
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2276
          • C:\providercommon\lsm.exe
            "C:\providercommon\lsm.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2720
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SRNviAgREO.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1736
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:1744
                • C:\providercommon\lsm.exe
                  "C:\providercommon\lsm.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2308
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2456
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:2880
                      • C:\providercommon\lsm.exe
                        "C:\providercommon\lsm.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2924
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2832
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:2952
                            • C:\providercommon\lsm.exe
                              "C:\providercommon\lsm.exe"
                              11⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:1916
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat"
                                12⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1016
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  13⤵
                                    PID:1980
                                  • C:\providercommon\lsm.exe
                                    "C:\providercommon\lsm.exe"
                                    13⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:1984
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat"
                                      14⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2340
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        15⤵
                                          PID:2200
                                        • C:\providercommon\lsm.exe
                                          "C:\providercommon\lsm.exe"
                                          15⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1816
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UQ4uSu8U9J.bat"
                                            16⤵
                                              PID:2104
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                17⤵
                                                  PID:1712
                                                • C:\providercommon\lsm.exe
                                                  "C:\providercommon\lsm.exe"
                                                  17⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2908
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OyPKZ08zKl.bat"
                                                    18⤵
                                                      PID:1812
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        19⤵
                                                          PID:1952
                                                        • C:\providercommon\lsm.exe
                                                          "C:\providercommon\lsm.exe"
                                                          19⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:756
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat"
                                                            20⤵
                                                              PID:2408
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                21⤵
                                                                  PID:1364
                                                                • C:\providercommon\lsm.exe
                                                                  "C:\providercommon\lsm.exe"
                                                                  21⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1600
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat"
                                                                    22⤵
                                                                      PID:2744
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        23⤵
                                                                          PID:2608
                                                                        • C:\providercommon\lsm.exe
                                                                          "C:\providercommon\lsm.exe"
                                                                          23⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2788
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LZh5ueQJla.bat"
                                                                            24⤵
                                                                              PID:1476
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                25⤵
                                                                                  PID:2988
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\providercommon\lsm.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2644
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2756
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1904
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\audiodg.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2636
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Cursors\audiodg.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2696
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\audiodg.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2104

                                Network

                                • flag-us
                                  DNS
                                  raw.githubusercontent.com
                                  lsm.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  raw.githubusercontent.com
                                  IN A
                                  Response
                                  raw.githubusercontent.com
                                  IN A
                                  185.199.109.133
                                  raw.githubusercontent.com
                                  IN A
                                  185.199.111.133
                                  raw.githubusercontent.com
                                  IN A
                                  185.199.110.133
                                  raw.githubusercontent.com
                                  IN A
                                  185.199.108.133
                                • 185.199.109.133:443
                                  raw.githubusercontent.com
                                  tls
                                  lsm.exe
                                  787 B
                                  4.1kB
                                  10
                                  10
                                • 185.199.109.133:443
                                  raw.githubusercontent.com
                                  tls
                                  lsm.exe
                                  741 B
                                  4.1kB
                                  9
                                  10
                                • 185.199.109.133:443
                                  raw.githubusercontent.com
                                  tls
                                  lsm.exe
                                  741 B
                                  4.1kB
                                  9
                                  10
                                • 185.199.109.133:443
                                  raw.githubusercontent.com
                                  tls
                                  lsm.exe
                                  741 B
                                  4.1kB
                                  9
                                  10
                                • 185.199.109.133:443
                                  raw.githubusercontent.com
                                  tls
                                  lsm.exe
                                  747 B
                                  4.2kB
                                  9
                                  11
                                • 185.199.109.133:443
                                  raw.githubusercontent.com
                                  tls
                                  lsm.exe
                                  747 B
                                  4.2kB
                                  9
                                  11
                                • 185.199.109.133:443
                                  raw.githubusercontent.com
                                  tls
                                  lsm.exe
                                  741 B
                                  4.1kB
                                  9
                                  10
                                • 185.199.109.133:443
                                  raw.githubusercontent.com
                                  tls
                                  lsm.exe
                                  747 B
                                  4.2kB
                                  9
                                  11
                                • 185.199.109.133:443
                                  raw.githubusercontent.com
                                  tls
                                  lsm.exe
                                  741 B
                                  4.1kB
                                  9
                                  10
                                • 185.199.109.133:443
                                  raw.githubusercontent.com
                                  tls
                                  lsm.exe
                                  741 B
                                  4.1kB
                                  9
                                  10
                                • 8.8.8.8:53
                                  raw.githubusercontent.com
                                  dns
                                  lsm.exe
                                  71 B
                                  135 B
                                  1
                                  1

                                  DNS Request

                                  raw.githubusercontent.com

                                  DNS Response

                                  185.199.109.133
                                  185.199.111.133
                                  185.199.110.133
                                  185.199.108.133

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  342B

                                  MD5

                                  4ec8922db362f61198b2df826e30d6c1

                                  SHA1

                                  9b606268b5b7202d4d8b4754ef5b767224c25164

                                  SHA256

                                  5f814d8fba4d422f701118d23fa96a0b9547d8c1d53bacf8c895b28883e1d339

                                  SHA512

                                  9a605f01ef7f92415afa725d84b701fb1f4743c64d1f1d343c5dfde4e30ae00214647fec856ea69bb5d85bf75662938acda36ad6f9fa5be9f6b59408f59342e7

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  342B

                                  MD5

                                  4416674e519f350e4181b548bf0f9703

                                  SHA1

                                  8b38fe7cb32fd56900cff50ecef09648de47a98d

                                  SHA256

                                  47d500e83ef189d3b6bc2871e17d09f48d1ed38f648399ecbbe54a99047b697b

                                  SHA512

                                  b96245b3c1ce415c7b55f89e7edd00a408cb6df05016e6eb737ca530666ce902cc9f67ce2b1b4d70661a05557b547942cf2ac7957e3b9680c40ae7e1efd36774

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  342B

                                  MD5

                                  6fc35852c3c2446a728cc2b34b832ddc

                                  SHA1

                                  dca018f19bd73b0b84e0040c88ec265046c89055

                                  SHA256

                                  b106124a5b31dfbf0ac8b4559070f4c22c9d7621d02303537ccfcb1e02d9977b

                                  SHA512

                                  22baef0083727e4783b3dcfe7ed16cdecf401539b72a031297b3ebd98ad39e58dbe239a0ee5b9dd4885d33cd615442a3101375fa3c4baf01cc2b52c52d1df0a0

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  342B

                                  MD5

                                  ab258b3dbb3d8e77df153e2fc4cc291b

                                  SHA1

                                  c50b119d1f0b3015a07dbad8c183957676f9150f

                                  SHA256

                                  357fe92c017179eb74b6e6bd23f024b3282b67fe7a3390eb45618a7255fe9c3d

                                  SHA512

                                  28c26cb4dd95db37f1124c60a645b0beb3d482d0bc5da46db477bf1a20a4463430f8b0c39bfc98ab29243936268bbb2c0fdce4da0d2b60b3ffd599cbff497be1

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  342B

                                  MD5

                                  191ba7327ac5e7fcfd59195aae62fb1d

                                  SHA1

                                  b6486a91ab07080bcbba9ddab5e4aa46188a6484

                                  SHA256

                                  7781e58f1e86855caa25adda02cfe737f18ef2b3b3fb1ce452289a720098085a

                                  SHA512

                                  1307c4b4ed4af2aad6d8b8d07ab47657fd964433bf6865c8fc16fe0548ba844710e61793e3b88bc64801e12385503b6c34461713676da8d71bba5679b610ae91

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  342B

                                  MD5

                                  4c8f2ce8af45b969528eac2d0dbe2920

                                  SHA1

                                  ada09017bf10fdebcd5cfe447cb0dba684ed9745

                                  SHA256

                                  ed46fb8ba21aa73b8507b9ea2831bb7c4e6cbade432eef88d60e5160df75e3bc

                                  SHA512

                                  749242e19db844870bd9665333590411dcf0910846378e9c3f244beac9894cf50f9510111364453f025b5cb221edd1806939e2e1dde7a9444ed9041e3083fed3

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  342B

                                  MD5

                                  3ec28c1880530f72a4781b2fec6cf9ca

                                  SHA1

                                  4437b7a5b9b5a155cfd252bf9398bbbe69e3c1c1

                                  SHA256

                                  3c4bf7522c970becdff9c4a720cc2db835a81b530100026e15f86678a09d43a1

                                  SHA512

                                  016c89af1dd1882650626903500402aebd3c6e823a065c2da6a75b2bcfbceb16b8752fb373a79d0ddac0043d14bc9144c2b7bc57e4a95e446eb69e5e2902fc12

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  342B

                                  MD5

                                  13e52af29eb0984b54ec80ffb2a1a775

                                  SHA1

                                  56d54da37309fa1ed7e33c5500009c7e7bbccd6a

                                  SHA256

                                  a945ed0e45ee19812e1a025d5c0585dcfb05fda9ee6e8f3927f734f981408f4c

                                  SHA512

                                  fb41ed8e3223bfe78227e0ffae13d07687294b28a717230bdceee54ab5e37b52e634bb0adb6d7e90e3ce93b88ee5b1e45d663c25020567f78270ab914f3de6be

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  342B

                                  MD5

                                  61d15a6577047afaa91efcf2175f8566

                                  SHA1

                                  29dfde01b5729bcdb6ace8ba2c9b59525fddb7b5

                                  SHA256

                                  860e403e7121e6427e31b02fbbfd132ba1d368bc21a52cd47856c0b8aac79f02

                                  SHA512

                                  e579e0d6aa0c955eb03b90728bd33ed85c8085cb7fa59f8c490a3ff284d63163e2d6fa8b3ceaf899c0292ad321dcf2eefa1f228d834732e041c8e46429c19b63

                                • C:\Users\Admin\AppData\Local\Temp\Cab33BF.tmp

                                  Filesize

                                  70KB

                                  MD5

                                  49aebf8cbd62d92ac215b2923fb1b9f5

                                  SHA1

                                  1723be06719828dda65ad804298d0431f6aff976

                                  SHA256

                                  b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                  SHA512

                                  bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                • C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat

                                  Filesize

                                  190B

                                  MD5

                                  3154c4d9b94c2a05e6ee8adcbef45d88

                                  SHA1

                                  2f4e1e036118904c9937642ed77fd5f93fee6ca0

                                  SHA256

                                  156cd463f8fafc9ebc1e0cf30fc80b9c6b68429c5cfbabd5a1b2c3405dd6d242

                                  SHA512

                                  8137d75107504699bae4a123b06e7f6057f1867851aa435b9f3e766dc911f99e56c991a8dd3582284fab018d98de678b105b89d7faaa45e9679f750d9f115d1d

                                • C:\Users\Admin\AppData\Local\Temp\LZh5ueQJla.bat

                                  Filesize

                                  190B

                                  MD5

                                  ab86bd4e35235fc9a5c3d74ab8ccc963

                                  SHA1

                                  9ac98546681ee2b0f2b58a56d2b77bdc09a87166

                                  SHA256

                                  0786443d8f0f81a1ea55baf9178b5da09dcdfe0dbc15d46ca52ea6776ec11f4d

                                  SHA512

                                  ce509a1d6ed8528ae3204d5b8e8d4824da5f7758f96e6b67fc75736aba9a0e22ddb2abb7361eab2ddd2def0cdc27c8bd7a79d51c9dc23d59918c45dcd364add4

                                • C:\Users\Admin\AppData\Local\Temp\OyPKZ08zKl.bat

                                  Filesize

                                  190B

                                  MD5

                                  538485267288151f373375175025500d

                                  SHA1

                                  cd4e258b59b27dffd241a248683e6dffc959c7bf

                                  SHA256

                                  a4bc3e0335408bc651d66e4a6f9e0216dcde2a2fdba71df8590b536ca8b63c94

                                  SHA512

                                  77d9c4d7ea39f87a3e442f7828f2ba8ae04f726c6b191f860892c49b6cfef75aa579b91c490c3118a65226e2339bda011f2a675d46175b6d0349a1e75c307edc

                                • C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat

                                  Filesize

                                  190B

                                  MD5

                                  45347d2bbc6ed10c007eda0d1f08b4ca

                                  SHA1

                                  568ee56c27917477bd4ec96a488eaf62e7e5d1ca

                                  SHA256

                                  9cb1e92a3f06e52355cd7da5567f2bc34758d9a625bf4c40db7536b8c65234b0

                                  SHA512

                                  29be70645a18147ed3701eb4033be711dccb6cbf7303d8ddd0d0cca0317c356e3ddf84625f1c2418e81d9d99c4aa036b2a99ae84047a607cb67016546ee7d4b1

                                • C:\Users\Admin\AppData\Local\Temp\SRNviAgREO.bat

                                  Filesize

                                  190B

                                  MD5

                                  dd34fcadf1dd1b55a42b365b1342150c

                                  SHA1

                                  85b7835b795960982830ddd5535265b06715b0f5

                                  SHA256

                                  adb1e6c779bc0719ffd77117f2d7447262e320f5c57c50890e21235f6b168dcd

                                  SHA512

                                  8bb316eb6a62f3904f86ae7142c1076d60ae1b2b09abd4ff0337b2ff9d433d28af153cd37f3f9039561b8ef72d039f3fbf374fd935704a25e2274149650db866

                                • C:\Users\Admin\AppData\Local\Temp\Tar3420.tmp

                                  Filesize

                                  181KB

                                  MD5

                                  4ea6026cf93ec6338144661bf1202cd1

                                  SHA1

                                  a1dec9044f750ad887935a01430bf49322fbdcb7

                                  SHA256

                                  8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                  SHA512

                                  6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                • C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat

                                  Filesize

                                  190B

                                  MD5

                                  c676bce82783731abc3a6612f11a7bf0

                                  SHA1

                                  b99d3239a01940a1c6daf59ea3a590b617e32fc8

                                  SHA256

                                  c9ea61f9f9281326fb7852aa07260c0c8f506187d26e33d0d41e55330075443f

                                  SHA512

                                  4ea99c51157ca4bc5496c38f467c50a585f5e2db51bfa797e9ff168db1203904900db1d3cd16425b2dccd11dd0cb71e45c2d9600ed95dbc12107f049a5b7d609

                                • C:\Users\Admin\AppData\Local\Temp\UQ4uSu8U9J.bat

                                  Filesize

                                  190B

                                  MD5

                                  ae8756e6c1496eae8811619bd9cf91f3

                                  SHA1

                                  0fe91f7906129d55372dd84e77865aecca4c445d

                                  SHA256

                                  72814cf2270e0beebcc9c76d7f3b2e6a61431b15576b83ed3d4177613c42feaa

                                  SHA512

                                  2e2d09b8b144d61918a957e89e9b6668044d358092ca5d49e88839ba789c5a35ad63c27417906cb2bb429cfaeffff4eb136880519e1d61e355b9c6f8f7c16f46

                                • C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat

                                  Filesize

                                  190B

                                  MD5

                                  9b2fced64a07a0f918d2e4c1dfc83252

                                  SHA1

                                  d721176f1073017c3ddd29a466ae5d8e4023c89d

                                  SHA256

                                  39f47f7358892c8039bb3cc1559bbaca425a1dc4ad8587158bf7b6639ad935ff

                                  SHA512

                                  084ac8d43b1453a29fd065cc402d35d28d843b93e575541ae55665d4b6b69cd6b02b1dcef4feda632d47fe54f5483742e835671bfefac7cca8a16e4040354cf3

                                • C:\Users\Admin\AppData\Local\Temp\wHaMzi6eYE.bat

                                  Filesize

                                  190B

                                  MD5

                                  8840490a54c9d64172c094a106d5b8f8

                                  SHA1

                                  9e2501aef5c09dbfbccbf8d346dc300546a197d1

                                  SHA256

                                  092067c432dcf42ee98ce1b6224b3fae773981a89d8479ad6eefaa440a44e32c

                                  SHA512

                                  f57217a30b8dc5a14bded2f3304b5146f7987fadec19853235a62be46c190a6aff9df93cf558cb8630b4e6391753af6460e832213ced7f8899a719018b7a5444

                                • C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat

                                  Filesize

                                  190B

                                  MD5

                                  1c3c63337a2aa7915bd30f248b4080bf

                                  SHA1

                                  828a34b44ba10797ca196d1271b3421e18842879

                                  SHA256

                                  082ba463d54be020295b1a4668a1fc8c114809552404b1e25e4f6ed6878a69e1

                                  SHA512

                                  f3f861a2a798b5c7c20d07f7b1acd8b384fbea2a8635162412d22bb6b98dea19fa6a9a6f56007e8269989d9f1bbfc68249ab2fd271101f1e99b3dfa3d2cc1e31

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                  Filesize

                                  7KB

                                  MD5

                                  778158e3210dc695832186d3a36188ea

                                  SHA1

                                  94f0020ae2c7e7f8472cdfb190e43fff0bf23567

                                  SHA256

                                  013d6cb6d111cb29461ca1502f3e4b61411402116939f512564ca787e621e6c6

                                  SHA512

                                  4904b0cb36ba08aee2b6e8e34f17bc244386e2ca5dcf128a260e751109757a1947de7778da581a90c08954d7992d4c8747b7e1b342045fb1124d315ed7578874

                                • C:\providercommon\1zu9dW.bat

                                  Filesize

                                  36B

                                  MD5

                                  6783c3ee07c7d151ceac57f1f9c8bed7

                                  SHA1

                                  17468f98f95bf504cc1f83c49e49a78526b3ea03

                                  SHA256

                                  8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                  SHA512

                                  c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                • C:\providercommon\DllCommonsvc.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                  Filesize

                                  197B

                                  MD5

                                  8088241160261560a02c84025d107592

                                  SHA1

                                  083121f7027557570994c9fc211df61730455bb5

                                  SHA256

                                  2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                  SHA512

                                  20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                • memory/756-459-0x0000000001320000-0x0000000001430000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2376-29-0x0000000002270000-0x0000000002278000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/2376-28-0x000000001B460000-0x000000001B742000-memory.dmp

                                  Filesize

                                  2.9MB

                                • memory/2720-45-0x0000000000350000-0x0000000000362000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2720-35-0x0000000001220000-0x0000000001330000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2724-13-0x0000000001040000-0x0000000001150000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2724-16-0x0000000000260000-0x000000000026C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2724-14-0x0000000000250000-0x0000000000262000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2724-15-0x0000000000280000-0x000000000028C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2724-17-0x0000000000270000-0x000000000027C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/2908-399-0x00000000001F0000-0x0000000000300000-memory.dmp

                                  Filesize

                                  1.1MB

                                We care about your privacy.

                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.