Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 10:54

General

  • Target

    JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe

  • Size

    1.3MB

  • MD5

    b1d7cd07cae2eb6aba7cf2f227c5003d

  • SHA1

    9172f04fb782a2a927a496bc3c83124ff289dad7

  • SHA256

    f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6

  • SHA512

    e20f021c663f601a9888ed1e9ff76b644c1014f059995fd45a4796aa1842887fd6f7c52bdaa1707470acd41ca7f7dfadd248ac7bd5b1eaaf10780b48cd90834c

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 54 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 9 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f5a0e43b452fe39f83a1c22b50d5103df55925a8ce563b5f5b19d3136f9825e6.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2816
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2968
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2552
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2572
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2876
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\SetupMetrics\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2752
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\templates\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1220
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\WIA\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2980
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2836
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WMIADAP.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2660
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Favorites\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2608
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2632
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\en-US\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\lsm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2740
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2792
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\GAC_MSIL\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2652
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\taskhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2944
          • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
            "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1660
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rmFq19iy8Y.bat"
              6⤵
                PID:2748
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  7⤵
                    PID:1724
                  • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                    "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                    7⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1736
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UucX7bnqC8.bat"
                      8⤵
                        PID:2252
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          9⤵
                            PID:2792
                          • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                            "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                            9⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1436
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ELd0wzhjGt.bat"
                              10⤵
                                PID:1072
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  11⤵
                                    PID:608
                                  • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                                    "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                                    11⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1584
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat"
                                      12⤵
                                        PID:2736
                                        • C:\Windows\system32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          13⤵
                                            PID:2364
                                          • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                                            "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                                            13⤵
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1276
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CV35gbisF1.bat"
                                              14⤵
                                                PID:1044
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  15⤵
                                                    PID:2600
                                                  • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                                                    "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                                                    15⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1656
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2qVagYZlTM.bat"
                                                      16⤵
                                                        PID:2500
                                                        • C:\Windows\system32\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          17⤵
                                                            PID:1220
                                                          • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                                                            "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                                                            17⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2704
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ap6i2Y3psm.bat"
                                                              18⤵
                                                                PID:1924
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  19⤵
                                                                    PID:1560
                                                                  • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                                                                    "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                                                                    19⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:848
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BDCDGXc9ch.bat"
                                                                      20⤵
                                                                        PID:2076
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          21⤵
                                                                            PID:1936
                                                                          • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                                                                            "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                                                                            21⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:316
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"
                                                                              22⤵
                                                                                PID:2980
                                                                                • C:\Windows\system32\w32tm.exe
                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                  23⤵
                                                                                    PID:1756
                                                                                  • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                                                                                    "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                                                                                    23⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:1620
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\esvfELjyVS.bat"
                                                                                      24⤵
                                                                                        PID:576
                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          25⤵
                                                                                            PID:2848
                                                                                          • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                                                                                            "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                                                                                            25⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2316
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YQG5KQjShu.bat"
                                                                                              26⤵
                                                                                                PID:1892
                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                  27⤵
                                                                                                    PID:1544
                                                                                                  • C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe
                                                                                                    "C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe"
                                                                                                    27⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1172
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\audiodg.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2708
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\All Users\audiodg.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2792
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\audiodg.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2612
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\DllCommonsvc.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2680
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\DllCommonsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1416
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\DllCommonsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3056
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Windows\Offline Web Pages\audiodg.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1332
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\audiodg.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:848
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\audiodg.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1304
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2132
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1224
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1800
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dwm.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:900
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2796
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1564
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Windows\security\templates\WmiPrvSE.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2956
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\security\templates\WmiPrvSE.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1212
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Windows\security\templates\WmiPrvSE.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:820
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\debug\WIA\sppsvc.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1448
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\debug\WIA\sppsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2124
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\debug\WIA\sppsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2480
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1804
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1412
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\Minesweeper\ja-JP\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2172
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2464
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1856
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1952
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WMIADAP.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1032
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WMIADAP.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2276
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\WMIADAP.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:840
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Favorites\dwm.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1744
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1308
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Favorites\dwm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:704
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1768
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2376
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1904
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\audiodg.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1780
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\en-US\audiodg.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1764
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\audiodg.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2568
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\lsm.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:568
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\lsm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1072
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\lsm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1196
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1652
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1624
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2412
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\GAC_MSIL\explorer.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:688
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_MSIL\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1736
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\assembly\GAC_MSIL\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1932
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:528
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1728
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1560
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\taskhost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2524
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\taskhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2104
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\taskhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1620

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                b42aad109ec4b722ec3e12a17fe9fb37

                                                SHA1

                                                76ae60ff842f8b105066c98208a829f38ed2bb5d

                                                SHA256

                                                c877c7ac75df0dd3bb24eb76e2925c26a13c26f0c65bf7fbd3f10a30b24f25c4

                                                SHA512

                                                eb56b44e0018c1335568c257d39add29ae27e65c3855419f7220d8f65851b8cc333a29f11c66cde40153ea22ec546a03391bf1d8b90d32818e20c4c9356364d1

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                eb10fc6398c617d16e474a5885520fa2

                                                SHA1

                                                24a87b174de54d4a4b41c75519ff72cb5b90a33d

                                                SHA256

                                                38931079540f288606bebf188da63cfc10402bbcef86d84599e3d2caabd9fe31

                                                SHA512

                                                8bff1bd0dd50c54a7cc09c665ace136e9f9226b916c4fc0b1a7c12afbc6829fa8aa145f1a46109be9e352366d7a2e25a92004ba6d5e572e7b1d01f78778091c0

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                1bc417b6c88160a8f65d069a5a07cef9

                                                SHA1

                                                ea1090d0dd66285faf826c1b05f94280f1dd7bc3

                                                SHA256

                                                6240f007e2d979f7eb83cfb6cc43f19086556c54c04782416c3ecec6fbe61ed9

                                                SHA512

                                                4d9333888e423eee48ea8b4d606636bac2fad3658b050d0d672c10195d43ec96cb9ed2ec95668be95e214d903dc8f825f82c1d6ea1196d08c3b22d1d43380b62

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                bc11043f8a2981364659c157a0e4ff62

                                                SHA1

                                                832e8f06056a553fd4b59a606f7552a52979a825

                                                SHA256

                                                b810c7eda379965d038b40a31bac27da31c5b072a5256c5c6b69431e14d55fac

                                                SHA512

                                                c84d799b550434929b1fc54481260087ffb9316feb99468c4402f6ba90e87d92e3a0d99888da927e76205544c56e80e0504cf8b4f0ced4c8e17faff727f9bad7

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                96fc69629b96e20c11ef77f87c8479d7

                                                SHA1

                                                1897e61ec5bde5438cc30f4f71915c7f7b56302c

                                                SHA256

                                                95afff131047320d56c6b23671d0fb504f9afeba8604fb8e9e8ebb693ece7a98

                                                SHA512

                                                d1ecff8624a2fa99cdaceeb3995456636694de83511fe1503fe97ace16679a8dfd9526f8424cf9f3b9ae7fde135de322af408b9404d92d8523267bde0fe15fbc

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                99b290f7463eca34dcd80aaabb399bb5

                                                SHA1

                                                1829fe78c8aefbb29edd61eac1c22ef027105ca6

                                                SHA256

                                                2996f329a1e9720bbc3a39f2aa2c61f5295db64b294c33b8333f573b48297151

                                                SHA512

                                                44d87161b94b27729a9720a9f06249aeaaf2d6d7928de48018b9e4ccc27c5bd60ba44b3d72c9eeb09689c8d25e611733a04645df3b2d961cc8abc4147c75304c

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                cc5831c37c0dfa6590c18167d81b52e3

                                                SHA1

                                                83a524d43860b9d9c396edf783f097150a7cfa53

                                                SHA256

                                                428e6ebb809e5b2b47e75ddda907edf4243580c516b3b384a9d0122298d2f0d7

                                                SHA512

                                                e5a3acb6883f19486c3ac541ea614272652f167e110e55f65db599d07c850bd38ae70ff9e792146b1aa53b009b19f86def42f61a95e69b7411a1704d3a03ea75

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                8b072d341fec5f7b5105c6721c8a0a8b

                                                SHA1

                                                39673e356ecb8d3a9c541d5c8337e6f14875b37c

                                                SHA256

                                                52f1f06f57da2a7743cc48b56b5388b8d41dc54327aac530deb36488033531ac

                                                SHA512

                                                b6e3aaf6ebb37717c03152680819436a4f39e15bbbb36cb5b6aeca0a3ffbe6f20f778d9dda2ac1ad64c2ca3706d65a64ec14c5ed0d98220a3ffa0a7d58bca790

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                26c3c4ae005f8f3a98cbe37c7cfb7e97

                                                SHA1

                                                c80ff204189a483bb4adbc299e69941a9bb638df

                                                SHA256

                                                ddaea031caa2966caae2dd5979942c0157a03159af712459de9942d42c23f3ab

                                                SHA512

                                                35ef6abad192e3823c90c8731d74bf28680626aca78d17b3b7a54f1075e8f6bcc849913fbbe54ddd9192ff5901a0e5f95af48d96a30d8f89142ececa0e3a98f2

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                342B

                                                MD5

                                                5f075d713684a8ad1c7a3f7e3db8e2ea

                                                SHA1

                                                68d6359dcf6ff038743f20a05832224b387ba285

                                                SHA256

                                                6b57afa58c7f5548c26c09950c497e120fd2db83e994c58d0b00c54328893f59

                                                SHA512

                                                a2efc4244627c8e7b92af27a877a031dd8ecfe1c6d8e27eefff7f204f83db27bbd1f38a55f9abf280e102183c5a214bf83caf4de13170543c1b725fb73a4b65d

                                              • C:\Users\Admin\AppData\Local\Temp\2qVagYZlTM.bat

                                                Filesize

                                                223B

                                                MD5

                                                a17a9baba82d14bf38befb1fbdf8782d

                                                SHA1

                                                c34f8eaf9408cef43035cd838ea0c16f0aac0bdc

                                                SHA256

                                                4434c3ba0e1e1895b56dcbb5a7a60bf3007104e3be9e5606d54d68eebb70a37f

                                                SHA512

                                                eb18ec6a72199db7d165caaa5860def950f0ad83bb6686f39a3e86e16bd6cde73d477c8bbc74d9a1d2f4a95a0b187d57825c41d40d5636953f04ccd731374c81

                                              • C:\Users\Admin\AppData\Local\Temp\Ap6i2Y3psm.bat

                                                Filesize

                                                223B

                                                MD5

                                                efff2e1c997ce1eb53ad0feada584ebe

                                                SHA1

                                                e9fd7a9864e0b5b06180958a883e4690f73a3b22

                                                SHA256

                                                a509437963fd6cd7ca549bafbc7d9b37759001b189a2ab91326ca7340d227803

                                                SHA512

                                                fa97cd539885a84925af04bcd1e45fa121779ee4b9b68d2f3a8d81265701fa85f8f0195469b46c0df69cf8e3d224fdf6aab2895d17f5d4be7075c5b69633583b

                                              • C:\Users\Admin\AppData\Local\Temp\BDCDGXc9ch.bat

                                                Filesize

                                                223B

                                                MD5

                                                c3cce53c33e3a33505111d3b78e42cbf

                                                SHA1

                                                ffb2c2dcc8d1d7dd95fbeb2c1fd560250dbe3820

                                                SHA256

                                                0cef18d4c3b197febd8fa2a7b4ffcc7f1dae8e94e9ae09e3c167ec942c922225

                                                SHA512

                                                2c7deec899428e7c5ae71a8e9dbe80849ade4e8aec132a3f989400bc797bf6f37b133663f37b7b089b555d196eeea1f7952a71fa8374edd12fcfbc958712a5d5

                                              • C:\Users\Admin\AppData\Local\Temp\CV35gbisF1.bat

                                                Filesize

                                                223B

                                                MD5

                                                1192c75df1db084cfdbf91c47a49cecd

                                                SHA1

                                                b9b8105db7d89f3d0ca586a757e383b776d0af73

                                                SHA256

                                                8c79d344579d12ef07d7f033bb4e9cb02cfe456a5a5d4ceae181a0d570aa1a47

                                                SHA512

                                                9dcc9e16546afc120c0185e0cab1c8f8c33b654cc1bd253f2eee960fe375fdecdc5b0011b352ae0af74d2f4b9ff48af0fb795bdd2fce035ff21735d041692705

                                              • C:\Users\Admin\AppData\Local\Temp\CabF6FE.tmp

                                                Filesize

                                                70KB

                                                MD5

                                                49aebf8cbd62d92ac215b2923fb1b9f5

                                                SHA1

                                                1723be06719828dda65ad804298d0431f6aff976

                                                SHA256

                                                b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                SHA512

                                                bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                              • C:\Users\Admin\AppData\Local\Temp\ELd0wzhjGt.bat

                                                Filesize

                                                223B

                                                MD5

                                                190c0d18d68e4be5655dc1e5cdacf2c4

                                                SHA1

                                                1b2a42e3413435d211e470d824d644325974ad90

                                                SHA256

                                                99f13ad9b432fe5d5a58c749f7dccd450ebf5e44adbd2af2b45b14a37bf440a1

                                                SHA512

                                                a211d9f827768a2ba55330b675d61f55a9d2e899e3e2d639c4cdde6e2179707a70f7c891de1785af28fc2ce48f22bbba537541b72ddf9370db9d55dd33cf9f88

                                              • C:\Users\Admin\AppData\Local\Temp\TarF720.tmp

                                                Filesize

                                                181KB

                                                MD5

                                                4ea6026cf93ec6338144661bf1202cd1

                                                SHA1

                                                a1dec9044f750ad887935a01430bf49322fbdcb7

                                                SHA256

                                                8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                SHA512

                                                6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                              • C:\Users\Admin\AppData\Local\Temp\UucX7bnqC8.bat

                                                Filesize

                                                223B

                                                MD5

                                                ed2387f4e8db61a8e5f67c42e6c994a6

                                                SHA1

                                                1c1cd49b97367480ded5222602d9109f68fb96fe

                                                SHA256

                                                2c4ad95a9fa7b1d78d5f39cc1ff69af178604824f4f0b318c7032ca1a980c2dc

                                                SHA512

                                                495d44c9081282ff8a234f4bf04e8dc70b39b6af93c652137c45b565def8ec155d1c3f07bb7953f14f2fa6d2071d3d84a4c5cbf86aabf11f384f39ece64a629e

                                              • C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat

                                                Filesize

                                                223B

                                                MD5

                                                8384c9cc6074ce18ae94f55726de5c96

                                                SHA1

                                                4e16ea004d9adb3ea25593d9c2ad6923f6b658d9

                                                SHA256

                                                7391985f220f6f5fb9603c4af377ba71d0f4affecae77d7563014316022d4d82

                                                SHA512

                                                c4e7742e594f6373af1e6391a50ff107dd2f9c394bd291d2062c8826e0f0043e4fc2158f68084be510ecddfcc38dc345b614d07bd9fae3ac990f13859865acd0

                                              • C:\Users\Admin\AppData\Local\Temp\YQG5KQjShu.bat

                                                Filesize

                                                223B

                                                MD5

                                                d3f9fbaf07ad1586dfc222e79067f490

                                                SHA1

                                                1b67c2361750af4b381109f61536afbcaeb12a82

                                                SHA256

                                                5ad5928ae7bf9a9fc6c11e717ed4542c9cb80b2def2760cfbd58a8e1eaef8988

                                                SHA512

                                                7fc1080c5af752b79c28150eaabec4aab64ff183040b9daae0f03a38eeb1aef06fe4513dc763675a4e497ddbe04fea510d01dbb24dfcd06046efc596f8db21b8

                                              • C:\Users\Admin\AppData\Local\Temp\esvfELjyVS.bat

                                                Filesize

                                                223B

                                                MD5

                                                69b7d52db3dd1549fece2a1598fefdbb

                                                SHA1

                                                117ee9596903bb36a8e31a7e9fb067ac72434aa7

                                                SHA256

                                                f2d92209f03809b4f3ca42d11d0df5d1d851967fa1fe58a10045e917864afa92

                                                SHA512

                                                1bce2a84a6d5c5e2921923cb4e69fadc7bc562d1b9224ced6becaa299e6c06b1b3b5f1d483ba27bf12cdcf4d2145c392a9c6a2dd2fa6caa8875915f8b6aba40b

                                              • C:\Users\Admin\AppData\Local\Temp\rmFq19iy8Y.bat

                                                Filesize

                                                223B

                                                MD5

                                                1923d61471fcfdcf76b72e9591a0bdbe

                                                SHA1

                                                2646c8cf8e95b1ef2ae77534a77132414c931c5b

                                                SHA256

                                                acf762c05575e99350d0d97ed17a360401a6756dae0255c462e87f52a2ecdd33

                                                SHA512

                                                7f4eb7f8e777b9e57d5896df4e152ffb329e961789121ad6740f7ab5bebe844114ebfb066ca898e3131734599e8211e9acd218aab98990891aa80cffbcedaf86

                                              • C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat

                                                Filesize

                                                223B

                                                MD5

                                                0eb454ce482c568e492927db1e5ebe5e

                                                SHA1

                                                325e192a248669038a601a8263095f3578ff245d

                                                SHA256

                                                14f73581b9eab2241f45e3f1d635034caa67677ff7e4e2b41a7fe29519733bbf

                                                SHA512

                                                c07e152a0b5ba4a4c18da5bdcee0b28762e69cfeeb25efc4cd69448f1e27fe996a3098d0cd361ad55a4f4ea2325ec2030be9ea78ccf01db24f242329b64f8c30

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                Filesize

                                                7KB

                                                MD5

                                                50b953cd33da52305a3315a7a7d11232

                                                SHA1

                                                45da0671779347d9434b2d225e450d120e021fa6

                                                SHA256

                                                266f9ba79a40e0d6d48412a72d8ec82d2f6f67306d93e146d5cb91d3f5333c85

                                                SHA512

                                                bf8a6f7d94e83e7f7be0274dc6fd97b543aef8e40cfe5cec70288b81f6165df382518b08a1e68f744e21b68e6812efb5bd5fab64031b003b2f23767838966204

                                              • C:\providercommon\1zu9dW.bat

                                                Filesize

                                                36B

                                                MD5

                                                6783c3ee07c7d151ceac57f1f9c8bed7

                                                SHA1

                                                17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                SHA256

                                                8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                SHA512

                                                c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                              • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                Filesize

                                                197B

                                                MD5

                                                8088241160261560a02c84025d107592

                                                SHA1

                                                083121f7027557570994c9fc211df61730455bb5

                                                SHA256

                                                2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                SHA512

                                                20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                              • \providercommon\DllCommonsvc.exe

                                                Filesize

                                                1.0MB

                                                MD5

                                                bd31e94b4143c4ce49c17d3af46bcad0

                                                SHA1

                                                f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                SHA256

                                                b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                SHA512

                                                f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                              • memory/848-575-0x0000000001090000-0x00000000011A0000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/1276-395-0x0000000000C20000-0x0000000000D30000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/1276-396-0x0000000000550000-0x0000000000562000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/1436-275-0x0000000000050000-0x0000000000160000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/1584-335-0x00000000000E0000-0x00000000001F0000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/1660-60-0x00000000010D0000-0x00000000011E0000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/1660-87-0x0000000000150000-0x0000000000162000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/1736-215-0x0000000001220000-0x0000000001330000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/2552-71-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

                                                Filesize

                                                2.9MB

                                              • memory/2552-72-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

                                                Filesize

                                                32KB

                                              • memory/2704-515-0x0000000000080000-0x0000000000190000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/2816-16-0x0000000000550000-0x000000000055C000-memory.dmp

                                                Filesize

                                                48KB

                                              • memory/2816-17-0x0000000000580000-0x000000000058C000-memory.dmp

                                                Filesize

                                                48KB

                                              • memory/2816-15-0x0000000000570000-0x000000000057C000-memory.dmp

                                                Filesize

                                                48KB

                                              • memory/2816-14-0x0000000000330000-0x0000000000342000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/2816-13-0x0000000000340000-0x0000000000450000-memory.dmp

                                                Filesize

                                                1.1MB