Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 20:35
Behavioral task
behavioral1
Sample
JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe
-
Size
1.3MB
-
MD5
1e3a7289f2d5e5bc19ef14741c17cee8
-
SHA1
c0b546f8cf03f2f519384e0925fa1ddd26a56ac6
-
SHA256
7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f
-
SHA512
abc9c6e5d651884c23db6b09fed1600d4d0da135e10e15d95f0a4e761fb4e1b72125a966e5dfa17317b43d63b88a1090ef1a6576d2765aff5b71fffda9db9ff8
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2792 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2720 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2548 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2616 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2996 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1656 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2068 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2816 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1992 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2092 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 588 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1340 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1920 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2612 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1624 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1016 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1120 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2648 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2184 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2148 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2376 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2944 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2164 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2292 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2864 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1524 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1308 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1576 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2036 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2320 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2196 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1372 2888 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1088 2888 schtasks.exe 35 -
resource yara_rule behavioral1/files/0x0007000000016c7c-9.dat dcrat behavioral1/memory/2928-13-0x0000000000B50000-0x0000000000C60000-memory.dmp dcrat behavioral1/memory/1676-114-0x0000000000B80000-0x0000000000C90000-memory.dmp dcrat behavioral1/memory/2924-174-0x0000000000240000-0x0000000000350000-memory.dmp dcrat behavioral1/memory/2148-234-0x0000000000180000-0x0000000000290000-memory.dmp dcrat behavioral1/memory/984-294-0x0000000000AD0000-0x0000000000BE0000-memory.dmp dcrat behavioral1/memory/1588-355-0x0000000000DE0000-0x0000000000EF0000-memory.dmp dcrat behavioral1/memory/2384-474-0x0000000000EF0000-0x0000000001000000-memory.dmp dcrat behavioral1/memory/2804-711-0x0000000001010000-0x0000000001120000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1712 powershell.exe 2852 powershell.exe 2448 powershell.exe 2088 powershell.exe 2632 powershell.exe 2884 powershell.exe 1792 powershell.exe 1964 powershell.exe 352 powershell.exe 2272 powershell.exe 2188 powershell.exe 1356 powershell.exe 1704 powershell.exe -
Executes dropped EXE 12 IoCs
pid Process 2928 DllCommonsvc.exe 1676 winlogon.exe 2924 winlogon.exe 2148 winlogon.exe 984 winlogon.exe 1588 winlogon.exe 2912 winlogon.exe 2384 winlogon.exe 1636 winlogon.exe 408 winlogon.exe 3004 winlogon.exe 2804 winlogon.exe -
Loads dropped DLL 2 IoCs
pid Process 2416 cmd.exe 2416 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 5 raw.githubusercontent.com 9 raw.githubusercontent.com 18 raw.githubusercontent.com 28 raw.githubusercontent.com 32 raw.githubusercontent.com 4 raw.githubusercontent.com 13 raw.githubusercontent.com 17 raw.githubusercontent.com 21 raw.githubusercontent.com 25 raw.githubusercontent.com 35 raw.githubusercontent.com 39 raw.githubusercontent.com 10 raw.githubusercontent.com -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\it-IT\6ccacd8608530f DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\ja-JP\conhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\ja-JP\088424020bedd6 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files\Internet Explorer\images\dllhost.exe DllCommonsvc.exe File created C:\Program Files\Internet Explorer\images\5940a34987c991 DllCommonsvc.exe File created C:\Program Files\Windows Sidebar\it-IT\Idle.exe DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\assembly\cc11b995f2a76d DllCommonsvc.exe File created C:\Windows\PLA\Templates\csrss.exe DllCommonsvc.exe File created C:\Windows\PLA\Templates\886983d96e3d3e DllCommonsvc.exe File created C:\Windows\assembly\winlogon.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2548 schtasks.exe 2816 schtasks.exe 2092 schtasks.exe 1340 schtasks.exe 1920 schtasks.exe 2792 schtasks.exe 1992 schtasks.exe 2648 schtasks.exe 1932 schtasks.exe 2720 schtasks.exe 2148 schtasks.exe 2292 schtasks.exe 2196 schtasks.exe 2612 schtasks.exe 1624 schtasks.exe 2944 schtasks.exe 2320 schtasks.exe 1088 schtasks.exe 1656 schtasks.exe 1308 schtasks.exe 1120 schtasks.exe 2184 schtasks.exe 1524 schtasks.exe 1576 schtasks.exe 2996 schtasks.exe 2428 schtasks.exe 2068 schtasks.exe 588 schtasks.exe 1016 schtasks.exe 2376 schtasks.exe 2164 schtasks.exe 2864 schtasks.exe 2616 schtasks.exe 2036 schtasks.exe 1372 schtasks.exe 2432 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2928 DllCommonsvc.exe 2852 powershell.exe 1704 powershell.exe 2088 powershell.exe 1964 powershell.exe 1712 powershell.exe 2272 powershell.exe 1792 powershell.exe 2884 powershell.exe 352 powershell.exe 2188 powershell.exe 1356 powershell.exe 2632 powershell.exe 2448 powershell.exe 1676 winlogon.exe 2924 winlogon.exe 2148 winlogon.exe 984 winlogon.exe 1588 winlogon.exe 2912 winlogon.exe 2384 winlogon.exe 1636 winlogon.exe 408 winlogon.exe 3004 winlogon.exe 2804 winlogon.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 2928 DllCommonsvc.exe Token: SeDebugPrivilege 2852 powershell.exe Token: SeDebugPrivilege 1704 powershell.exe Token: SeDebugPrivilege 2088 powershell.exe Token: SeDebugPrivilege 1964 powershell.exe Token: SeDebugPrivilege 1712 powershell.exe Token: SeDebugPrivilege 2272 powershell.exe Token: SeDebugPrivilege 1792 powershell.exe Token: SeDebugPrivilege 2884 powershell.exe Token: SeDebugPrivilege 352 powershell.exe Token: SeDebugPrivilege 2188 powershell.exe Token: SeDebugPrivilege 1356 powershell.exe Token: SeDebugPrivilege 2632 powershell.exe Token: SeDebugPrivilege 2448 powershell.exe Token: SeDebugPrivilege 1676 winlogon.exe Token: SeDebugPrivilege 2924 winlogon.exe Token: SeDebugPrivilege 2148 winlogon.exe Token: SeDebugPrivilege 984 winlogon.exe Token: SeDebugPrivilege 1588 winlogon.exe Token: SeDebugPrivilege 2912 winlogon.exe Token: SeDebugPrivilege 2384 winlogon.exe Token: SeDebugPrivilege 1636 winlogon.exe Token: SeDebugPrivilege 408 winlogon.exe Token: SeDebugPrivilege 3004 winlogon.exe Token: SeDebugPrivilege 2804 winlogon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2308 2360 JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe 31 PID 2360 wrote to memory of 2308 2360 JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe 31 PID 2360 wrote to memory of 2308 2360 JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe 31 PID 2360 wrote to memory of 2308 2360 JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe 31 PID 2308 wrote to memory of 2416 2308 WScript.exe 32 PID 2308 wrote to memory of 2416 2308 WScript.exe 32 PID 2308 wrote to memory of 2416 2308 WScript.exe 32 PID 2308 wrote to memory of 2416 2308 WScript.exe 32 PID 2416 wrote to memory of 2928 2416 cmd.exe 34 PID 2416 wrote to memory of 2928 2416 cmd.exe 34 PID 2416 wrote to memory of 2928 2416 cmd.exe 34 PID 2416 wrote to memory of 2928 2416 cmd.exe 34 PID 2928 wrote to memory of 2852 2928 DllCommonsvc.exe 72 PID 2928 wrote to memory of 2852 2928 DllCommonsvc.exe 72 PID 2928 wrote to memory of 2852 2928 DllCommonsvc.exe 72 PID 2928 wrote to memory of 1712 2928 DllCommonsvc.exe 73 PID 2928 wrote to memory of 1712 2928 DllCommonsvc.exe 73 PID 2928 wrote to memory of 1712 2928 DllCommonsvc.exe 73 PID 2928 wrote to memory of 2884 2928 DllCommonsvc.exe 74 PID 2928 wrote to memory of 2884 2928 DllCommonsvc.exe 74 PID 2928 wrote to memory of 2884 2928 DllCommonsvc.exe 74 PID 2928 wrote to memory of 1704 2928 DllCommonsvc.exe 75 PID 2928 wrote to memory of 1704 2928 DllCommonsvc.exe 75 PID 2928 wrote to memory of 1704 2928 DllCommonsvc.exe 75 PID 2928 wrote to memory of 1792 2928 DllCommonsvc.exe 76 PID 2928 wrote to memory of 1792 2928 DllCommonsvc.exe 76 PID 2928 wrote to memory of 1792 2928 DllCommonsvc.exe 76 PID 2928 wrote to memory of 1964 2928 DllCommonsvc.exe 77 PID 2928 wrote to memory of 1964 2928 DllCommonsvc.exe 77 PID 2928 wrote to memory of 1964 2928 DllCommonsvc.exe 77 PID 2928 wrote to memory of 352 2928 DllCommonsvc.exe 78 PID 2928 wrote to memory of 352 2928 DllCommonsvc.exe 78 PID 2928 wrote to memory of 352 2928 DllCommonsvc.exe 78 PID 2928 wrote to memory of 2448 2928 DllCommonsvc.exe 79 PID 2928 wrote to memory of 2448 2928 DllCommonsvc.exe 79 PID 2928 wrote to memory of 2448 2928 DllCommonsvc.exe 79 PID 2928 wrote to memory of 2272 2928 DllCommonsvc.exe 80 PID 2928 wrote to memory of 2272 2928 DllCommonsvc.exe 80 PID 2928 wrote to memory of 2272 2928 DllCommonsvc.exe 80 PID 2928 wrote to memory of 2088 2928 DllCommonsvc.exe 81 PID 2928 wrote to memory of 2088 2928 DllCommonsvc.exe 81 PID 2928 wrote to memory of 2088 2928 DllCommonsvc.exe 81 PID 2928 wrote to memory of 2188 2928 DllCommonsvc.exe 88 PID 2928 wrote to memory of 2188 2928 DllCommonsvc.exe 88 PID 2928 wrote to memory of 2188 2928 DllCommonsvc.exe 88 PID 2928 wrote to memory of 1356 2928 DllCommonsvc.exe 94 PID 2928 wrote to memory of 1356 2928 DllCommonsvc.exe 94 PID 2928 wrote to memory of 1356 2928 DllCommonsvc.exe 94 PID 2928 wrote to memory of 2632 2928 DllCommonsvc.exe 95 PID 2928 wrote to memory of 2632 2928 DllCommonsvc.exe 95 PID 2928 wrote to memory of 2632 2928 DllCommonsvc.exe 95 PID 2928 wrote to memory of 1676 2928 DllCommonsvc.exe 98 PID 2928 wrote to memory of 1676 2928 DllCommonsvc.exe 98 PID 2928 wrote to memory of 1676 2928 DllCommonsvc.exe 98 PID 1676 wrote to memory of 2388 1676 winlogon.exe 99 PID 1676 wrote to memory of 2388 1676 winlogon.exe 99 PID 1676 wrote to memory of 2388 1676 winlogon.exe 99 PID 2388 wrote to memory of 1836 2388 cmd.exe 101 PID 2388 wrote to memory of 1836 2388 cmd.exe 101 PID 2388 wrote to memory of 1836 2388 cmd.exe 101 PID 2388 wrote to memory of 2924 2388 cmd.exe 102 PID 2388 wrote to memory of 2924 2388 cmd.exe 102 PID 2388 wrote to memory of 2924 2388 cmd.exe 102 PID 2924 wrote to memory of 2248 2924 winlogon.exe 103 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e2e93f62eefe7c5b5240ae2eb17b24390ba1ee5ccb8aad541d7c27a1469b69f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\it-IT\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\ja-JP\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:352
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\images\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Templates\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iu0amT0ExO.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1836
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat"8⤵PID:2248
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2700
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2U51WDObLZ.bat"10⤵PID:2884
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:772
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat"12⤵PID:2680
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:1264
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tYG4XGbOex.bat"14⤵PID:2472
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:2764
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yMeEqlK1gO.bat"16⤵PID:1768
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:2696
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat"18⤵PID:1088
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:888
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5DPJyftqFq.bat"20⤵PID:2760
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:1656
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\svzewrKVsp.bat"22⤵PID:1680
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:668
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uOEGMIRuqZ.bat"24⤵PID:1440
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1092
-
-
C:\Users\Default\My Documents\winlogon.exe"C:\Users\Default\My Documents\winlogon.exe"25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\it-IT\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\it-IT\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\it-IT\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\My Documents\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\My Documents\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\My Documents\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1120
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\images\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\providercommon\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\PLA\Templates\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\PLA\Templates\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\assembly\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b59e37f0ed63048c6dd118dd56c7893
SHA1ce8683dcef3d19abb649d4d03d08466e2a3cf4a1
SHA25618113095208bbf1312174c605ea55d5464ee97f1df48baff2850db2bd5d7a12e
SHA5125277cad78a1788463c428b1e742fcbcbccb4976cd9b9d71fcf575d93f15ed11088e9aa3c7257d66c9fc78c37ba7589f390fa8ad33fb169bde3e68f5c82490a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6f6057684600895e8b8d82e04a5bef5
SHA17c4a08bf309b3b190bfbf28097a58ed38e85d4db
SHA256e7c024aee70ac7f0356dec7c3310e46eaee831dcefd6da9b1232dae980a0fd97
SHA512c65529743d121cb060c27ceb50834a0b2894eefad0c7c00c77eea99d885fa27475a93be536d4942e760c0e3869281cb02c8b22b95c6927c0cdd7ed6ee5a3e677
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53acaa38a8e4db7510649158dd890a78e
SHA15f1581066d48654982d875359e3180e1ddbb7d58
SHA2566b296a21c35c6935f93c180538678d5232ad95cf0826e6fc4b77503453b16545
SHA512e4e702e9f78d9eb22ef9ea547cdbb27b2f2aea71264c6dd06a54400177e8e62460a658cd8194a902a83d64f37ff0eeea9fb0e03240f185ceaf00af5810c1292e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bb17c0b0589c6c2f639c5f458aa1cef
SHA1e1ab93ac72661c3fea266ee7ec0781430cae6bb9
SHA256200bd2f997d8498e4fe02502223bc29d27709c7b1a86bf59af05df7aba5a977f
SHA512fe93ddbedb408130cfee34a4794fc0d4df26d6c2c081540098386ba7445fe78f2a4e6524302b3b6b8d044c51e1a70e3d3304600b08ebb7384952529257c6a628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d3ab54d97eb1a87e70d9ad7005c59ce
SHA1de4a6251c261a23b3aa3436b2529071742a7acda
SHA2560ee99a092ca87f6dc37b64be49c87db6f1c39cf7525d7d812a63127b6fd53b20
SHA512c04800286262f6ff5389e483141b4c7bc58fc52989284aa4d27ff5de223e665dba35d1d38700518d8eed2d461e061512c9e809955eb086ddce5f8b3a685b17f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516431ea79154483c649d0067ec9e382a
SHA16014d0fe5dc7d909c6f25dfa0a38133a082c5df2
SHA256c50aa8dec007239be5aad8f049cdc9728d410e091101bf85ff86fe8342218593
SHA512c0246ccfb4d28bf7dea00843c8971e3f9d724e4fc60830273bcecaa65056788d0395b9c9ebf3c7cb1e06fbd0941e14024d1056206d3a05617d7e40e8fed7fd27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9f166f78f32da645fbdfb29316240e4
SHA1b0b29dbcaee5f2d58603d3840da2feeadf57b4bf
SHA256c545542463b1172cc45265309e68b9fa1b2d165f9fa3e78d3167f4658b23a503
SHA5121b38a43152762bc294b3052eecab983ddeb33553cd4609566ba32dadf7ab4ba9865830bf928b9bfad2e5b53df681755e66e0e9f2f316b9c3e180d287db83252f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d69d7eeed2df6faeec231c753ecee22
SHA164ac2caac1fdad745f690cc8b0a312b86c9b145c
SHA2566f484ff17a51704ef8f648b2ec383a87e59b6d08ccfb0b373628b90d8f097506
SHA5121b2501ae8b9a59be2bb68449515312c0a3a795744c9bb2568d22359bc72207646e693a0d54ae62e8619090c05fd756364b1ce8c6f6999b96810f6e0eefe1135d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ad3792b2054433745ad7408dd2599d4
SHA113f6547f50d02814c12186f412a11246f995d942
SHA25671b392acf38a2ce0873b32d0e85a9ed63c4b6381f08f21b0b62137638a35ffaa
SHA512587f5358a90143b4a866a6b54d8e80ae9ec600bc7675e06231e6634b5b47407b2dd954e39a4d14690ea0d0b8c6f6cc410b31b6d6a085785318fa84708086f32c
-
Filesize
207B
MD50c0fb8931e81ff381ff5e57eefa40489
SHA15a4447103cfb069b03c208f9e1d397b17726744d
SHA25698f8bc20fe0d77e46ff132fba810d0334781d484ab432567e843673b1c1f7105
SHA5124d2991b24ed8661f6f93f0670a0dde253a9c4337cdcba2501673755f766c9a0702f93e6c579ea4daa004047a1aca2eaee22c70dcc1d91e3885e9a76d597aeac2
-
Filesize
207B
MD5f5db194213df67981bc3bb165041b71b
SHA1a42ea65765687d41b38c76776f50a56cf827ea7d
SHA2562d438e30c9deaeecbe093ba88ef0ae471419ceee4bdc98f1012375db6d4b5df2
SHA51247b34b1cb01e2cdec61dc6d1d13956e3f85519a75e7a442177e768006500a0608bbce22d074e3e18a062fa832a4d15f4d32192eb9e817b52c6a19d4d27532716
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
207B
MD5a9ecf1f53458e165e148858566d85401
SHA1eae7c08328bdc815dc9f63a0f91ea8dcb5fa209c
SHA2567567d2709d9799f399b0faf110bdc3620110e7206174b24d11417d652964f9d6
SHA51268e41bcb1835477df4d2c708b24c1ab3e4e4632aeab8e3cfefd559b2a6be47208a3861f65e2a64c770c01cb7e34a2968807fc5d02d324ddd283c67766b7166f8
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
207B
MD59a58a601460b870b32d23d6e0de54c32
SHA1a0b1380ba0a5b0f9c1ede69d12aec775667dbf79
SHA2569cc36ebb043cc867cf6ac3dee5f8db751fb7108f1764e130c5fda25732ffdea4
SHA5120ed0d3250d12b87f4dec50149adfd7fc41207c22d0c3cac7eae44dbf708f04d5638868f04fc94d57c7d2ab4c3f1a50953836e7e34a3afe9407ca14f66567daf1
-
Filesize
207B
MD55947b7d7214629c8d5812adb9d035edf
SHA1fd407bda1533acf02e25d072f7fe34f186aef6d0
SHA2568ff74483c5bae4d4f55c5774e3c3c2a4d6231e2e782b54db0e801375c5178bc0
SHA5128a04bba8a00828fe025b83257b196fbd88af9d7877ff837eced47300919eee9cb90d601d6af1a14885cc372bb23c4045980a9f9188cdfa5db9512dfd76c2ee4b
-
Filesize
207B
MD544313bd024773c5a9ce6385ab05a6ac7
SHA1dfdea22a5c20d5ebf4b15c0562585ae92ced60a2
SHA256cd0135103cf8c142591ab5fa34ed7281e106aed75083e05285626ed951111ee8
SHA512ae368d0264dd157ac7a8c267e8e29e266c1a92a53b55e58f1f0697575b55c9a83a04216a6d18abd3867331611edcc1e49e49c685850c7ad198a7d767d25f09d1
-
Filesize
207B
MD57cbcf87fdee2290d86dcc6096295c997
SHA1e214f716ec079c832be83361d692e9b007426d7f
SHA256f22a8b277236d83507aaaaadb0404cce41b4ec15f7c094f13e5a312bb9934761
SHA512c41d1d1d9a666328ea585d3d1924fe10336e72d8d34f701fe347bccb850a863a8adfa0f635101e2d47f970b517d1977fb692016eaf312479bfbc0eff41c7b223
-
Filesize
207B
MD58c28beb8b4ce007fd9d54486b10a818f
SHA107b17d2c20b86f866af76335f826103a9de74efc
SHA25648ba383436f2af36f8f83db4c55888f990913b63e90bf86da381308fe82a458b
SHA512cc32614e8b0d06de534b8b6ffe6b77a667c6b94a4b283b3cf716269c533cf6e95e723df9b8298a8e73be35aab4c300e55f650ee45105ff5520fc38431905a19f
-
Filesize
207B
MD5d97e542d1ddf4ac06cfdcc84826ac14e
SHA160999681214ce26069d83c6c4754901b75f32ea4
SHA25693b7e471af68e9ce49788c67b80a1a7169d7f5e4078caade56f378e43c84348b
SHA51296a9fd7182aee354d0fdbfb8a5d7ab01c4bd3c06f7e2ab833ab73caa3d9f6749806ac143bd39db6d56438890a1681db7503426e3b57dccc9bc82cd23ac08be62
-
Filesize
207B
MD5afd15bcb66476fb665c541ea8f3fc5e9
SHA1fe56d739db9ce74d48a14c4c60205fca86381a03
SHA256e8d98f47297150d7874a4f5c3e996368caacf9851879c80212e5591a08eb98ad
SHA512d81795959fcaa4a3f68d236e640db220ddee136231533543fc4df158f08446fb51c6a2f2e6029e1652937a60d7723ddd5c5ff7a29fe88fcdf435a520a825b0c7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD542ff730d1f44b82fa52908df171c506f
SHA192241cb0ea7fb47a0d1de0b5eab1402a4fee22c3
SHA2561106507172b5d1ecbbb6c09d67a304f00414cae10b80d7694f6092e72971db76
SHA5122016cbd5310817900d9bb6b02b87cfba273ad75d32b1e584f3204a4bb8d0011965756f170932673c6b9efd7dac20a7b335f0dd1449b191364a2aad309aa7e18e
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394