Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 02:01

General

  • Target

    JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe

  • Size

    1.3MB

  • MD5

    83b2f842bf049010a6f5efcd7cc633b4

  • SHA1

    57daa8df96556dde2bb2a64d38815fb572c2c3bc

  • SHA256

    9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254

  • SHA512

    8838de90aac93883bc0c67b5a11128609c1a3207b56fe0b1e5b9a1fcc800284b0b71d42d837e1c532846f2cab81b13196a2e313d74eb28bb2b683819782ca0fd

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 57 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 12 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b0a5f42d1ac58b0a6513d3d41b638c5757268a0bf012c0344c16fad9e124254.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2428
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2776
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2536
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1968
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2508
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2572
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2940
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2936
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\audiodg.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2304
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1140
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:832
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\ja-JP\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1464
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:316
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1652
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2540
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2456
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2292
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1232
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1572
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2552
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Sample Pictures\lsm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1736
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\u4i0upNjR2.bat"
            5⤵
              PID:2236
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                6⤵
                  PID:2924
                • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                  "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1728
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Zqs8041Oe.bat"
                    7⤵
                      PID:2584
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        8⤵
                          PID:1956
                        • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                          "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                          8⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:448
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tlraSVrJxn.bat"
                            9⤵
                              PID:2576
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                10⤵
                                  PID:1880
                                • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                                  "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                                  10⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2980
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fg7ffKrc0I.bat"
                                    11⤵
                                      PID:892
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        12⤵
                                          PID:2064
                                        • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                                          "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                                          12⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1196
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat"
                                            13⤵
                                              PID:2172
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                14⤵
                                                  PID:1460
                                                • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                                                  "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                                                  14⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1964
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4Tm0GxqeGU.bat"
                                                    15⤵
                                                      PID:584
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        16⤵
                                                          PID:2564
                                                        • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                                                          "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                                                          16⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2672
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat"
                                                            17⤵
                                                              PID:2164
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                18⤵
                                                                  PID:2440
                                                                • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                                                                  "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                                                                  18⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2748
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\d5cQTyHbvx.bat"
                                                                    19⤵
                                                                      PID:2508
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        20⤵
                                                                          PID:2264
                                                                        • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                                                                          "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                                                                          20⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2056
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GKRF07RVHS.bat"
                                                                            21⤵
                                                                              PID:1872
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                22⤵
                                                                                  PID:2624
                                                                                • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                                                                                  "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                                                                                  22⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1600
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ap6i2Y3psm.bat"
                                                                                    23⤵
                                                                                      PID:3028
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        24⤵
                                                                                          PID:2628
                                                                                        • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                                                                                          "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                                                                                          24⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:832
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ys6bB5gfdY.bat"
                                                                                            25⤵
                                                                                              PID:1096
                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                26⤵
                                                                                                  PID:1988
                                                                                                • C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe
                                                                                                  "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe"
                                                                                                  26⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1612
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2740
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3024
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2804
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\DllCommonsvc.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2644
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Default User\DllCommonsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3016
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\DllCommonsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2512
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2584
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2968
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2252
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1096
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2356
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1744
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1928
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1620
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:552
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2300
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2344
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1248
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Windows\de-DE\audiodg.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1912
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\de-DE\audiodg.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1872
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\audiodg.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1196
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsm.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2416
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2820
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1568
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\CrashReports\services.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2732
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\services.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:380
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\CrashReports\services.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2028
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files\DVD Maker\ja-JP\DllCommonsvc.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2872
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\ja-JP\DllCommonsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2692
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files\DVD Maker\ja-JP\DllCommonsvc.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:448
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\providercommon\conhost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:584
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1616
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:956
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Application Data\explorer.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1932
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1204
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Application Data\explorer.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1916
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\csrss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:660
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1460
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:236
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\dllhost.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3008
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Downloads\dllhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1692
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Downloads\dllhost.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2208
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1440
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1880
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2212
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\L2Schemas\csrss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:992
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\L2Schemas\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1412
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\L2Schemas\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:764
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1636
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1660
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2920
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\Office14\1033\csrss.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2972
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2280
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\Office14\1033\csrss.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:864
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\Sample Pictures\lsm.exe'" /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1264
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\lsm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2056
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\Sample Pictures\lsm.exe'" /rl HIGHEST /f
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2768

                                              Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      afdbdf8aad2f7f036e59127126e3e9e0

                                                      SHA1

                                                      207bd6b36f10e8a005947abca4ea019029739b58

                                                      SHA256

                                                      867c36050201f4763fbb451a6986ebad25cd0d584b2cca2155d767e18d081f97

                                                      SHA512

                                                      90d858dafc8ef6a14c4373a081fe80470c2cb80d86bee91a48dbaac2172030d6620049ff38b95970d2dd82113cc804ef7b479c7b69e6c0d238cb24420d7d2e99

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      db1eaec516b4b01e80905f0837ef039a

                                                      SHA1

                                                      8346d18da26af1daf95eea07edeebf371a564313

                                                      SHA256

                                                      6097fabf5e30b3eb14596c8948940ce4b903c072dc7c982647c8df06e3d7bb63

                                                      SHA512

                                                      97d27552a122738446d0ac38bcab843774f32123abcdc14d734e2a611ca8b759f338a14f584b06be908c301a97f1981c689179ce797d1e40aa2c5806df65b4bb

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      4d2cc0547efc9356d7567816ea388b03

                                                      SHA1

                                                      d2b33fff329e01581b6f0690fe796aba47d11612

                                                      SHA256

                                                      b1e7719c875186ed87cad0ced44c1369427cef4d82942fd49f4366118d2e8077

                                                      SHA512

                                                      05769fa060481d3170ef17f8a42daa07e62f1e9a9e6ac0383db1432d4e8763876ab0133e2a5e8e3f2ed257a680fddb4e1eb5c255c0fe72bdc8c90a404924b37c

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      2afe47f4b2687913a9eb2ad56f1608eb

                                                      SHA1

                                                      445de65f5c303f9ca69281839ab8941899c9fb81

                                                      SHA256

                                                      37ee4b082168007453fb1fb57c568def3a88f3a465bc9bd7d985ff781b7bcfbe

                                                      SHA512

                                                      6a4fa2917ea03513cd63e6a23f1b56e7867c83e6398a9b12342456f35de841b88530666736e40b0d8c4f0c3522c557c1c1d0884eeb25d8a909a8f659a93462d5

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      30f4123d0abc624c4965becf119ba21f

                                                      SHA1

                                                      2969f8e502edb390013f4bcee7021ccb45dadc66

                                                      SHA256

                                                      c8c0732f0db20bedbd5d445d3e2f29f0ce742af243f31047200fa960b862d599

                                                      SHA512

                                                      95899e0830cec99f94fbd527f7ff615ec5eeb505dfb06f99d21a1bab3eea2c9f85b8c6b26ef3005d97681f4e8c6413b231c0ddaf3d51e6f5a9ef33172d81e660

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      4931d432ae0f427868961b93b67cd2f6

                                                      SHA1

                                                      eb1e46c63f5b90fdd48c789845a84b21091ddae3

                                                      SHA256

                                                      59295ab26b79f5a4b9d939fbee8032938f48b309ff47601a6807944dfd141d04

                                                      SHA512

                                                      a63b27a2abd5ecaeda7d3741b12f96a23026c9d8958503b0b5d81b06fd5e0141258ea53b2a5e6a5dc02ad08a4e4bb3691f0302b9a8adc2912dcc066b1715675f

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      956d385161cd644c51bf9a2e472776b8

                                                      SHA1

                                                      437c62a9f245a2ee42b9830298938f3497f01d9d

                                                      SHA256

                                                      6343aeaf7eecaddf4dcd3baf0506d78b05e08dc4050672de4a32b400365050a5

                                                      SHA512

                                                      93d51878679877a317d1766eadcbdea025a23f7edbae203cf0765819b72932ce76250bc3230efbd373cc2694553631ad38c75575fe23cc97913708fdd3d4e1a8

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      dfc937f9c239764b5456929ef862af05

                                                      SHA1

                                                      b47196142b0c2a4a776b57b8c3c2161aff8e4e86

                                                      SHA256

                                                      33f757a8a76519b78ede9662233bdcb8d0abf0581583dc0c5e9778f3bbd79940

                                                      SHA512

                                                      80565f1e8875bc6a069cb0c149f72fe8ee9403c66a8a88042dfda649df076f41a083f9f7f8c741188d5e0e5f2a0a76025d915a0b0e559533235afbc52a50fba0

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                      Filesize

                                                      342B

                                                      MD5

                                                      0220c3044137222ba6d3b58a0aec5ab2

                                                      SHA1

                                                      3631ca7c4e4cf4db82e4ee1f835e9dd39c149491

                                                      SHA256

                                                      45c1f06fe38e2f45327a131c97d981f580ce9a5e0a948cb4d123bf6e54b0f69e

                                                      SHA512

                                                      02a40959a8cac4dc774c1f223b0b716956a22ac0b6836c6fd60a813b98a1f4a84ef7955c3b51acf61463f237053f0dcdf8414a28ea367ee3c458a322a6224ef2

                                                    • C:\Users\Admin\AppData\Local\Temp\4Tm0GxqeGU.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      4226ff4c7ba33d454a6ffa094e0e7eff

                                                      SHA1

                                                      47231b5b11f3a46e96e96b4c1b3929e4e07084b3

                                                      SHA256

                                                      8d9101b3a74a8b7334c77bd9059a78d9f5727e1f0e064fb2f24b98cd79208413

                                                      SHA512

                                                      4a191e81f2f7c2374c4a05c368d3ca8923964ed86ecd07a31ba0b244921ba646c8a8af3b576865b5a3f148974ad4791da8f6aa6707d9947c485f49d093f91713

                                                    • C:\Users\Admin\AppData\Local\Temp\6Zqs8041Oe.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      ad366a63f9b8edb1091e8318d18e2294

                                                      SHA1

                                                      d25f5e76e2aef5498403582970f932a2a2aa1a12

                                                      SHA256

                                                      dfaccd5073c6768f8092cc45135e9d77a38150be896b07c01c12f6ade86777c4

                                                      SHA512

                                                      41ca29ddb3e4dc8bc00c8c9a85ad6df20087337a65af6d9862797a2e89311f4237cbd3b39ed05fe99f73682987e61ddb32cce2555313ea7f6dae78b72b2aed37

                                                    • C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      c26ef7598727fdfd3ba24cd06827e599

                                                      SHA1

                                                      85a5f7b158a8b9aadb7af764550242d97eedf8e7

                                                      SHA256

                                                      ff6adb0133ce26a29790247b0663b13cd753adcfc4fd3c256598215c17d51ee1

                                                      SHA512

                                                      70ef70d5a32ce44fc000e4536f092b23a51d95f657e0c6fedbffba68be78818666c03bcf0c691a094dd75f9acc742c30c79f769cfa7fcdeb1bc7918b3bf25267

                                                    • C:\Users\Admin\AppData\Local\Temp\Ap6i2Y3psm.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      53a5abe8fd9bfcc09215869348197691

                                                      SHA1

                                                      95cc7dfc8b66694d2cddec3c164ff6fc17947d26

                                                      SHA256

                                                      d35867d46632a16fec1d189bf314b4a097f172b18fcbc4486fab4d3bb708fe3b

                                                      SHA512

                                                      c1e5ca6fd2189a3f40f209114bacdb0cefc87de8bcfb6038dcd0549bbb943df6e8d386eb02e6e70f0e9aee9fdc7fd203c64cc355e29302ba25f25779a959772b

                                                    • C:\Users\Admin\AppData\Local\Temp\CabF366.tmp

                                                      Filesize

                                                      70KB

                                                      MD5

                                                      49aebf8cbd62d92ac215b2923fb1b9f5

                                                      SHA1

                                                      1723be06719828dda65ad804298d0431f6aff976

                                                      SHA256

                                                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                      SHA512

                                                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                    • C:\Users\Admin\AppData\Local\Temp\GKRF07RVHS.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      30595ffcbfffa3595b12d054cd693f82

                                                      SHA1

                                                      e3174647e8d22c8e4079255593afdd32d164031d

                                                      SHA256

                                                      485fecffa876504b0d4559a4d669ba5f894c849319de8719ad140039046e9a87

                                                      SHA512

                                                      63d3b525db3de1db7d60236e8d165ed7c15a8f210ef74cac1fa52dbcdfc2f174332d3c7523e6c55101af78c03c2b8a89173a022313494797e844a5285a9c8ce0

                                                    • C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      b223ecdb3a8793391fb4ce9f0c1f782d

                                                      SHA1

                                                      4f911566698b4697d7af486d3163ebffd42d6505

                                                      SHA256

                                                      8ccecb90c5182d62d3eb02fec2f69c32b87bb2aef80e567b5fdf006c1e5aa1af

                                                      SHA512

                                                      54bafaf8e2149f89a34b909e8015eb238f3a54e60c1f5be86bbe374c0f1cc94685dbfa911f5ee95f33aa811b0b38ffc1aaa2d4486a274183030eda52ac8f7b09

                                                    • C:\Users\Admin\AppData\Local\Temp\TarF388.tmp

                                                      Filesize

                                                      181KB

                                                      MD5

                                                      4ea6026cf93ec6338144661bf1202cd1

                                                      SHA1

                                                      a1dec9044f750ad887935a01430bf49322fbdcb7

                                                      SHA256

                                                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                      SHA512

                                                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                    • C:\Users\Admin\AppData\Local\Temp\d5cQTyHbvx.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      9151bf0a9a02e517ab3bec6a1fd3e100

                                                      SHA1

                                                      6fc3cd63bb8fde70634d2728f6cef9223c3fb7b9

                                                      SHA256

                                                      2119e6d6447b2f97dce4ef987ab9fcca98379237b34f0c00ada8ed09d19376e4

                                                      SHA512

                                                      47d444200ecfc2e1d0f693a50b36e991083472314c0c1d021629ed4490130da5d08b6349b777f14a22eb28721f70e4c18f90476c845edb6405460d272233497b

                                                    • C:\Users\Admin\AppData\Local\Temp\fg7ffKrc0I.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      0d1ac243dcfee688a89d780b9fb66e2e

                                                      SHA1

                                                      c9e4631245a1310fa08df8e15f4945f2c2f62c30

                                                      SHA256

                                                      fe9ae1418468ada5b16e385e8a7bb741e126cd341ced39d68261de3c9978c66a

                                                      SHA512

                                                      36f6c7ae2ee7222c07ec1b52dd9901e459f941e427c893a77c3d695818dede0f21185a345a840717056276a064fba8a0b08184155011755d22f50020a1aab5f6

                                                    • C:\Users\Admin\AppData\Local\Temp\tlraSVrJxn.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      c992f8c3d2c53810ba725ecae78b5116

                                                      SHA1

                                                      0c4dd5b15c327fde91fba6d3b474979161e24369

                                                      SHA256

                                                      96ed7edfc1aaed0644dec1c8e3e4bda5a548fac357e33a5585287ad9931ab717

                                                      SHA512

                                                      15523efc0d3aae23aa4402350c66d017a951391b2df44dff9371954001f210aaa1afb6d63ba9499167c1576af3be8a037b3aa31e6bf78cbc3cdf428d9975a8cf

                                                    • C:\Users\Admin\AppData\Local\Temp\u4i0upNjR2.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      6cacb7778d21fc885cdc1f8229f15838

                                                      SHA1

                                                      018640d6ea15ed25329ccf59906b533ca3f6fb60

                                                      SHA256

                                                      1b21d8d76131596b860d20de47fb440dc74d5a26b3506dc9f0129fe1b7bec396

                                                      SHA512

                                                      82891032ac77541e2dc626040d6f6ac849a64737131818a9919164ddc29e5355f06bf7d84117b29581537c3b9288a495c25ae6a1908533c3bae7b6205b8b0afe

                                                    • C:\Users\Admin\AppData\Local\Temp\ys6bB5gfdY.bat

                                                      Filesize

                                                      225B

                                                      MD5

                                                      bc803aa7d9f08bc6a623175260c07a04

                                                      SHA1

                                                      0d78c8dfc216b109f9cc6eb885197921932446b9

                                                      SHA256

                                                      e0e205ce9b8c8ff98b70a16af2a62252375a032816bf30114dba12b8dafde6a3

                                                      SHA512

                                                      8726ff0ace6c48a10a3aa4ea7b8c4a59eb6751ec1d79ed3489b75a1dac5215b13c71eff9ee9fad6f07c7c0710d957b1c314226bcb4b557dc9f8affbdd86999bf

                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      6393b1a111cb9a9ee7f8df5df0f98ef1

                                                      SHA1

                                                      1621511e87cc5e6ea845f10477ae53b6bb216229

                                                      SHA256

                                                      737ab11ee0708ae985ff9a5480c264181029579bf4326ade3298ef4cd0baf81b

                                                      SHA512

                                                      d78f568ae950ba2830b06f5aee2b5b9ca5331417e0791a3a9250fd2ae020aeb0dda400aa1d3bb161422690817fc13fb4056550d1484ab381ce7a6bed69d384c1

                                                    • C:\providercommon\1zu9dW.bat

                                                      Filesize

                                                      36B

                                                      MD5

                                                      6783c3ee07c7d151ceac57f1f9c8bed7

                                                      SHA1

                                                      17468f98f95bf504cc1f83c49e49a78526b3ea03

                                                      SHA256

                                                      8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                                      SHA512

                                                      c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                                    • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                                      Filesize

                                                      197B

                                                      MD5

                                                      8088241160261560a02c84025d107592

                                                      SHA1

                                                      083121f7027557570994c9fc211df61730455bb5

                                                      SHA256

                                                      2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                                      SHA512

                                                      20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                                    • \providercommon\DllCommonsvc.exe

                                                      Filesize

                                                      1.0MB

                                                      MD5

                                                      bd31e94b4143c4ce49c17d3af46bcad0

                                                      SHA1

                                                      f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                                      SHA256

                                                      b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                                      SHA512

                                                      f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                                    • memory/448-218-0x0000000000120000-0x0000000000230000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1196-338-0x0000000001110000-0x0000000001220000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1600-638-0x0000000000B00000-0x0000000000C10000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1612-758-0x0000000000240000-0x0000000000252000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/1612-757-0x0000000000EB0000-0x0000000000FC0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1728-158-0x0000000000A30000-0x0000000000B40000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1728-159-0x0000000000240000-0x0000000000252000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/1964-398-0x0000000000180000-0x0000000000290000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/2056-578-0x00000000002D0000-0x00000000003E0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/2292-78-0x000000001B6A0000-0x000000001B982000-memory.dmp

                                                      Filesize

                                                      2.9MB

                                                    • memory/2428-15-0x0000000000A10000-0x0000000000A1C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/2428-14-0x00000000009F0000-0x0000000000A02000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2428-13-0x0000000000AA0000-0x0000000000BB0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/2428-16-0x0000000000A00000-0x0000000000A0C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/2428-17-0x00000000020C0000-0x00000000020CC000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/2508-100-0x0000000001E70000-0x0000000001E78000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/2672-458-0x00000000003C0000-0x00000000004D0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/2748-518-0x00000000008B0000-0x00000000009C0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/2980-278-0x00000000009A0000-0x0000000000AB0000-memory.dmp

                                                      Filesize

                                                      1.1MB