Analysis

  • max time kernel
    146s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 17:41

General

  • Target

    JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe

  • Size

    1.3MB

  • MD5

    e9333bf2ebbc0f4f0dfa3117c0d8defb

  • SHA1

    b78aad289bcee2c69187810a7f7b498167ce0833

  • SHA256

    91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f

  • SHA512

    f01d52a39fb56db397bfc3f40ca320b5d7931b2195c263ef615a7484c69388f74a2fee1af1109e35abfc1221d1e89cfbc03316390e595e276489d78cebb20375

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91adb63135fe2e2165feef8f8a1a4971041d2efa716fbb1bd751da90221cba9f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1280
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre7\lib\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3016
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1852
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2976
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OQU2DA9XHb.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2000
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:1784
              • C:\Users\Public\conhost.exe
                "C:\Users\Public\conhost.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:268
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1632
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:2092
                    • C:\Users\Public\conhost.exe
                      "C:\Users\Public\conhost.exe"
                      8⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:876
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1592
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:1092
                          • C:\Users\Public\conhost.exe
                            "C:\Users\Public\conhost.exe"
                            10⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1036
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iIDKKqsGny.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:300
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:2960
                                • C:\Users\Public\conhost.exe
                                  "C:\Users\Public\conhost.exe"
                                  12⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2956
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CL2HVdYORd.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:2204
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:2436
                                      • C:\Users\Public\conhost.exe
                                        "C:\Users\Public\conhost.exe"
                                        14⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:448
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iVu5YTRuDT.bat"
                                          15⤵
                                            PID:1060
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              16⤵
                                                PID:2624
                                              • C:\Users\Public\conhost.exe
                                                "C:\Users\Public\conhost.exe"
                                                16⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2576
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat"
                                                  17⤵
                                                    PID:1248
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      18⤵
                                                        PID:3064
                                                      • C:\Users\Public\conhost.exe
                                                        "C:\Users\Public\conhost.exe"
                                                        18⤵
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2900
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6qhkY4Aj1y.bat"
                                                          19⤵
                                                            PID:2188
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              20⤵
                                                                PID:1140
                                                              • C:\Users\Public\conhost.exe
                                                                "C:\Users\Public\conhost.exe"
                                                                20⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2612
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat"
                                                                  21⤵
                                                                    PID:2876
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      22⤵
                                                                        PID:2248
                                                                      • C:\Users\Public\conhost.exe
                                                                        "C:\Users\Public\conhost.exe"
                                                                        22⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2856
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T3kbcxG26A.bat"
                                                                          23⤵
                                                                            PID:2540
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              24⤵
                                                                                PID:1220
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre7\lib\dwm.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2720
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\dwm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2888
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre7\lib\dwm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2924
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\conhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:308
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2756
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2728
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\providercommon\csrss.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1248
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1812
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1044

                                Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        b7bd80ab39c3f40ce1af13891e0d6d74

                                        SHA1

                                        a7a90cde4e69df8d22a4c345ec6c87a7442fe50e

                                        SHA256

                                        784615b9627f55d23728d8b2f4783e59863699c77b53fea192643ea99924a145

                                        SHA512

                                        abbf9b31ba076ea8dff3b23ccf298ffb9502e08c8a2ee95cabf3d8c066816b63bd0e7c012dd32ff62da93ca88119c8c0af33989023645be4b00b4066037871fb

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        ce7d1dcef286c5f24df9cf5fa33a5fa5

                                        SHA1

                                        c2761cead4b306f2893e35141528ae117e817f77

                                        SHA256

                                        c02c0c997975fb046efddace60edba906093ed4f131952bbd18f0e48615a30b8

                                        SHA512

                                        a72d92f0b3e633d9781f0db074ffbe7c1a8b150c7d7e5900f9f8a2c647992d698cfa685095b0249405abad2b6fbdf367fdec6175e4ef34521bd8bec462bfa1ac

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        cf104165f6bfa2c19150fb7a769bdcd7

                                        SHA1

                                        72eedf37b438aea62b54181229a2bc284f477e36

                                        SHA256

                                        ab1668ca15af6c14640ca05578dc656f248de1e326450f760d2694b914daa98b

                                        SHA512

                                        f935dd5407994c354e544d01004b61df4446bb6d8fc06dbde5a2ccd658bbd5813781119c634327f6a78afab83cfe20f64b5dad0d1243ab249caae5ee03184fa8

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        53835cbd1484c80590001dc9bffb430a

                                        SHA1

                                        c995f00c5a30a6fcc10fb6ecbf301ac6cdf48599

                                        SHA256

                                        49b272c6cb672d9dce1cf394e5ede244c5b7b780d60140fdc4a3dd0ce483b772

                                        SHA512

                                        47cafbc94617f78d02c0853094a5d426ba9e13272d50d8f8961cd8b3d14fe6ca87401dbcb3875c5a7cd7d266f27b0e3fda0e5137158803f8f57031d2305f0eb3

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        2e4fd0dd72c66e9cefd7d46cb55f5b32

                                        SHA1

                                        6c979d2cfd14d9eb64669acef39590f6382c20fc

                                        SHA256

                                        01cfd9d24cdfd0e4cfa2e233b382607ff1e7a1e3b4e26a487b6805e0ab8b2c60

                                        SHA512

                                        beb51b799b98d613f87ced53e0f7aef027abb68a37f7ce641feaf30da0b7db99de4e0f5d51606076cd0d8f102f574b0e722e7f52c6d0c158d7098aea13cdcd10

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        cf3438ad04b98698c067cd942f69369b

                                        SHA1

                                        98252c91f5a067bfe5a6cec7fa8391821e9a4f6d

                                        SHA256

                                        550efc932ecf982ae308f389d49c1b70fab78a3b1e1bec10073751dc5e233391

                                        SHA512

                                        ed13404530d62b861a57070ece6d1653722d449ced0b31ae8486db4e559c5ae3c695293fb0324409e193a3075c68f508f439e468ab8a80d78dd812deac316fb9

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        96ac62e4f9c34824e5c776fdf09ba1f4

                                        SHA1

                                        7ea24703ed9ca4354426c1a92255bd34a774d2e6

                                        SHA256

                                        60f807d8ee1af55159af7769b6ebf5e9a56b9d1e9b9ea6bb66130b9161e4f84a

                                        SHA512

                                        65554d04da1a43f6ba56ea3aade9eecf576bbcf7c1e677d92bc9f9d4411b258560ae65f6d99bb48b28a8721b6a9310235eb528dcd3f35ce0c547501700347702

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                        Filesize

                                        342B

                                        MD5

                                        f4f76cb8622c9979f6212e6509cce804

                                        SHA1

                                        c975d749780362edb56d4f21c7a79e84f74e88db

                                        SHA256

                                        3fa7674e0cb730b0e5bcabbbf5b41faf11a8a300447c2b221aaccd2f162c2aff

                                        SHA512

                                        8a8d3602a8986b338f93cb26da2f1322faead6ef58a8b2c21f397200fe9615d52cf3b51d5f57fbe7cdaf63b6a9650e52cda132146ee847b723eec8ca40857772

                                      • C:\Users\Admin\AppData\Local\Temp\4rzlnKig63.bat

                                        Filesize

                                        192B

                                        MD5

                                        0f524ac0f3a0c697432448ff7fec3586

                                        SHA1

                                        f7a338653d619117f36cd119c0be15273bffd990

                                        SHA256

                                        52e6a829d139a7991a5b3f4d8daec1ba1fe7ed7b501c805d6a567ead09e00de0

                                        SHA512

                                        1e0e94be6d2c872817b833080f30f6d340055e6dfc61e85c455f7effc7fe7b359d2c10d45902dff83b6478a659c9391db196515ba1f47156e0ba9a44199b3cbd

                                      • C:\Users\Admin\AppData\Local\Temp\6qhkY4Aj1y.bat

                                        Filesize

                                        192B

                                        MD5

                                        8251d7504eb80f7ef21f46d22bbde465

                                        SHA1

                                        236e5ab35f2f81df5cc0d1365d46821b66f4b0cc

                                        SHA256

                                        27619be3a4a7176bf0f70e0dde9d9451e1bfe3311b77d4b685936a7620229790

                                        SHA512

                                        9c90e3c8d7a2ffcd4b30be81a76564c629188b2a47345969312eeb6995c7a13e7f2fc8019af5f5d9526fd004260c62654749d55b408558f1e045f11f9aad8ea0

                                      • C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat

                                        Filesize

                                        192B

                                        MD5

                                        bcde3c384bcb412c191dcfc4dd17a9ab

                                        SHA1

                                        0f84d41a8b40f8582c395da63a0afdf50a58089e

                                        SHA256

                                        f2761518fdef1af599bcd5238971f697739ac6bb89186e04a50aeb4d01b0d846

                                        SHA512

                                        e4543af1fafbeab9c4b53fc17412928923d044b1b196d320045c9d36c9fc3ee8aec0ec0f6d18b2f7b87bf54d3501a34e6c6ae01a501217f534c7b18021955e42

                                      • C:\Users\Admin\AppData\Local\Temp\CL2HVdYORd.bat

                                        Filesize

                                        192B

                                        MD5

                                        dfa6335f98791e851c8697102f24e6c1

                                        SHA1

                                        168a0a8f38b4add1a0decf7667d98ea4e50c0fc8

                                        SHA256

                                        677a84165e17d53252d5ab00f86b3b2d8d5bca36914f03441c3d800a16878818

                                        SHA512

                                        00cd606d9c28253189f98cdf1bbedf5802ae5ed115472b02360427b64b49c4023e2329bd9e5d1452b61e8118baddbd4e2eb2b6182ef0a66391badd159a699889

                                      • C:\Users\Admin\AppData\Local\Temp\Cab175A.tmp

                                        Filesize

                                        70KB

                                        MD5

                                        49aebf8cbd62d92ac215b2923fb1b9f5

                                        SHA1

                                        1723be06719828dda65ad804298d0431f6aff976

                                        SHA256

                                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                        SHA512

                                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                      • C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat

                                        Filesize

                                        192B

                                        MD5

                                        a71f6ad1c633718cf50743d8ac8540e6

                                        SHA1

                                        77fbc5d402215993f26c07016663bb6e2031b208

                                        SHA256

                                        eb72cfec116de201e48b83a65f375bb0950405e45d86f95fea25185c43c903c7

                                        SHA512

                                        48fc6e19d809ba7cb93e89d27aa3b50cbde345487417715c89a81232372cba1d173073b97d9062ff0360610eb7667cca110418cab79cc10c860215dd83c9823d

                                      • C:\Users\Admin\AppData\Local\Temp\OQU2DA9XHb.bat

                                        Filesize

                                        192B

                                        MD5

                                        1af63a59674c69077b54c2e9ba323b1b

                                        SHA1

                                        515dc133b7f3f25be4bf3412d3833aa80de81ddd

                                        SHA256

                                        9c4df6956c244c22dcadcfb20e3554b319cc1421b73407fc6d15988c18406a7a

                                        SHA512

                                        69e3bb163660e9a1f1b39a806bb5cd606b6cef4309710a29c7a05f0152274401263c33513cc4d36904208cd306be68cf2a0454211a8bce37723d12f6c047f441

                                      • C:\Users\Admin\AppData\Local\Temp\T3kbcxG26A.bat

                                        Filesize

                                        192B

                                        MD5

                                        413198e4275aa9e8c822e3c6556f2cc5

                                        SHA1

                                        60918ce2779aa2b4eef30721de88500660090333

                                        SHA256

                                        e4d660f6b61fb9facd01f5220be31981d15076bcc4a89d5decd0004371a79796

                                        SHA512

                                        b6a7796e75b8d517087d738643297d9a696d4f651ddcd96911c832555662217d19fb9a2161c59351c230f24db0b5e26fc6343b93d35472ca4c36f084481b3636

                                      • C:\Users\Admin\AppData\Local\Temp\Tar177C.tmp

                                        Filesize

                                        181KB

                                        MD5

                                        4ea6026cf93ec6338144661bf1202cd1

                                        SHA1

                                        a1dec9044f750ad887935a01430bf49322fbdcb7

                                        SHA256

                                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                        SHA512

                                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                      • C:\Users\Admin\AppData\Local\Temp\iIDKKqsGny.bat

                                        Filesize

                                        192B

                                        MD5

                                        ee3bd24977de1a3c69023d9aa144960f

                                        SHA1

                                        bfb718ef7b0f6770b0560e0a73e5a4b641e62ac1

                                        SHA256

                                        a8cbaa9ae0e3e6b93bff66102f079eca21ac12136146d4af98e0608ef7afc3a5

                                        SHA512

                                        6641c41b67b80a6a8ee2826ebd2fbb45f7020e95690db745d54f1efce4817c3c7ce938eeb2d41163e54a50763ce8b38a3505459ffeb8ca84c3037d4aeaf86024

                                      • C:\Users\Admin\AppData\Local\Temp\iVu5YTRuDT.bat

                                        Filesize

                                        192B

                                        MD5

                                        8a8baf893b85300b1e4d02b19291b71f

                                        SHA1

                                        8fcb80633569ac2bcc5b9ea2e9db5da53fe004d3

                                        SHA256

                                        da92fa876ed969839f20db79eec73bf5b828c12992ebf049eeaae3caba1f2e5b

                                        SHA512

                                        51c39ccea4b69832cfadb2859bfd7e22f26f7bb8851bbbe82a6b4284e460536e949d1767e07a6eee5085434cece4d7c48e29af932f199bc14578baa66da832e4

                                      • C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat

                                        Filesize

                                        192B

                                        MD5

                                        f6bd6ae0c40fedb64b6f3dcd8816cf69

                                        SHA1

                                        2643c11c0d33a0925376c7742e5eac306de20d21

                                        SHA256

                                        8064f73523cb886d74c2f564e14906c32838e3912fe58a7a10cfd903c9e16d1a

                                        SHA512

                                        e58d98ddfd7ee05c493c99d16a17e3d7648aa2f29309a8c349ba71d2709ce97b883ad926c76a93d12cf5dbf7f3232ab8636e612fd0dd35f4183c1512698aa7cc

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                        Filesize

                                        7KB

                                        MD5

                                        88c3fbf3cf3155b53abd0df659725513

                                        SHA1

                                        7e6fd35da35009a9c5abe9bce41284941df5e30f

                                        SHA256

                                        f0eaea9352df2222d2a58c80d0490d1e73284317231a56957db4fd8de60e0380

                                        SHA512

                                        1d70d97937bd22c30521ca3470eff929503fd944a6e7fad8ff28ccd91a23a8e0eca0877b20df77e361cda28c030b93643b0d23d41a18a0260ab1b9edb706e58e

                                      • C:\providercommon\1zu9dW.bat

                                        Filesize

                                        36B

                                        MD5

                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                        SHA1

                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                        SHA256

                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                        SHA512

                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                      • C:\providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                        Filesize

                                        197B

                                        MD5

                                        8088241160261560a02c84025d107592

                                        SHA1

                                        083121f7027557570994c9fc211df61730455bb5

                                        SHA256

                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                        SHA512

                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                      • memory/268-53-0x00000000004B0000-0x00000000004C2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/268-52-0x00000000010D0000-0x00000000011E0000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/448-290-0x00000000012F0000-0x0000000001400000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/1036-171-0x00000000011C0000-0x00000000012D0000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/1280-48-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

                                        Filesize

                                        32KB

                                      • memory/1280-47-0x000000001B6B0000-0x000000001B992000-memory.dmp

                                        Filesize

                                        2.9MB

                                      • memory/2856-527-0x0000000000630000-0x0000000000642000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2900-14-0x0000000000340000-0x0000000000352000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2900-13-0x0000000000360000-0x0000000000470000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/2900-15-0x0000000000570000-0x000000000057C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2900-16-0x0000000000350000-0x000000000035C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/2900-17-0x0000000000580000-0x000000000058C000-memory.dmp

                                        Filesize

                                        48KB