Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 19:46

General

  • Target

    JaffaCakes118_6800b33e033564aed85657ddfb0e0d014dfe8ddcc646571363b3e2638fe86eb4.exe

  • Size

    1.3MB

  • MD5

    59353dcdb1fcc1ae0b5eb042693d603d

  • SHA1

    f2fb1570672442c3a38c1b8765777d2706a16782

  • SHA256

    6800b33e033564aed85657ddfb0e0d014dfe8ddcc646571363b3e2638fe86eb4

  • SHA512

    746198691c94e9b124974adaf127fdca763f77305aae4376b38a420c4e44e5bdb15a94074be680b90ba9ea51d2e139b61ae8af7a59105f44d94afeffdc1761c4

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6800b33e033564aed85657ddfb0e0d014dfe8ddcc646571363b3e2638fe86eb4.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6800b33e033564aed85657ddfb0e0d014dfe8ddcc646571363b3e2638fe86eb4.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4040
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3564
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2196
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\sysmon.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:244
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2044
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Adobe\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2032
          • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
            "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3344
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pI0EcicZAo.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1108
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:2436
                • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                  "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:532
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cLz7lFEPwa.bat"
                    8⤵
                      PID:1264
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        9⤵
                          PID:640
                        • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                          "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                          9⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4360
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kKaF7FiTK0.bat"
                            10⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2036
                            • C:\Windows\system32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              11⤵
                                PID:3948
                              • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                                "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                                11⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:3848
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jFR8woBO6B.bat"
                                  12⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2984
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    13⤵
                                      PID:4680
                                    • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                                      "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                                      13⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:5000
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\18eSMsDQCm.bat"
                                        14⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1504
                                        • C:\Windows\system32\w32tm.exe
                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                          15⤵
                                            PID:4900
                                          • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                                            "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                                            15⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:1556
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat"
                                              16⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1220
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                17⤵
                                                  PID:3336
                                                • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                                                  "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                                                  17⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2056
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat"
                                                    18⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3772
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      19⤵
                                                        PID:1964
                                                      • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                                                        "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                                                        19⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4428
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6raUEgr1vJ.bat"
                                                          20⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2488
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            21⤵
                                                              PID:640
                                                            • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                                                              "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                                                              21⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2836
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DegeIw2hse.bat"
                                                                22⤵
                                                                  PID:528
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    23⤵
                                                                      PID:4812
                                                                    • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                                                                      "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                                                                      23⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3752
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RgqsKqwwLg.bat"
                                                                        24⤵
                                                                          PID:4976
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            25⤵
                                                                              PID:1364
                                                                            • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                                                                              "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                                                                              25⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2940
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat"
                                                                                26⤵
                                                                                  PID:3504
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    27⤵
                                                                                      PID:2080
                                                                                    • C:\Program Files (x86)\Common Files\Adobe\conhost.exe
                                                                                      "C:\Program Files (x86)\Common Files\Adobe\conhost.exe"
                                                                                      27⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1524
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\sysmon.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:940
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default\Downloads\sysmon.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4692
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\sysmon.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1308
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1544
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1548
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2084
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Adobe\conhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:208
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2164
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Adobe\conhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4148

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

                                  Filesize

                                  1KB

                                  MD5

                                  baf55b95da4a601229647f25dad12878

                                  SHA1

                                  abc16954ebfd213733c4493fc1910164d825cac8

                                  SHA256

                                  ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                  SHA512

                                  24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  d85ba6ff808d9e5444a4b369f5bc2730

                                  SHA1

                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                  SHA256

                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                  SHA512

                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  944B

                                  MD5

                                  d28a889fd956d5cb3accfbaf1143eb6f

                                  SHA1

                                  157ba54b365341f8ff06707d996b3635da8446f7

                                  SHA256

                                  21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                  SHA512

                                  0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  944B

                                  MD5

                                  77d622bb1a5b250869a3238b9bc1402b

                                  SHA1

                                  d47f4003c2554b9dfc4c16f22460b331886b191b

                                  SHA256

                                  f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                  SHA512

                                  d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                • C:\Users\Admin\AppData\Local\Temp\18eSMsDQCm.bat

                                  Filesize

                                  218B

                                  MD5

                                  787b72399fe974bd1b982f2038adf4db

                                  SHA1

                                  e8028eb5d2100841a37811984aecb065e073bf14

                                  SHA256

                                  682b146810a9f2521ea98a2c0574750ce426726d5e61e0f04b4499eecf371c73

                                  SHA512

                                  ddd77bd69c98a36e4319592560c80208f305ce93eda87085d49589f71047406c4fdad97a35b830284d8053793add932eea1f03deed4b7e0a73c6919dc6be4052

                                • C:\Users\Admin\AppData\Local\Temp\6raUEgr1vJ.bat

                                  Filesize

                                  218B

                                  MD5

                                  3f10e8ca7dd9545507867f5b72434559

                                  SHA1

                                  acd5f13ecd4ea1d15890eb315b59aff4565b1c55

                                  SHA256

                                  29ce31855af9ff0285d24c0464e274e20f170aa6884fff3c80a431db8ff40627

                                  SHA512

                                  a0c19176d37e617c2b7c17e836bbc29f7e4731af86cf04dcc07f140aa9382b0d9e11f76f3350bf04eaf4c3dd4d57ae6ddc372e897f7e824d236b1ece0b55d292

                                • C:\Users\Admin\AppData\Local\Temp\Asmf6CRzTu.bat

                                  Filesize

                                  218B

                                  MD5

                                  a33e5b225c368183af3f571e40b31833

                                  SHA1

                                  5b677e0caae0c8ae0c2e4f146ce503326198ff04

                                  SHA256

                                  dda2297852eb0c80f96432a73730f9b0abeae7f4775cb2d641d5b01bcb9cf986

                                  SHA512

                                  f8e70a82a45e0196d44af4b60eeed6f108147ac6ed1c3d1cdbf21c206772e464331cfc045facd4e2ccc9a0d578d26037d7b589f41667cf20c09ef9c33ff1c417

                                • C:\Users\Admin\AppData\Local\Temp\DegeIw2hse.bat

                                  Filesize

                                  218B

                                  MD5

                                  602f5b6fa0e4ff6106d79697ac7f9643

                                  SHA1

                                  160ef2f21c52010b8c020ce3653ea24c1e5f07be

                                  SHA256

                                  691c4adae0c9052352a0109bced1cf8387538a6c9d56a256dc71939259fa657c

                                  SHA512

                                  3a07eea77c13763a51867793e0e9f930bb5e60b1ecf8a89fc76ff5de2d86370d1e5f4aa5aee828b990cc88e44b382ed3c9161fe873c183a9759e36f3f1fe2746

                                • C:\Users\Admin\AppData\Local\Temp\RgqsKqwwLg.bat

                                  Filesize

                                  218B

                                  MD5

                                  ba9db6dfc1939de8e4f039c59d359cf4

                                  SHA1

                                  4a153aa344256e6805108365dfeadea215e010dc

                                  SHA256

                                  cfacc35a03b5b81137fbf6f6e3849dcf28d78f02be9f3154f8d4a2222432984e

                                  SHA512

                                  fdfd141a10be7b6b62b4664a1f7efca4f31ca46c13593858b760c34bebef0f45308d37c4f024410aa824245a977bf260834316edddbbdba93452d5b201357eef

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cdqqel52.jy5.ps1

                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                • C:\Users\Admin\AppData\Local\Temp\jFR8woBO6B.bat

                                  Filesize

                                  218B

                                  MD5

                                  a4f2019626d8cc40ac8ed5d6546b8e3a

                                  SHA1

                                  2f30cf9644560f357e7d045bb214825c42072f50

                                  SHA256

                                  24833875496b836eeb557b6f698f099330fe921d6205854197e74fe6f93b6206

                                  SHA512

                                  cc55abbad1f7634d9a106c2501001a62622b919e8483b4d3ad2c1b57b628198097bb70081bc98552154c2bcc87053e013dcbd375927fccd2c2ff1af473162629

                                • C:\Users\Admin\AppData\Local\Temp\kKaF7FiTK0.bat

                                  Filesize

                                  218B

                                  MD5

                                  f549b513b68a152fa4508216b8b84542

                                  SHA1

                                  2e3adc6bb621224d9d5faae89b6ab46a53dd1b16

                                  SHA256

                                  569ccc77611c6012658eb59353984700f7bd7e6cb04049737eb4c7e708ad07b9

                                  SHA512

                                  f80905dd44001572c7462c5fb1a63169736ad144286186354e7852ee2bdb4fe36a84625445cab48f58688748195c8a48329336bc217d33e975adab50535bd048

                                • C:\Users\Admin\AppData\Local\Temp\pI0EcicZAo.bat

                                  Filesize

                                  218B

                                  MD5

                                  a447f3f80dbfd5d9de209f52bfda1082

                                  SHA1

                                  058a78539e9070508560fe9c620d195c3d134e75

                                  SHA256

                                  af70722a29da877bf787c136527fac266c515efad699da0cdde5fb4b84acefa4

                                  SHA512

                                  946c621d761193f4055819507f9cca4ca2f9f4f3617b1808024ca51ee3a84bb7c1756d08c7307ae88631cb13bd6bf1430653d584c1a36ff029e2200f7969edce

                                • C:\Users\Admin\AppData\Local\Temp\q3WH03M43W.bat

                                  Filesize

                                  218B

                                  MD5

                                  0c51e45afff05b9173358d2654b19506

                                  SHA1

                                  752ac8e8fafd77e10a73292d073eef9cc6544e11

                                  SHA256

                                  063435f810e64510406dafaf5a364c99894d5532ac7a5ef95ed2b454c6632eed

                                  SHA512

                                  1f792299231a532b1eb464005419aac170274e5804aca4cee4a69b97253101dd8414098d3092c520611c2b8566a93c1044beff58a5eaa7bb1fed789d9d837fca

                                • C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat

                                  Filesize

                                  218B

                                  MD5

                                  5b3e2a01bcf2787ae71a626f7df09fde

                                  SHA1

                                  24c43a079fcd60acdd16b3a4df6573ddb529b680

                                  SHA256

                                  ef214076d3fa0ab9eebd0e0cb7fb7b2020ba621d19b056bdfca5c1ee8e882d5f

                                  SHA512

                                  94710b324d8c0434874452df27a3c0fc07150fcea7688567c384506c3f0791546fad090ac059bc2159c591e9333012f1439e97bcb9960c75e3df9b763d4c66e6

                                • C:\providercommon\1zu9dW.bat

                                  Filesize

                                  36B

                                  MD5

                                  6783c3ee07c7d151ceac57f1f9c8bed7

                                  SHA1

                                  17468f98f95bf504cc1f83c49e49a78526b3ea03

                                  SHA256

                                  8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                  SHA512

                                  c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                • C:\providercommon\DllCommonsvc.exe

                                  Filesize

                                  1.0MB

                                  MD5

                                  bd31e94b4143c4ce49c17d3af46bcad0

                                  SHA1

                                  f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                  SHA256

                                  b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                  SHA512

                                  f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                  Filesize

                                  197B

                                  MD5

                                  8088241160261560a02c84025d107592

                                  SHA1

                                  083121f7027557570994c9fc211df61730455bb5

                                  SHA256

                                  2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                  SHA512

                                  20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                • memory/532-89-0x00000000016D0000-0x00000000016E2000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2044-40-0x000001D25B300000-0x000001D25B322000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2836-131-0x0000000000AD0000-0x0000000000AE2000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/3564-15-0x0000000001830000-0x000000000183C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/3564-12-0x00007FF9155C3000-0x00007FF9155C5000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/3564-13-0x0000000000D70000-0x0000000000E80000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/3564-14-0x0000000001800000-0x0000000001812000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/3564-16-0x0000000001810000-0x000000000181C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/3564-17-0x0000000001820000-0x000000000182C000-memory.dmp

                                  Filesize

                                  48KB