Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 12:50

General

  • Target

    JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe

  • Size

    1.3MB

  • MD5

    f2803766a2f7cea3e91c2840ac2f85a6

  • SHA1

    546004d9f413ae33db3b6d74eceea26e6453b596

  • SHA256

    11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480

  • SHA512

    c6116141dcc7ebb3efcffda6f128e9a5b0c586f26ce6bb86e738eb2d89a781bac053e4f77b7314236e59df4ecf6f4b561be131b025db9fedbf89ec0f1672f491

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11931e904ddb30950482b46ef54e73bf048723912c9dc29996a16e6e9c388480.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:544
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5108
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:756
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4948
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1508
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4364
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IdFEdbtPnD.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2288
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:3436
              • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4388
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5mXdMdden9.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2840
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:2392
                    • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                      "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3024
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2416
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:4688
                          • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                            "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                            10⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2428
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pbn0SniZDX.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4792
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:1508
                                • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                                  "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                                  12⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2916
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4632
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:3520
                                      • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                                        "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                                        14⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:1252
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l8nFZEr7oq.bat"
                                          15⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1632
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            16⤵
                                              PID:4976
                                            • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                                              "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                                              16⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:2308
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WVE2eLfZN7.bat"
                                                17⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:4624
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  18⤵
                                                    PID:4404
                                                  • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                                                    "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                                                    18⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2912
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat"
                                                      19⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2844
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        20⤵
                                                          PID:800
                                                        • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                                                          "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                                                          20⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2528
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Dk8ljd7jBY.bat"
                                                            21⤵
                                                              PID:2188
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                22⤵
                                                                  PID:4944
                                                                • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                                                                  "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                                                                  22⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4620
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o4pIGJu18c.bat"
                                                                    23⤵
                                                                      PID:3636
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        24⤵
                                                                          PID:4204
                                                                        • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                                                                          "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                                                                          24⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2372
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HiXkD60p2N.bat"
                                                                            25⤵
                                                                              PID:2120
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                26⤵
                                                                                  PID:3584
                                                                                • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                                                                                  "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                                                                                  26⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3600
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FgAoPiAcVL.bat"
                                                                                    27⤵
                                                                                      PID:5104
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        28⤵
                                                                                          PID:2408
                                                                                        • C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe
                                                                                          "C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe"
                                                                                          28⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3404
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pFKIY4EPZg.bat"
                                                                                            29⤵
                                                                                              PID:1772
                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                30⤵
                                                                                                  PID:532
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\smss.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3328
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Prefetch\smss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2696
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Prefetch\smss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3988
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\cmd.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1816
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2304
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\cmd.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2740
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4976
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4296
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2412
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3916
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4572
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4784

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        baf55b95da4a601229647f25dad12878

                                        SHA1

                                        abc16954ebfd213733c4493fc1910164d825cac8

                                        SHA256

                                        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                        SHA512

                                        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                        Filesize

                                        2KB

                                        MD5

                                        71fa55c67a762ba70e40011153e19b3c

                                        SHA1

                                        a36d2bb4802a8ec7db1a68de5f0c3d6007987492

                                        SHA256

                                        b8be6896ca89d3ebe9ee8a94e3407483f4750badaf7fa33526817cfc926dc291

                                        SHA512

                                        32760af7c05e20fec8cbddf56c2df544a69335f930f1d313cd1fdceaa90ed2afe81e54ac1b6770097d6f5ca5f30955f95970171a453579aa19239a17aaefe47f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        77d622bb1a5b250869a3238b9bc1402b

                                        SHA1

                                        d47f4003c2554b9dfc4c16f22460b331886b191b

                                        SHA256

                                        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                        SHA512

                                        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        d28a889fd956d5cb3accfbaf1143eb6f

                                        SHA1

                                        157ba54b365341f8ff06707d996b3635da8446f7

                                        SHA256

                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                        SHA512

                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        62623d22bd9e037191765d5083ce16a3

                                        SHA1

                                        4a07da6872672f715a4780513d95ed8ddeefd259

                                        SHA256

                                        95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                        SHA512

                                        9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                      • C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat

                                        Filesize

                                        221B

                                        MD5

                                        6f018589a9c00d3754a36df09ff7838c

                                        SHA1

                                        c95ad50cdb1276f40bc40779b1d758dabea0d651

                                        SHA256

                                        15b33dd57dda2f486f5017b8bb8f0ce2271e140de3277d73529868bea7fd29fa

                                        SHA512

                                        1198ef8509d02d9aabedfd0b93d0c645cb52278d27b8c1922535e88b1e90189c6d74ef22e96f807a9e76a8e735cc98c21e9d8ea22e8746ec55b3b0e87ad45ce2

                                      • C:\Users\Admin\AppData\Local\Temp\5mXdMdden9.bat

                                        Filesize

                                        221B

                                        MD5

                                        bd01fea7a98bb7511fdbc41585a9b004

                                        SHA1

                                        0aa99e782a4eabda765edf5740cee3c9313d4d75

                                        SHA256

                                        199f5606ba57caceb7ef2b664a10f34adcb81323df594dd2e1ce9a19442ae134

                                        SHA512

                                        e7402cf7348d63fa40023028dc56c5947028c36cc8fd9ec28be83d8cad9ddebe7d2a34d48657ee1e4b0dbf28075143d86fb673269c8c0b5d6126e0300ce69cbd

                                      • C:\Users\Admin\AppData\Local\Temp\Dk8ljd7jBY.bat

                                        Filesize

                                        221B

                                        MD5

                                        3c40aa5c22ef125b076f60ec93768569

                                        SHA1

                                        d6d9fdb78fd5bb04a6eda702d575fa33c6c3cc00

                                        SHA256

                                        5e7e7c03c3420a75419bb470a516a4faf0fd69732aa4dcdd3b0201658502f2a5

                                        SHA512

                                        2eea60ec1832afd840a8b286f1cea7d9f221bc2c9a5b0e0ad45069e2c792c409d33f045b9eb702706e0005fe6ebd93c2315c4db76f20b29070d4200a9531b41e

                                      • C:\Users\Admin\AppData\Local\Temp\FgAoPiAcVL.bat

                                        Filesize

                                        221B

                                        MD5

                                        168e03cf03213ae6dd34c9fe91e93d0d

                                        SHA1

                                        a2551a5f8e88a52a911cfccd89aae08ca1a3aa7c

                                        SHA256

                                        004c4902811b4c8b735d99e5d95e0552ce5aead7b55b3d5bfa44abbd905988d3

                                        SHA512

                                        90ec87621c8eadec76c7ba9f5073a04da7860133c16d9bd026d8a4dfb245a0bc87dbcc5e5ef43a8b87c3c74ea70d098c324e5175263bd1b41d70154a55c3119e

                                      • C:\Users\Admin\AppData\Local\Temp\HiXkD60p2N.bat

                                        Filesize

                                        221B

                                        MD5

                                        54037e49fe1775148a2a7b32bea50947

                                        SHA1

                                        e0956e9e9a63b68d1c57a6b31551e90af6736b71

                                        SHA256

                                        a5641c9048320d54c5ee53a1721fc8daae341bfdfe2e6b9fec6df2d3050b11f4

                                        SHA512

                                        9d696e7676969d3a94f3d0e2255eeb8be08118967196aaa651a77aa8af7bffac679a0b2d00c791fe78268e749bd0cfa528bfd979c6892a1b6a69eaa2fa2256d1

                                      • C:\Users\Admin\AppData\Local\Temp\IdFEdbtPnD.bat

                                        Filesize

                                        221B

                                        MD5

                                        fcac6f9b6c4614c40915b0380dbcd23a

                                        SHA1

                                        a7040a0276b972b27a9d0f0a85237025215bc130

                                        SHA256

                                        95e87c8d6385c8e05a70102192c8766ea2682537aea9b166b6c23265eb709259

                                        SHA512

                                        58d84a1565694e2fa0b55d4be7bd9c9fadc892e7566972b4968a2844e49a781afa83a9beb654b3f09458f9f0cbf58bc3331e57153462c3388e37c56f68d59b53

                                      • C:\Users\Admin\AppData\Local\Temp\Pbn0SniZDX.bat

                                        Filesize

                                        221B

                                        MD5

                                        842f06094c338b9b8b4a3f74dbb7559b

                                        SHA1

                                        2a2e8da56931373de1bf6fc86aee68673eb6e675

                                        SHA256

                                        b59a3c731edb83d31c6e758c7f7d1eb17609de02e63cbeb4e02e5bb14423c2ce

                                        SHA512

                                        23988c76d286f8098132e7d708b56aba83dcfd54e81dd2837276efe574fe2fcbf31a074a1330a18e44979bde71df6bcb1cb2cfe0298fa9dd3215f5cead5ea159

                                      • C:\Users\Admin\AppData\Local\Temp\WVE2eLfZN7.bat

                                        Filesize

                                        221B

                                        MD5

                                        aa1f1e5e539fe3746c5fa0b8ac4c52c7

                                        SHA1

                                        4287f52af6ab10fd191d2ad9f701e1e111153d41

                                        SHA256

                                        57247672ddf8b843b2423716f14836f52385814f3d1f6cf7f19999598adcd7f3

                                        SHA512

                                        9fd3be0ef4a40c38bed65147047ad2efdfd6eb53b6eb840250e1b1caa5850c161b53855d4a8b94b0895077a8a044be9f947429c692bede419b232d57fecabdd9

                                      • C:\Users\Admin\AppData\Local\Temp\ZH81p4FGmr.bat

                                        Filesize

                                        221B

                                        MD5

                                        9d7f4bc80aaf310660cadcd02214de78

                                        SHA1

                                        647546923daf22cba341edb2485d778232213750

                                        SHA256

                                        bd84cdde5131348a253402babf10378bb19569c63d32d9cd6800971b30eff928

                                        SHA512

                                        2057a9f86caa024881348dfb9025111234cb7f0ad4ee0db3ac428e295cc0aa48e5b867c019ef955a907b5e1197f20f2db49ba7cc1e3f8a210cc5449c3701a915

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wttnqv4z.lf0.ps1

                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      • C:\Users\Admin\AppData\Local\Temp\l8nFZEr7oq.bat

                                        Filesize

                                        221B

                                        MD5

                                        f74230b00c28bf3e6c1ccba7adc64d3a

                                        SHA1

                                        a0ae2585b43c15271839b4000377b8c928893858

                                        SHA256

                                        db7360cbeeee61a0f55923e349e9ca044093b634f3337b55040136e4e6164773

                                        SHA512

                                        6a2ed030d0b6993cbb12f3233c66f437d5bdae084504480610ea3a2f595b8675b39be0b9e2550d91476a7142abcf96327479d4f2098fe735de110945d1b2ccb2

                                      • C:\Users\Admin\AppData\Local\Temp\o4pIGJu18c.bat

                                        Filesize

                                        221B

                                        MD5

                                        990f20b6e793e2d766acb481c2139415

                                        SHA1

                                        d4e4b7260647ac36df5489994cd961e676d02f50

                                        SHA256

                                        5ba1d372493567ab8d22786343c880e12fedd8d934ba67deb3cff6e38dc292f8

                                        SHA512

                                        b4d8be9d40c7995489d46f9e59c9959010e07f6c24b1ee413bc51170aeb34ea4d6bcbda608170c9794a1e7cfaba8167015ff8188e5992e6d0504d76e1e616451

                                      • C:\Users\Admin\AppData\Local\Temp\pFKIY4EPZg.bat

                                        Filesize

                                        221B

                                        MD5

                                        8e92a8ea89a3da979331ab6caec3f4dc

                                        SHA1

                                        8a19e27825ba88e95e8e412a10f16bada2f588c2

                                        SHA256

                                        a4ed5b74502f39a648802a39faada7a5916ef3efc1d0c266747ef2ed5b22fecb

                                        SHA512

                                        2af3be23eecf54acd760f651ffebd0604b0fb6dd751e3e2087cb8828551fda321ab53ba80b7585c3b7f9ceab63c5c1547df0220ec44723baa9963149e2c68622

                                      • C:\Users\Admin\AppData\Local\Temp\yyRUJOSyqo.bat

                                        Filesize

                                        221B

                                        MD5

                                        b39086d65c53b7fc07e56c72ca7edcd0

                                        SHA1

                                        6fcc24d91bf196f300c7307cff0d97329ced0ffd

                                        SHA256

                                        2991e15f1d25416ef5be6cbcb1d1c74c4a46d93b97c7303feb26e8e9d3eb1657

                                        SHA512

                                        45dc99d344a36af23a83933ad799a8b47c465308d7318043a3e6cc5ffbb5510049eb0c5ca2221249cf9d562d329576549156032a4be204427afba9ac8f51b596

                                      • C:\providercommon\1zu9dW.bat

                                        Filesize

                                        36B

                                        MD5

                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                        SHA1

                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                        SHA256

                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                        SHA512

                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                      • C:\providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                        Filesize

                                        197B

                                        MD5

                                        8088241160261560a02c84025d107592

                                        SHA1

                                        083121f7027557570994c9fc211df61730455bb5

                                        SHA256

                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                        SHA512

                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                      • memory/544-15-0x0000000003030000-0x000000000303C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/544-12-0x00007FFAB0FE3000-0x00007FFAB0FE5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/544-13-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/544-17-0x0000000003040000-0x000000000304C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/544-16-0x0000000003020000-0x000000000302C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/544-14-0x0000000002EB0000-0x0000000002EC2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/1508-40-0x0000022DAC270000-0x0000022DAC292000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/2372-158-0x000000001D740000-0x000000001D8E9000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2372-159-0x000000001D740000-0x000000001D8E9000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2428-108-0x000000001D440000-0x000000001D452000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2528-144-0x000000001D080000-0x000000001D229000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2912-133-0x000000001B9F0000-0x000000001BA02000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/3024-99-0x000000001BFF0000-0x000000001C002000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/3024-105-0x000000001DD60000-0x000000001DF09000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/3024-104-0x000000001DCB0000-0x000000001DD51000-memory.dmp

                                        Filesize

                                        644KB

                                      • memory/3404-169-0x000000001ADF0000-0x000000001AE02000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/3404-175-0x000000001D340000-0x000000001D4E9000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/3600-166-0x000000001DB80000-0x000000001DD29000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/4388-90-0x00000000013F0000-0x0000000001402000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/4620-151-0x000000001D640000-0x000000001D7E9000-memory.dmp

                                        Filesize

                                        1.7MB