Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 02:41

General

  • Target

    JaffaCakes118_610dc47db4ca9cc504499989b9b2a88e97f8f903c9f3556c75c17e46d9daea63.exe

  • Size

    1.3MB

  • MD5

    fe0dfa3dbd245726c680f9ec5b209a56

  • SHA1

    2e27d696e504e35e57d72b4daaa404ece2cc2ced

  • SHA256

    610dc47db4ca9cc504499989b9b2a88e97f8f903c9f3556c75c17e46d9daea63

  • SHA512

    e62de4d83bc3be3e970bfc5895802677d6c9a2c414ce42e63fabc042601ec8bd8451a64ac3e17ea3764b2c35c13bfbec671cd62b4cff321e740120fbb7ef10f7

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_610dc47db4ca9cc504499989b9b2a88e97f8f903c9f3556c75c17e46d9daea63.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_610dc47db4ca9cc504499989b9b2a88e97f8f903c9f3556c75c17e46d9daea63.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3980
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2832
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4764
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1716
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:632
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4464
          • C:\Windows\L2Schemas\RuntimeBroker.exe
            "C:\Windows\L2Schemas\RuntimeBroker.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3080
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jk1vLt9ke4.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2592
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:2036
                • C:\Windows\L2Schemas\RuntimeBroker.exe
                  "C:\Windows\L2Schemas\RuntimeBroker.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4536
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2892
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:3856
                      • C:\Windows\L2Schemas\RuntimeBroker.exe
                        "C:\Windows\L2Schemas\RuntimeBroker.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1488
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nc51i3GWIc.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4444
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:1124
                            • C:\Windows\L2Schemas\RuntimeBroker.exe
                              "C:\Windows\L2Schemas\RuntimeBroker.exe"
                              11⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:760
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat"
                                12⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4736
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  13⤵
                                    PID:3052
                                  • C:\Windows\L2Schemas\RuntimeBroker.exe
                                    "C:\Windows\L2Schemas\RuntimeBroker.exe"
                                    13⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:804
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hD3D8PLBZ9.bat"
                                      14⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4752
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        15⤵
                                          PID:2592
                                        • C:\Windows\L2Schemas\RuntimeBroker.exe
                                          "C:\Windows\L2Schemas\RuntimeBroker.exe"
                                          15⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:548
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DhSpfyjZaR.bat"
                                            16⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1092
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              17⤵
                                                PID:3068
                                              • C:\Windows\L2Schemas\RuntimeBroker.exe
                                                "C:\Windows\L2Schemas\RuntimeBroker.exe"
                                                17⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:1356
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat"
                                                  18⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4464
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    19⤵
                                                      PID:4792
                                                    • C:\Windows\L2Schemas\RuntimeBroker.exe
                                                      "C:\Windows\L2Schemas\RuntimeBroker.exe"
                                                      19⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:912
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6uMgbjYtd5.bat"
                                                        20⤵
                                                          PID:2108
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            21⤵
                                                              PID:5032
                                                            • C:\Windows\L2Schemas\RuntimeBroker.exe
                                                              "C:\Windows\L2Schemas\RuntimeBroker.exe"
                                                              21⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4408
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"
                                                                22⤵
                                                                  PID:1720
                                                                  • C:\Windows\system32\w32tm.exe
                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                    23⤵
                                                                      PID:1920
                                                                    • C:\Windows\L2Schemas\RuntimeBroker.exe
                                                                      "C:\Windows\L2Schemas\RuntimeBroker.exe"
                                                                      23⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4524
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r7gOBUt9HL.bat"
                                                                        24⤵
                                                                          PID:5012
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            25⤵
                                                                              PID:4072
                                                                            • C:\Windows\L2Schemas\RuntimeBroker.exe
                                                                              "C:\Windows\L2Schemas\RuntimeBroker.exe"
                                                                              25⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3628
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9gHfnS8a2p.bat"
                                                                                26⤵
                                                                                  PID:3616
                                                                                  • C:\Windows\system32\w32tm.exe
                                                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                    27⤵
                                                                                      PID:2188
                                                                                    • C:\Windows\L2Schemas\RuntimeBroker.exe
                                                                                      "C:\Windows\L2Schemas\RuntimeBroker.exe"
                                                                                      27⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3540
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\RuntimeBroker.exe'" /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4204
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\L2Schemas\RuntimeBroker.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3648
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\L2Schemas\RuntimeBroker.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:720
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\RuntimeBroker.exe'" /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2476
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\RuntimeBroker.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:5000
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\RuntimeBroker.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1676
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3844
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4988
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4436
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2160
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1348
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3964

                                Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        baf55b95da4a601229647f25dad12878

                                        SHA1

                                        abc16954ebfd213733c4493fc1910164d825cac8

                                        SHA256

                                        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                        SHA512

                                        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                        Filesize

                                        2KB

                                        MD5

                                        d85ba6ff808d9e5444a4b369f5bc2730

                                        SHA1

                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                        SHA256

                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                        SHA512

                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        6d42b6da621e8df5674e26b799c8e2aa

                                        SHA1

                                        ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                        SHA256

                                        5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                        SHA512

                                        53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        6d3e9c29fe44e90aae6ed30ccf799ca8

                                        SHA1

                                        c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                        SHA256

                                        2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                        SHA512

                                        60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        d28a889fd956d5cb3accfbaf1143eb6f

                                        SHA1

                                        157ba54b365341f8ff06707d996b3635da8446f7

                                        SHA256

                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                        SHA512

                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                      • C:\Users\Admin\AppData\Local\Temp\6uMgbjYtd5.bat

                                        Filesize

                                        203B

                                        MD5

                                        cfce2f76d0b8efa79bf3db3efb210bc4

                                        SHA1

                                        b674322df2b7ead6236336602846bc2b76a35d61

                                        SHA256

                                        a0c5e14a53c080a36bab2405642b8b0255028d307c883716559fa9b9f5bf3184

                                        SHA512

                                        93cffa5109a6ec1b6fb94640c58da5f0ebeab37a7eb8f25ab58f5152a8f92ea467a38f6ddd91573042e5e87e260954605139235b129d66567973dc216eb69cc2

                                      • C:\Users\Admin\AppData\Local\Temp\9gHfnS8a2p.bat

                                        Filesize

                                        203B

                                        MD5

                                        1944bdc0a167b04b080823725d30e696

                                        SHA1

                                        5692225d4963951290f2d7d927187b44e7584daf

                                        SHA256

                                        4e591b203736f3e42cde75b44a6e6243daa380a2f3635177e2fe931327a25f2f

                                        SHA512

                                        7061b5e2d0bb7c4357f7c2eb02b04b485b5e8724bedf20d3882cf9a0548bb992d70b4bd115e9d2710d8e2101dc2f860e8c42a229a35051cfdfa45257383053aa

                                      • C:\Users\Admin\AppData\Local\Temp\DhSpfyjZaR.bat

                                        Filesize

                                        203B

                                        MD5

                                        b985a1350c4a361bdaef9ff3beb862fc

                                        SHA1

                                        debb44716d9c3daf9adddcf85d6fbd61f2be64f6

                                        SHA256

                                        7b01f9f9c53ab8e8cf664937a3779ffed2fd7c6f578a3c211e34f308774da143

                                        SHA512

                                        8077a1832d7f73f4d8e2f324767f256393782df1853b8151caaacb891cacc9865c0f73b4c14fd52aee98029688d7199a0ce136fcb07866a6374dd3888c0d6367

                                      • C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat

                                        Filesize

                                        203B

                                        MD5

                                        352575f50b7683c8770d27f4414d8dfc

                                        SHA1

                                        b8054ceacd26934b179ffe0aa232e80a968eed31

                                        SHA256

                                        dae34df6f926c620cb55503105c0fea38f218868ea429a64be4b0d11b662da00

                                        SHA512

                                        52e1a7f6aa3a3cfca110207d85d65c3b9e2a6a9fd2131f25a44f5a7a4355b3514f0cf6898ea003f6f89b649e9129b38b630a06ac675c0a37554daba26bb405c8

                                      • C:\Users\Admin\AppData\Local\Temp\Jk1vLt9ke4.bat

                                        Filesize

                                        203B

                                        MD5

                                        47987b0416eca7f3510460c5b3afc4c4

                                        SHA1

                                        303daf7d7a82109883b6936db5b29d0b24685a60

                                        SHA256

                                        b75c9ed45653ff933a91165e57b4ed5bc6a0707a4d6be659e1004c588270aa25

                                        SHA512

                                        08e1d149be32d2a390076a6142441624aac1a07d5b952164c19d81e96f4a4896f647d677ca2d9340ad0d700c7287b9b460aee6c6d97a6b15971dee9560d6c340

                                      • C:\Users\Admin\AppData\Local\Temp\Nc51i3GWIc.bat

                                        Filesize

                                        203B

                                        MD5

                                        3347ae1ad1048063fffb17185ba26d43

                                        SHA1

                                        4d78ac80397b86c0b28d7ce6e36fb2b245f71b69

                                        SHA256

                                        ae20c6b6327253961f66cf1ee0e63fbd15d5cd5063b8bff860c15712b108e449

                                        SHA512

                                        43aede19bb817d4ca7bb2e1ca6c1272c19107e31d9b3ee97927a1974c2a3677874db478f1e2805c78cb5fec95bcbfdd3b04a8e1e17c69f31ac11c05a7218be55

                                      • C:\Users\Admin\AppData\Local\Temp\UMOyPGkKXB.bat

                                        Filesize

                                        203B

                                        MD5

                                        c52e769f1840e88637273f111cc6a8e3

                                        SHA1

                                        d7dc57e758b50c664fda3a3e1bc7134bfd8ecac3

                                        SHA256

                                        a19c5c3738ad1a1961cf60705090479cbff3ab71c03e0a7ae69817a89017f1d3

                                        SHA512

                                        e53cee7f1e38ed68e6d945552f0bd46d6638664ae89fd0e3d767010c0defebcbb22f74ad337a66bae56b4c7efaa05705c0a64dde0c01a91b3fa0d3bd47cbc146

                                      • C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat

                                        Filesize

                                        203B

                                        MD5

                                        de8ffffe22cc9b7d4a2b800cc8170df4

                                        SHA1

                                        d7ee2c707a68cf2eab8e3255b127ffb0b52d12d2

                                        SHA256

                                        22f2eaa483137b2041b85d6048975058da81b539b04c963560e35cb5b3c136dc

                                        SHA512

                                        eefd88eb2f96270e58a85fc48bd91fde79b9406d86e0130b3fdd787d94d2ac88d885f2fa4b56d593708d856e0b24a20dd1220809809022010a9f083e84350c01

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_44wozfq0.yrc.ps1

                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      • C:\Users\Admin\AppData\Local\Temp\hD3D8PLBZ9.bat

                                        Filesize

                                        203B

                                        MD5

                                        6f2cc5a903ec69a2217a199622a3bdba

                                        SHA1

                                        4f5dfd6f749371cb28f439e5bd35a1fa7ceaa711

                                        SHA256

                                        508f236362eb5014b0a3fd3de154ca20b3c057ec2313a5de389217ca340a466d

                                        SHA512

                                        4a08374b21cebd9239ee00cb35401ca17583ed128f57588c1b7fa3dbd3cbce0293bf16a9bac9f85540667138d0af6e726c5517cc12cf22bdb25c5c1368396655

                                      • C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat

                                        Filesize

                                        203B

                                        MD5

                                        69b4618922176e29213a2048fec692ff

                                        SHA1

                                        70bd806ea05117ff6ad751ae7cf6b7b0dcda171b

                                        SHA256

                                        d6dc6b6f868e3318fe7f3bec87973bd0351cc745789ef611d492b2ed29cc2651

                                        SHA512

                                        38947074fb573cc075c628dea9b4fbc8974334107c9706d8c79d85c863e9ff45ca7b276b2fcbe5352f1094f490faec070df9fa2deb04dd440be3558c7b11dc61

                                      • C:\Users\Admin\AppData\Local\Temp\r7gOBUt9HL.bat

                                        Filesize

                                        203B

                                        MD5

                                        1db4aca792b78d8a9e7ba2c21048947c

                                        SHA1

                                        44e21d583a44f5d64497f2707616713cf41f8dbe

                                        SHA256

                                        7b50264d59f235151c45c93f20c85e5b830840ffca58583ca3eafc3babf6e72e

                                        SHA512

                                        652fbb441cd320fe656561b2cc8f5c0118a88887b58dfd6888b564c2c146955d177e6bc6454d2dbfdd4d9c93cdb65f215752a7630edcc7aa2b99ef3f3a7ec568

                                      • C:\providercommon\1zu9dW.bat

                                        Filesize

                                        36B

                                        MD5

                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                        SHA1

                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                        SHA256

                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                        SHA512

                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                      • C:\providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                        Filesize

                                        197B

                                        MD5

                                        8088241160261560a02c84025d107592

                                        SHA1

                                        083121f7027557570994c9fc211df61730455bb5

                                        SHA256

                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                        SHA512

                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                      • memory/632-51-0x000001FEF7C00000-0x000001FEF7C22000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/1488-113-0x000000001D740000-0x000000001D8E9000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/3980-12-0x00007FFEE6483000-0x00007FFEE6485000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3980-13-0x00000000008C0000-0x00000000009D0000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/3980-14-0x00000000012B0000-0x00000000012C2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/3980-15-0x00000000012C0000-0x00000000012CC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/3980-17-0x000000001BD10000-0x000000001BD1C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/3980-16-0x000000001B560000-0x000000001B56C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/4408-146-0x000000001B9F0000-0x000000001BA02000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/4524-153-0x000000001AFF0000-0x000000001B002000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/4536-106-0x000000001D840000-0x000000001D9E9000-memory.dmp

                                        Filesize

                                        1.7MB