Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 02:01

General

  • Target

    JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe

  • Size

    1.3MB

  • MD5

    92452d3cad4b0b6f9b05999e91f26014

  • SHA1

    94eb891634ae49a17bf9c08eca44c3b57e6dfa82

  • SHA256

    b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a

  • SHA512

    2fcd37960b45a2022ccaaff5ddb2043cad8965f8a200105a2f5e439f11cfbb8517db2b7420ffecde65bdc1ecd0ce745d3dd0be290016f9b7ed8ffa9b90871e7e

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b9fe092e0d15cefd3f03fda32ef261466b6c2aaf424462718468439bf50ff09a.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5080
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:872
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1700
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1420
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1532
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4992
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SoftwareDistribution\Download\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4956
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PoxOxlpmGs.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:816
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:4468
              • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4780
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PJw82jcrZC.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4736
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:3388
                    • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                      "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4928
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ewVMycoP0v.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3364
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:3004
                          • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                            "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                            10⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1976
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1hmmkqxEk5.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4204
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:2736
                                • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                                  "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                                  12⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:732
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\unLkZH0FaU.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4360
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:4780
                                      • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                                        "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                                        14⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:1548
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat"
                                          15⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2588
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            16⤵
                                              PID:808
                                            • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                                              "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                                              16⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:3484
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b9aNmsEibB.bat"
                                                17⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:3196
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  18⤵
                                                    PID:3964
                                                  • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                                                    "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                                                    18⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4220
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xjNnGM38uG.bat"
                                                      19⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2864
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        20⤵
                                                          PID:3824
                                                        • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                                                          "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                                                          20⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1544
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat"
                                                            21⤵
                                                              PID:3772
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                22⤵
                                                                  PID:1500
                                                                • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                                                                  "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                                                                  22⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4752
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CMv1BFFgLz.bat"
                                                                    23⤵
                                                                      PID:1280
                                                                      • C:\Windows\system32\w32tm.exe
                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                        24⤵
                                                                          PID:1208
                                                                        • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                                                                          "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                                                                          24⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4784
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\srJhtCwLGi.bat"
                                                                            25⤵
                                                                              PID:2572
                                                                              • C:\Windows\system32\w32tm.exe
                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                26⤵
                                                                                  PID:864
                                                                                • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                                                                                  "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                                                                                  26⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4988
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VF9LbKHiRa.bat"
                                                                                    27⤵
                                                                                      PID:3344
                                                                                      • C:\Windows\system32\w32tm.exe
                                                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                        28⤵
                                                                                          PID:3048
                                                                                        • C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe
                                                                                          "C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe"
                                                                                          28⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1980
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LW19r029AS.bat"
                                                                                            29⤵
                                                                                              PID:3088
                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                30⤵
                                                                                                  PID:1740
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\csrss.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3488
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\csrss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4416
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\csrss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4184
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3840
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2488
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\DllCommonsvc.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3048
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3752
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2956
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3364
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\SoftwareDistribution\Download\RuntimeBroker.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1852
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\Download\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:748
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\SoftwareDistribution\Download\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2352

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                                              Filesize

                                              1KB

                                              MD5

                                              7f3c0ae41f0d9ae10a8985a2c327b8fb

                                              SHA1

                                              d58622bf6b5071beacf3b35bb505bde2000983e3

                                              SHA256

                                              519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

                                              SHA512

                                              8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                              Filesize

                                              2KB

                                              MD5

                                              d85ba6ff808d9e5444a4b369f5bc2730

                                              SHA1

                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                              SHA256

                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                              SHA512

                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              4d7e609eb8e2f1d595c8202f1ec6eb23

                                              SHA1

                                              9331edf68376270c2b034bc3f0ece25d96090c51

                                              SHA256

                                              52605303f5748e2d9d7d3d9ecff34bb221af254800d28db8d06fe486fb14b29b

                                              SHA512

                                              a1d7a745cc7b043d1d84248d7d3473244bc3c2681a288a7b7a877536ac973ea86246ae82da80b461a6442c0d6f60c731b2e6e0955f1ffe0a34edb008f13d226c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              77d622bb1a5b250869a3238b9bc1402b

                                              SHA1

                                              d47f4003c2554b9dfc4c16f22460b331886b191b

                                              SHA256

                                              f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                              SHA512

                                              d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                            • C:\Users\Admin\AppData\Local\Temp\1hmmkqxEk5.bat

                                              Filesize

                                              219B

                                              MD5

                                              2f039541a41418d80700c7262c0e5e24

                                              SHA1

                                              ecc122048a8492136186778556aa10d7899fd8dd

                                              SHA256

                                              c778c8efbaf8be6ce4a38614ed7bd87e5fd7018a9487369ba199aeb0bf96ed45

                                              SHA512

                                              c74dd60fd7a30c2c41518483200eafb2c04485a1e55f4c4973eb42901545014720e94d8477c478b8165a13d56ae633026f285576f35540b86eff7f9a425c055b

                                            • C:\Users\Admin\AppData\Local\Temp\CMv1BFFgLz.bat

                                              Filesize

                                              219B

                                              MD5

                                              8b0e46c2e7ea8ac5ad500b4c426b7545

                                              SHA1

                                              51a64cf20e73c679d08b2d71b9f0f10d6113ca63

                                              SHA256

                                              8930d75c52563fa25b699d3291db7b97bd3859efca0932835d0957f87d756fdd

                                              SHA512

                                              8a12036e00c0678c161600c203171aa28bf7a188175ab56bcb2196c8c0543f3df6d85b7117704e23718303881d47f148e0afce669f19cf85edc943dc67ff234d

                                            • C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat

                                              Filesize

                                              219B

                                              MD5

                                              e7317b80a2dedbc168a8243bda9e5d42

                                              SHA1

                                              c90deb4ab0d17081690d3c9eedf69b69a5d5ef2c

                                              SHA256

                                              15136d73c8aa8b655bd31f276d4794efeed5d2f7a2f876ef7a557eac6b69ad24

                                              SHA512

                                              8a18216e8973585bc1a0f739b732d4253f054a6fe8504ff0842e347f98d7a5223cbc72e256f3477690f022774f80aeecfaf0746bb401a85ec7df2104c27c270b

                                            • C:\Users\Admin\AppData\Local\Temp\LW19r029AS.bat

                                              Filesize

                                              219B

                                              MD5

                                              8990e6afcb099c800ac4a084f1869500

                                              SHA1

                                              a880b4873e46f8c1a5804adb3fca5a1ae167d16f

                                              SHA256

                                              b8ecaf076b2f817554045ee11460210dd47d3fd16e1b9e5f6fa06cf9def4f0e9

                                              SHA512

                                              abbf3c17d155869c55e4bf15cb3076a60389646e598bbe058464829fba1b15173b326308418796900614487e67e9507adccd796627d704ad3492630ef676de9e

                                            • C:\Users\Admin\AppData\Local\Temp\PJw82jcrZC.bat

                                              Filesize

                                              219B

                                              MD5

                                              d3f4eb4b2a764090f9f1dd3587183d15

                                              SHA1

                                              3156518b124411f5a8747955e9eca5b78ccc9bca

                                              SHA256

                                              c39d64bbdd4bf6cd3654fc25e95db744068772e9d2e41f30f7cac7406f9c2844

                                              SHA512

                                              c11f12c5a804331f05c11fc6beab0d4dc068246dc1eb78e1734b61bc469afac2d03d60597d19a081fe502172f268aea0f00e4552621ebd9dd9c520836fac1331

                                            • C:\Users\Admin\AppData\Local\Temp\PoxOxlpmGs.bat

                                              Filesize

                                              219B

                                              MD5

                                              47ad534dd987e6181d674af227db8a4c

                                              SHA1

                                              574b80093deaa58258d78ff6e57e8640660a0113

                                              SHA256

                                              0f9c50572ba5031d475059a879748d039675c9e41e0488cc546b4668db2e417c

                                              SHA512

                                              0a1f36b0f0d8818b41ceec438c613f2d0da572eb7483ee4d535c25f1ef100f8d765b49e735184d3fe7669ac2366b4de46d54a583e7830cec60bb931a658ddfbd

                                            • C:\Users\Admin\AppData\Local\Temp\VF9LbKHiRa.bat

                                              Filesize

                                              219B

                                              MD5

                                              4acf1f3c2b78b76bccfacccea49edca4

                                              SHA1

                                              684497969639ca6ee2ef0c3f50c049cad749d24b

                                              SHA256

                                              ac284dc4c4cb3a5c99af213f8a0ff43ebc77022972611b1ce7e8032b8e568a20

                                              SHA512

                                              3a213be97927447756a12aa16e62498095ebb7aaab9803d4ddae9597c436870abcac5b12b5724f3ce00c7f05b70969a15213764199ba72f1e24b9637ccc9deb5

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0i24r0qw.snw.ps1

                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            • C:\Users\Admin\AppData\Local\Temp\b9aNmsEibB.bat

                                              Filesize

                                              219B

                                              MD5

                                              606f9a52900a4b1334743c41d3f40d1e

                                              SHA1

                                              226ab80a9111a019a217c1bd13e438db52c0bb82

                                              SHA256

                                              f3905e33262669b500fd5a3d3a6c984fb089d5a180762883c7695cafe36e03fb

                                              SHA512

                                              468e749c57034be388f9a4f8726f026d70f851293b535f5e73fff5f1cd197cdb8a0b2f4a3b3d70d9b4655c3b79103dc0df61c3a16939bc0ae120c877ebd88bba

                                            • C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat

                                              Filesize

                                              219B

                                              MD5

                                              4a3659e6b9df8abc3b98beb0d8db2fb9

                                              SHA1

                                              a27b18d20e5289d16a3c7e9fee7c8ab8ef6bf18b

                                              SHA256

                                              f1dbdc5d8f2121ceada9a561545088a582c0457b22a65e827c50387175e61324

                                              SHA512

                                              2e45656057c44e436cad2a8ecd8ef4971f55b0ce7c105e38dd8c8c4b01be0c3f165e122217a87814edd2b9f534821e1f5b20e20c3171ba18511d11bad7f77f24

                                            • C:\Users\Admin\AppData\Local\Temp\ewVMycoP0v.bat

                                              Filesize

                                              219B

                                              MD5

                                              9140e0b99a5d8817f3b7e3b55c72a2f1

                                              SHA1

                                              9dd9cab2da2340887d54bde605cb6a0bc77842e3

                                              SHA256

                                              29ac0dc9d4f412b0c5648f4e1d010a77db548f5f5aefd58e81059e7b26cb291a

                                              SHA512

                                              0427228997384c5bb9141ee0270f29d5519a8a2dfee743e26ee1f3bbd305be33daf02a04c0f53835682ee863b47b87114366f695324a46f53b49d856f838c84d

                                            • C:\Users\Admin\AppData\Local\Temp\srJhtCwLGi.bat

                                              Filesize

                                              219B

                                              MD5

                                              f92de639a97170c3689120d7f70b7ce2

                                              SHA1

                                              b110b2f1129f1f2bc01ff8cf7b8d8e6852bdb7af

                                              SHA256

                                              60a082715bfe9c2f68d16cfab27dd11ffff69f4dd62e05b80ae96c452c2ea8fa

                                              SHA512

                                              4067632d8b2292b6aa5e2c32fbe89ef76f5dbfea32d200ff34632d576de4cd9b905727477986ed7b0cc7e9931eee9c7b6584b5c22517c4bd2ba307c7fe819b1f

                                            • C:\Users\Admin\AppData\Local\Temp\unLkZH0FaU.bat

                                              Filesize

                                              219B

                                              MD5

                                              fbb6a20eec95c129ac19f70eb802bb7f

                                              SHA1

                                              1cd47aa23fac8671b992686e95cfea3bf9dfd209

                                              SHA256

                                              df19680965d9c32ffa9e2a35aadc9b5429a0e8e3061d110b4c05370ee7726c08

                                              SHA512

                                              f4a28706756c36b253fe27fa85f538f0470a53166cf18df28703fa5838a6482b02f2f00ea03d582c780ab4553435a66620d0d1a699a007a9c8a8a63ae051696f

                                            • C:\Users\Admin\AppData\Local\Temp\xjNnGM38uG.bat

                                              Filesize

                                              219B

                                              MD5

                                              e21556717472069726cee581f62cf5a1

                                              SHA1

                                              235c888a35688706d2c218d29a292f368c6789d2

                                              SHA256

                                              4e447f41c65c5aae4825fdd4552764a7dde919dc65c8aaa5bf1d797b80082972

                                              SHA512

                                              d673146011fc1b14c658561eb543e0769b09cdb0e9780d0319a5295b9d1e9575f646206ada1b94dfe08174759ed423753d283e87b27b0e09ac8192340a7962ac

                                            • C:\providercommon\1zu9dW.bat

                                              Filesize

                                              36B

                                              MD5

                                              6783c3ee07c7d151ceac57f1f9c8bed7

                                              SHA1

                                              17468f98f95bf504cc1f83c49e49a78526b3ea03

                                              SHA256

                                              8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                              SHA512

                                              c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                            • C:\providercommon\DllCommonsvc.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                              Filesize

                                              197B

                                              MD5

                                              8088241160261560a02c84025d107592

                                              SHA1

                                              083121f7027557570994c9fc211df61730455bb5

                                              SHA256

                                              2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                              SHA512

                                              20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                            • memory/732-112-0x00000000028C0000-0x00000000028D2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/872-15-0x0000000002800000-0x000000000280C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/872-16-0x0000000002790000-0x000000000279C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/872-14-0x0000000002780000-0x0000000002792000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/872-13-0x0000000000600000-0x0000000000710000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/872-12-0x00007FFBA0323000-0x00007FFBA0325000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/872-17-0x0000000002810000-0x000000000281C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/4784-149-0x0000000003180000-0x0000000003192000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/4928-99-0x0000000003010000-0x0000000003022000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/4956-45-0x0000013707340000-0x0000013707362000-memory.dmp

                                              Filesize

                                              136KB