Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/10/2023, 17:33

General

  • Target

    NEAS.f8b17c21dbf4da6ea15d7bbd0ee4a380.exe

  • Size

    1.1MB

  • MD5

    f8b17c21dbf4da6ea15d7bbd0ee4a380

  • SHA1

    07c61110827fdee71cdaade2498d717ba8651197

  • SHA256

    588530f4cba85b9874f6dd2b2a93ea052486147ef68cb9dfaaa32e450c180f48

  • SHA512

    cd8466ffeb42b423d74398ab4f18380192de8352a39652645407af17efaed8f6606a7537348f3ae6ff30439f7ef71678ecd09ed2a1fd5025e74b6a4b26ac3625

  • SSDEEP

    12288:El+4Tcyct/JWT7yckBlepmbMsBXYHOWyAh5+djVyKDGpiRe7FaS+ug82qGeJ3btU:Zyc5JWackYm7dZ1Oq2nn2qPJ3btV3+f

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 39 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 9 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 39 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.f8b17c21dbf4da6ea15d7bbd0ee4a380.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f8b17c21dbf4da6ea15d7bbd0ee4a380.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2300
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:340
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1816
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3508
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1340
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2844
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4148
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2456
    • C:\Users\All Users\Templates\RuntimeBroker.exe
      "C:\Users\All Users\Templates\RuntimeBroker.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:2544
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\lsass.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:980
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\lsass.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1388
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\lsass.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2172
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "NEAS.f8b17c21dbf4da6ea15d7bbd0ee4a380N" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\NEAS.f8b17c21dbf4da6ea15d7bbd0ee4a380.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1724
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "NEAS.f8b17c21dbf4da6ea15d7bbd0ee4a380" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\NEAS.f8b17c21dbf4da6ea15d7bbd0ee4a380.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2496
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "NEAS.f8b17c21dbf4da6ea15d7bbd0ee4a380N" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\NEAS.f8b17c21dbf4da6ea15d7bbd0ee4a380.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4196
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4744
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:500
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3104
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\spoolsv.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:676
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1080
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1028
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\LocalLow\Oracle\Java\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:756
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\AppData\LocalLow\Oracle\Java\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2836
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\LocalLow\Oracle\Java\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3668
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1332
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1340
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2884
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\backgroundTaskHost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4128
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\backgroundTaskHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1392
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\backgroundTaskHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:5072
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Templates\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4936
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Templates\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1072
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Templates\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1192
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\INF\UGTHRSVC\0410\dllhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4500
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\INF\UGTHRSVC\0410\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1156
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\INF\UGTHRSVC\0410\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3784
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4332
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2072
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3716
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\odt\sppsvc.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4008
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3564
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4020
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\TextInputHost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:436
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\TextInputHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4352
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Temp\TextInputHost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4520
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\odt\spoolsv.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1260
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:4600
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Windows Sidebar\Gadgets\NEAS.f8b17c21dbf4da6ea15d7bbd0ee4a380.exe

    Filesize

    1.1MB

    MD5

    d45dcb426afd43877078dd3974f1ccdc

    SHA1

    c7f0a143b322caf44cdc9ec73ff977ca0e1f9c5d

    SHA256

    fcacecf8e8b9cd6a6c3393675ffabf17dd563ff6dd9effbee492a4c9c56f9a67

    SHA512

    c994a8ba52155804340e4f50c8b8feda8eeec8d067f65a9a9c52500ed1da4222d4a69ba4a67770cae9afdeaf991d47ff3b83c89192d357f7c5af739bbd59302f

  • C:\Program Files\Microsoft Office 15\ClientX64\lsass.exe

    Filesize

    1.1MB

    MD5

    eda1d0ab33912c7ff8dd0a28d29e50f5

    SHA1

    21bff8dedec32f5155dc1fc4cfccd194e48eb9c4

    SHA256

    de9f781ce0b965e523d971f0277e3066f427ccc786454b3a345e2e8a18707c22

    SHA512

    8450ed65eeb7d356360b4b9f8ba3471382829f42abf8443fbb79634e8bb2d851c4289316dc13af670cd75ef7184977ffea4ec7796e1e078ba73836e4d685ecc6

  • C:\ProgramData\Microsoft\Windows\Templates\RuntimeBroker.exe

    Filesize

    1.1MB

    MD5

    f8b17c21dbf4da6ea15d7bbd0ee4a380

    SHA1

    07c61110827fdee71cdaade2498d717ba8651197

    SHA256

    588530f4cba85b9874f6dd2b2a93ea052486147ef68cb9dfaaa32e450c180f48

    SHA512

    cd8466ffeb42b423d74398ab4f18380192de8352a39652645407af17efaed8f6606a7537348f3ae6ff30439f7ef71678ecd09ed2a1fd5025e74b6a4b26ac3625

  • C:\Users\Admin\AppData\LocalLow\Oracle\Java\RuntimeBroker.exe

    Filesize

    1.1MB

    MD5

    f8b17c21dbf4da6ea15d7bbd0ee4a380

    SHA1

    07c61110827fdee71cdaade2498d717ba8651197

    SHA256

    588530f4cba85b9874f6dd2b2a93ea052486147ef68cb9dfaaa32e450c180f48

    SHA512

    cd8466ffeb42b423d74398ab4f18380192de8352a39652645407af17efaed8f6606a7537348f3ae6ff30439f7ef71678ecd09ed2a1fd5025e74b6a4b26ac3625

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    c6c940df49fc678d1c74fea3c57a32f9

    SHA1

    79edd715358a82e6d29970998ff2e9b235ea4217

    SHA256

    4e50925adb70141467a7081cc905c76fd6dab841195400683f9f67fc2602aa0a

    SHA512

    3c1df9c18f1756ead841f68916dec03a066078b0705443d3f886fd990e2e42ebbffd46916be3f6fe39ea0505fc2c848fbdea56828fbd5aa5f24b329f8d979707

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    c6c940df49fc678d1c74fea3c57a32f9

    SHA1

    79edd715358a82e6d29970998ff2e9b235ea4217

    SHA256

    4e50925adb70141467a7081cc905c76fd6dab841195400683f9f67fc2602aa0a

    SHA512

    3c1df9c18f1756ead841f68916dec03a066078b0705443d3f886fd990e2e42ebbffd46916be3f6fe39ea0505fc2c848fbdea56828fbd5aa5f24b329f8d979707

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    5f0ddc7f3691c81ee14d17b419ba220d

    SHA1

    f0ef5fde8bab9d17c0b47137e014c91be888ee53

    SHA256

    a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

    SHA512

    2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    61e06aa7c42c7b2a752516bcbb242cc1

    SHA1

    02c54f8b171ef48cad21819c20b360448418a068

    SHA256

    5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

    SHA512

    03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    61e06aa7c42c7b2a752516bcbb242cc1

    SHA1

    02c54f8b171ef48cad21819c20b360448418a068

    SHA256

    5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

    SHA512

    03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    61e06aa7c42c7b2a752516bcbb242cc1

    SHA1

    02c54f8b171ef48cad21819c20b360448418a068

    SHA256

    5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

    SHA512

    03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    61e06aa7c42c7b2a752516bcbb242cc1

    SHA1

    02c54f8b171ef48cad21819c20b360448418a068

    SHA256

    5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

    SHA512

    03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    5f0ddc7f3691c81ee14d17b419ba220d

    SHA1

    f0ef5fde8bab9d17c0b47137e014c91be888ee53

    SHA256

    a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

    SHA512

    2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    85502ce8813f7174d5989a982a473094

    SHA1

    767982aed807f5f28ad7037139db874adebae5ed

    SHA256

    df0b71db6a6f78fcea4a935928560506f0c099e75aba717fd04cc9226d720ec6

    SHA512

    224ba8f3fc1d9a04bceb006af989f2838f4253074ba58b9082c7761daa1067e9d742ae51212d9116c89bda346538e8806790121deacf67a1c7b4a81bc95e6f9f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    22fbec4acba323d04079a263526cef3c

    SHA1

    eb8dd0042c6a3f20087a7d2391eaf48121f98740

    SHA256

    020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

    SHA512

    fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3xxwcjcn.fvn.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\Downloads\RuntimeBroker.exe

    Filesize

    1.1MB

    MD5

    f2496d33118356831edaec71b14188ad

    SHA1

    0fdf093bfdcfaa593de4255f904d4b7aade617e2

    SHA256

    102392b5603caa03aafe5ba59c9a87be6b0fff0f05a473d86a25ca5879e9d369

    SHA512

    671b574ba4dae5e2947d11ea26193b0c1804927a9c064225e166f2e44b55edf63ee87abdfcf14912e373429034935d57c783f0e69fcda81eb6462dc2da0b3066

  • C:\Users\All Users\Templates\RuntimeBroker.exe

    Filesize

    1.1MB

    MD5

    f8b17c21dbf4da6ea15d7bbd0ee4a380

    SHA1

    07c61110827fdee71cdaade2498d717ba8651197

    SHA256

    588530f4cba85b9874f6dd2b2a93ea052486147ef68cb9dfaaa32e450c180f48

    SHA512

    cd8466ffeb42b423d74398ab4f18380192de8352a39652645407af17efaed8f6606a7537348f3ae6ff30439f7ef71678ecd09ed2a1fd5025e74b6a4b26ac3625

  • C:\Windows\INF\UGTHRSVC\0410\dllhost.exe

    Filesize

    1.1MB

    MD5

    bc87bd5826ff70d467fbfdfaa72bfc7d

    SHA1

    5bf47f9557d2827dd47102b1aa6cbf4aa8e12dbe

    SHA256

    4140686532f2c3d5c9044f5350d316d9a5a20ba73fda19801b86cda028e1ca5f

    SHA512

    8e2e731360bfcda2ccea5e63596836adf3ec2f2d83fff4ba2c346bdf20eb2641d99d92a89c80bdfe68b6e5b0f1837862f8c5f33233fd7a59b6f73c3ce09ac8ae

  • C:\odt\spoolsv.exe

    Filesize

    1.1MB

    MD5

    261e66bb4eb571b6e9038d5ea94d2d3e

    SHA1

    1e0d86abf3c406559ef9d4692717e7b21289579e

    SHA256

    6d120d2d4d143390b5470cae464f71c44122addf4845dfd670ad2f4dc58be9b3

    SHA512

    b9cef9958c8517fe1d120c7f4bd9d57dddfbde1275877c74138ce8a2cd9fafece4addb64198159ab2ba7db057814d31b415308fa00f97ebd95dd58e68564881b

  • memory/340-429-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/340-375-0x000001DA83FB0000-0x000001DA83FC0000-memory.dmp

    Filesize

    64KB

  • memory/340-404-0x000001DA83FB0000-0x000001DA83FC0000-memory.dmp

    Filesize

    64KB

  • memory/340-373-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/1340-388-0x000001DEEA270000-0x000001DEEA280000-memory.dmp

    Filesize

    64KB

  • memory/1340-256-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/1340-312-0x000001DEEA270000-0x000001DEEA280000-memory.dmp

    Filesize

    64KB

  • memory/1816-385-0x0000015590A40000-0x0000015590A50000-memory.dmp

    Filesize

    64KB

  • memory/1816-394-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/1816-386-0x0000015590A40000-0x0000015590A50000-memory.dmp

    Filesize

    64KB

  • memory/1936-427-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/1936-381-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/2104-302-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/2104-428-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/2104-402-0x0000026F7C530000-0x0000026F7C540000-memory.dmp

    Filesize

    64KB

  • memory/2104-389-0x0000026F7C530000-0x0000026F7C540000-memory.dmp

    Filesize

    64KB

  • memory/2104-340-0x0000026F7C530000-0x0000026F7C540000-memory.dmp

    Filesize

    64KB

  • memory/2300-108-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/2300-6-0x000000001AF80000-0x000000001AF8A000-memory.dmp

    Filesize

    40KB

  • memory/2300-1-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/2300-374-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/2300-150-0x000000001B000000-0x000000001B010000-memory.dmp

    Filesize

    64KB

  • memory/2300-0-0x0000000000230000-0x0000000000350000-memory.dmp

    Filesize

    1.1MB

  • memory/2300-2-0x000000001B000000-0x000000001B010000-memory.dmp

    Filesize

    64KB

  • memory/2300-8-0x000000001AFA0000-0x000000001AFAC000-memory.dmp

    Filesize

    48KB

  • memory/2300-7-0x000000001AF90000-0x000000001AF9C000-memory.dmp

    Filesize

    48KB

  • memory/2300-3-0x0000000002570000-0x000000000257E000-memory.dmp

    Filesize

    56KB

  • memory/2300-5-0x000000001AF70000-0x000000001AF80000-memory.dmp

    Filesize

    64KB

  • memory/2300-4-0x000000001AF60000-0x000000001AF68000-memory.dmp

    Filesize

    32KB

  • memory/2456-358-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/2456-371-0x0000022845900000-0x0000022845910000-memory.dmp

    Filesize

    64KB

  • memory/2456-372-0x0000022845900000-0x0000022845910000-memory.dmp

    Filesize

    64KB

  • memory/2456-416-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/2456-398-0x0000022845900000-0x0000022845910000-memory.dmp

    Filesize

    64KB

  • memory/2544-395-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/2844-382-0x0000020D3EDC0000-0x0000020D3EDD0000-memory.dmp

    Filesize

    64KB

  • memory/2844-380-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/2844-399-0x0000020D3EDC0000-0x0000020D3EDD0000-memory.dmp

    Filesize

    64KB

  • memory/2844-383-0x0000020D3EDC0000-0x0000020D3EDD0000-memory.dmp

    Filesize

    64KB

  • memory/2844-403-0x0000020D3EDC0000-0x0000020D3EDD0000-memory.dmp

    Filesize

    64KB

  • memory/3508-405-0x000001AFECCB0000-0x000001AFECCC0000-memory.dmp

    Filesize

    64KB

  • memory/3508-376-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/3508-377-0x000001AFECCB0000-0x000001AFECCC0000-memory.dmp

    Filesize

    64KB

  • memory/3508-390-0x000001AFECCB0000-0x000001AFECCC0000-memory.dmp

    Filesize

    64KB

  • memory/3516-246-0x0000024461720000-0x0000024461742000-memory.dmp

    Filesize

    136KB

  • memory/3516-393-0x0000024461760000-0x0000024461770000-memory.dmp

    Filesize

    64KB

  • memory/3516-384-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/3516-401-0x0000024461760000-0x0000024461770000-memory.dmp

    Filesize

    64KB

  • memory/3516-421-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/3516-397-0x0000024461760000-0x0000024461770000-memory.dmp

    Filesize

    64KB

  • memory/3668-241-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/3668-387-0x00000243342F0000-0x0000024334300000-memory.dmp

    Filesize

    64KB

  • memory/3668-243-0x00000243342F0000-0x0000024334300000-memory.dmp

    Filesize

    64KB

  • memory/3668-422-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/3668-242-0x00000243342F0000-0x0000024334300000-memory.dmp

    Filesize

    64KB

  • memory/3668-391-0x00000243342F0000-0x0000024334300000-memory.dmp

    Filesize

    64KB

  • memory/4128-396-0x00000214652E0000-0x00000214652F0000-memory.dmp

    Filesize

    64KB

  • memory/4128-245-0x00000214652E0000-0x00000214652F0000-memory.dmp

    Filesize

    64KB

  • memory/4128-244-0x00000214652E0000-0x00000214652F0000-memory.dmp

    Filesize

    64KB

  • memory/4128-415-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/4128-392-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/4148-378-0x00007FF9E4570000-0x00007FF9E5031000-memory.dmp

    Filesize

    10.8MB

  • memory/4148-379-0x00000161C2B50000-0x00000161C2B60000-memory.dmp

    Filesize

    64KB

  • memory/4148-400-0x00000161C2B50000-0x00000161C2B60000-memory.dmp

    Filesize

    64KB