Overview

overview

10

Static

static

10

NEAS.958a2...00.exe

windows7-x64

10

NEAS.958a2...00.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2023 02:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.958a297912778bfedf7f5c8f4e270900.exe

  • Size

    1.4MB

  • MD5

    958a297912778bfedf7f5c8f4e270900

  • SHA1

    22d2e9dca6983ba173b6c9e48e22324467454ec2

  • SHA256

    366f45d064951e8dd798c64542ef1ee608f501b95f2839e28bfd9fba69cde067

  • SHA512

    182980b100be670d9598f0ce2fc71fc868a16ed27663f5182297912b8e0deb1464dd00840f5fc663e3495f1f78076dfcf787e5f5f4b99cf9bd02b816486ffdf4

  • SSDEEP

    24576:qBBkOlRe8ZcXPuCyRdaN1yV/vELneAcCg8:uOOy8eEa1Jct8

Score
10/10
dcratevasioninfostealerrattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 12 IoCs
    evasiontrojan
  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.958a297912778bfedf7f5c8f4e270900.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.958a297912778bfedf7f5c8f4e270900.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3620
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3896
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5092
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2908
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1460
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:812
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2300
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2868
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4824
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4920
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4940
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vyR16pqISe.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:5328
        • C:\odt\RuntimeBroker.exe
          "C:\odt\RuntimeBroker.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:5972
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3ce4aab-cb18-4dbd-90b7-96ddf133c0f2.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4792
            • C:\odt\RuntimeBroker.exe
              C:\odt\RuntimeBroker.exe
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:5328
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2df41c72-316b-47bf-9b08-a1000d97f378.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:6104
                • C:\odt\RuntimeBroker.exe
                  C:\odt\RuntimeBroker.exe
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4340
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc0ddbb5-9078-4864-8a59-58bbe6d333c1.vbs"
                    8⤵
                      PID:2416
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f2e9e3f-0989-44de-b7e4-8a15c91fad47.vbs"
                      8⤵
                        PID:4780
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b12347fc-1162-4916-a2b8-b4548cb90b14.vbs"
                    6⤵
                      PID:5144
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6592e8b8-58c6-44c8-99f1-7bff89a9f47d.vbs"
                  4⤵
                    PID:5156
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\odt\RuntimeBroker.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:4944
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:4832
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:3912
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\csrss.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:3428
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\csrss.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:4988
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\csrss.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:4024
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\csrss.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:4308
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\csrss.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:4328
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\csrss.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:3764
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellExperiences\taskhostw.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:312
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\taskhostw.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:624
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\ShellExperiences\taskhostw.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:3104
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\ssh\smss.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:4304
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\ssh\smss.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:620
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\ssh\smss.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:2272
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\winlogon.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:1588
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\Templates\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:440
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Creates scheduled task(s)
              PID:628

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\ssh\smss.exe
              Filesize

              1.4MB

              MD5

              958a297912778bfedf7f5c8f4e270900

              SHA1

              22d2e9dca6983ba173b6c9e48e22324467454ec2

              SHA256

              366f45d064951e8dd798c64542ef1ee608f501b95f2839e28bfd9fba69cde067

              SHA512

              182980b100be670d9598f0ce2fc71fc868a16ed27663f5182297912b8e0deb1464dd00840f5fc663e3495f1f78076dfcf787e5f5f4b99cf9bd02b816486ffdf4

              Download Submit

            • C:\ProgramData\ssh\smss.exe
              Filesize

              1.4MB

              MD5

              2d063502aeed652af61f13449b8172ec

              SHA1

              9a4aab6e4b5f42231f18649af5c8a3f3780bb470

              SHA256

              6827553732570c02c72175385025d27e2491d21225b4c5694dd9c957f844acb9

              SHA512

              f5fbdcf60e3e9f07ff71bcad62ec5cb36c928bf378bd345e060899d954388af7fb07328643257762ccd3a76dcebf8cc8b8fd8e3869e5b812f80933e88f92f605

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
              Filesize

              1KB

              MD5

              9b0256da3bf9a5303141361b3da59823

              SHA1

              d73f34951777136c444eb2c98394f62912ebcdac

              SHA256

              96cbc3f4e49d7ae13cd46e36ebb4819b6db1eabe5db910902638c1a24947208e

              SHA512

              9f014fef4b1bb71dbdd1d0bad11bd20437a9801eaa830ab386f901f6b5be374a26f68161d7638ea03483028e9a56bf97023cc24b45356a9c76cb755a53d9c164

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              3a6bad9528f8e23fb5c77fbd81fa28e8

              SHA1

              f127317c3bc6407f536c0f0600dcbcf1aabfba36

              SHA256

              986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

              SHA512

              846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              3a6bad9528f8e23fb5c77fbd81fa28e8

              SHA1

              f127317c3bc6407f536c0f0600dcbcf1aabfba36

              SHA256

              986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

              SHA512

              846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              3a6bad9528f8e23fb5c77fbd81fa28e8

              SHA1

              f127317c3bc6407f536c0f0600dcbcf1aabfba36

              SHA256

              986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

              SHA512

              846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              5f0ddc7f3691c81ee14d17b419ba220d

              SHA1

              f0ef5fde8bab9d17c0b47137e014c91be888ee53

              SHA256

              a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

              SHA512

              2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              5f0ddc7f3691c81ee14d17b419ba220d

              SHA1

              f0ef5fde8bab9d17c0b47137e014c91be888ee53

              SHA256

              a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

              SHA512

              2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              764B

              MD5

              474c87505a924ffe1f70286f2bbe32ba

              SHA1

              7938e703bcc87a04af02e95f690d8a8ad81d21ce

              SHA256

              7cfba30dd9575c8f87c5b55636a9f05d47462e268db474687ee9729e86fcfd71

              SHA512

              0804ea49b49a10a8002d3a4ee6008cb0983df8c059601d87f3ad3bf7b6352475f91b0977e2600cf253fc650814fa2cba0b5d2860998caf6074bf225a72a4eb5b

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              5f0ddc7f3691c81ee14d17b419ba220d

              SHA1

              f0ef5fde8bab9d17c0b47137e014c91be888ee53

              SHA256

              a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

              SHA512

              2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              764B

              MD5

              474c87505a924ffe1f70286f2bbe32ba

              SHA1

              7938e703bcc87a04af02e95f690d8a8ad81d21ce

              SHA256

              7cfba30dd9575c8f87c5b55636a9f05d47462e268db474687ee9729e86fcfd71

              SHA512

              0804ea49b49a10a8002d3a4ee6008cb0983df8c059601d87f3ad3bf7b6352475f91b0977e2600cf253fc650814fa2cba0b5d2860998caf6074bf225a72a4eb5b

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              a8e8360d573a4ff072dcc6f09d992c88

              SHA1

              3446774433ceaf0b400073914facab11b98b6807

              SHA256

              bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

              SHA512

              4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              a8e8360d573a4ff072dcc6f09d992c88

              SHA1

              3446774433ceaf0b400073914facab11b98b6807

              SHA256

              bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

              SHA512

              4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              a8e8360d573a4ff072dcc6f09d992c88

              SHA1

              3446774433ceaf0b400073914facab11b98b6807

              SHA256

              bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

              SHA512

              4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              a8e8360d573a4ff072dcc6f09d992c88

              SHA1

              3446774433ceaf0b400073914facab11b98b6807

              SHA256

              bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

              SHA512

              4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\2df41c72-316b-47bf-9b08-a1000d97f378.vbs
              Filesize

              700B

              MD5

              3a049539b531cc4d9776e82b5521972f

              SHA1

              0ba1af909a6e028adc5eaec497ae243acd3a088d

              SHA256

              5095b0d84d68f04890ffd7db8e29a5dc27468ca78a1eabaf55f722328d3c40e6

              SHA512

              7b0889228db9ed217060777b9e8a6b226c95226888d28aa713eb8a3a2cbbea8b88f36e03e1f7995255cd7f1feb6e55b18cc687fe454e4c4971ddce6c3150fc76

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\5f2e9e3f-0989-44de-b7e4-8a15c91fad47.vbs
              Filesize

              476B

              MD5

              9b043631051a15a4e4dfac163fe3ab36

              SHA1

              3c7ff6d1e636714eb85842f70d375d38b7ac26cf

              SHA256

              f0ed8860f9f1d02c18f7e2432c5eca104162d43a7be8e70f16ffe1ca4b73ae9b

              SHA512

              3a3cec5a58981def8c6ecdb5546b2fd2dcdd2eb54224f4fe0892fcfcc25ee33f5b7fece1d141a27ffc0f9e53acab5c9126cf482526b0fffb040f897a8d8facbb

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\6592e8b8-58c6-44c8-99f1-7bff89a9f47d.vbs
              Filesize

              476B

              MD5

              9b043631051a15a4e4dfac163fe3ab36

              SHA1

              3c7ff6d1e636714eb85842f70d375d38b7ac26cf

              SHA256

              f0ed8860f9f1d02c18f7e2432c5eca104162d43a7be8e70f16ffe1ca4b73ae9b

              SHA512

              3a3cec5a58981def8c6ecdb5546b2fd2dcdd2eb54224f4fe0892fcfcc25ee33f5b7fece1d141a27ffc0f9e53acab5c9126cf482526b0fffb040f897a8d8facbb

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qw22qpou.uaf.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\b12347fc-1162-4916-a2b8-b4548cb90b14.vbs
              Filesize

              476B

              MD5

              9b043631051a15a4e4dfac163fe3ab36

              SHA1

              3c7ff6d1e636714eb85842f70d375d38b7ac26cf

              SHA256

              f0ed8860f9f1d02c18f7e2432c5eca104162d43a7be8e70f16ffe1ca4b73ae9b

              SHA512

              3a3cec5a58981def8c6ecdb5546b2fd2dcdd2eb54224f4fe0892fcfcc25ee33f5b7fece1d141a27ffc0f9e53acab5c9126cf482526b0fffb040f897a8d8facbb

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\b12347fc-1162-4916-a2b8-b4548cb90b14.vbs
              Filesize

              476B

              MD5

              9b043631051a15a4e4dfac163fe3ab36

              SHA1

              3c7ff6d1e636714eb85842f70d375d38b7ac26cf

              SHA256

              f0ed8860f9f1d02c18f7e2432c5eca104162d43a7be8e70f16ffe1ca4b73ae9b

              SHA512

              3a3cec5a58981def8c6ecdb5546b2fd2dcdd2eb54224f4fe0892fcfcc25ee33f5b7fece1d141a27ffc0f9e53acab5c9126cf482526b0fffb040f897a8d8facbb

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\dc0ddbb5-9078-4864-8a59-58bbe6d333c1.vbs
              Filesize

              700B

              MD5

              18893675445f67176ff1a85546889b5b

              SHA1

              6efc1a37b7c48c5a76adb3515fe625901277591e

              SHA256

              0d1d6a532f144c8197de3a7a467efb1f5b66b44c101c656bd4bef75b58f9f9c2

              SHA512

              f7a278b81d960dfff7f55a4c8e7f3227eef82acf2c4d9bd68a65c0fb03510aef0fab215085fc739f1c2c3c1f64ab73b671d63a8a4b8f6db80604236be0d735a5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\f3ce4aab-cb18-4dbd-90b7-96ddf133c0f2.vbs
              Filesize

              700B

              MD5

              21be3b2f1294ca757fd0cf52022c0b4d

              SHA1

              da3e34ee9b45b875771e2a422392a1ec61c3b6ec

              SHA256

              9d67bf0cf1e1e2e62f51d6ee71138ce19aecf5baf862f89723b8b614a5ef9ab0

              SHA512

              f13371d4912116193abe0ada1fdd6b003c4436d3309c5662fa55a10ec84d0516e0c851bc8a0c096eff89923472d72cae83e19a9d30796ecfa824fd5e5cc69f47

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vyR16pqISe.bat
              Filesize

              189B

              MD5

              72e1777da41ace2d4d004a78d7360bde

              SHA1

              29d77241a1724239566cfec66e3acb96edcaa884

              SHA256

              d387c311f0de7ad2b016831abe67a9f9e84bb33cf7500ae0c3636898af9c6bdf

              SHA512

              51dac385995db62702e78a3dfef40cebfeddf9c06d338fcba67ba3fe3fb3609dddcfee4453e301a88413f96ac53eb3e6dac8a181314dc0aa3d207ef144c7a7fa

              Download Submit

            • C:\Windows\ShellExperiences\taskhostw.exe
              Filesize

              1.4MB

              MD5

              c23276532db2a008be262b70b9df0f09

              SHA1

              7910b5d5552bfacd999a46d796c44bace5adce77

              SHA256

              4e6cf66ccecaec97a5cc8027d7d1790c586847f8db0b074c051f46a454347263

              SHA512

              2599088c880fc25f92b32ce075f5da3dbaff52ce1a50aed6a4535275dfdf6be1f16c8652db1cff560322afe9b4dcd7e38bbb4b747b9befd1fd47aaae0559a118

              Download Submit

            • C:\odt\RuntimeBroker.exe
              Filesize

              1.4MB

              MD5

              958a297912778bfedf7f5c8f4e270900

              SHA1

              22d2e9dca6983ba173b6c9e48e22324467454ec2

              SHA256

              366f45d064951e8dd798c64542ef1ee608f501b95f2839e28bfd9fba69cde067

              SHA512

              182980b100be670d9598f0ce2fc71fc868a16ed27663f5182297912b8e0deb1464dd00840f5fc663e3495f1f78076dfcf787e5f5f4b99cf9bd02b816486ffdf4

              Download Submit

            • C:\odt\RuntimeBroker.exe
              Filesize

              1.4MB

              MD5

              958a297912778bfedf7f5c8f4e270900

              SHA1

              22d2e9dca6983ba173b6c9e48e22324467454ec2

              SHA256

              366f45d064951e8dd798c64542ef1ee608f501b95f2839e28bfd9fba69cde067

              SHA512

              182980b100be670d9598f0ce2fc71fc868a16ed27663f5182297912b8e0deb1464dd00840f5fc663e3495f1f78076dfcf787e5f5f4b99cf9bd02b816486ffdf4

              Download Submit

            • C:\odt\RuntimeBroker.exe
              Filesize

              1.4MB

              MD5

              958a297912778bfedf7f5c8f4e270900

              SHA1

              22d2e9dca6983ba173b6c9e48e22324467454ec2

              SHA256

              366f45d064951e8dd798c64542ef1ee608f501b95f2839e28bfd9fba69cde067

              SHA512

              182980b100be670d9598f0ce2fc71fc868a16ed27663f5182297912b8e0deb1464dd00840f5fc663e3495f1f78076dfcf787e5f5f4b99cf9bd02b816486ffdf4

              Download Submit

            • C:\odt\RuntimeBroker.exe
              Filesize

              1.4MB

              MD5

              958a297912778bfedf7f5c8f4e270900

              SHA1

              22d2e9dca6983ba173b6c9e48e22324467454ec2

              SHA256

              366f45d064951e8dd798c64542ef1ee608f501b95f2839e28bfd9fba69cde067

              SHA512

              182980b100be670d9598f0ce2fc71fc868a16ed27663f5182297912b8e0deb1464dd00840f5fc663e3495f1f78076dfcf787e5f5f4b99cf9bd02b816486ffdf4

              Download Submit

            • memory/812-143-0x00000209B21B0000-0x00000209B21C0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/812-132-0x00000209B21B0000-0x00000209B21C0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1460-262-0x00000117CA6F0000-0x00000117CA700000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1460-261-0x00000117CA6F0000-0x00000117CA700000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1460-260-0x00007FFE33640000-0x00007FFE34101000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2300-244-0x00000217F3A30000-0x00000217F3A40000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2300-245-0x00000217F3A30000-0x00000217F3A40000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2300-265-0x00000217F3A30000-0x00000217F3A40000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2868-226-0x000002696E340000-0x000002696E350000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2868-217-0x000002696E340000-0x000002696E350000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2908-263-0x0000029140900000-0x0000029140910000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2908-169-0x00007FFE33640000-0x00007FFE34101000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2908-201-0x0000029140900000-0x0000029140910000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2908-191-0x0000029140900000-0x0000029140910000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-48-0x00007FFE33640000-0x00007FFE34101000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3620-13-0x0000000003090000-0x000000000309C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/3620-0-0x0000000000D30000-0x0000000000E9C000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3620-73-0x000000001BB60000-0x000000001BB70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-1-0x00007FFE33640000-0x00007FFE34101000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3620-2-0x000000001BB60000-0x000000001BB70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-146-0x00007FFE33640000-0x00007FFE34101000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3620-3-0x000000001BAA0000-0x000000001BAAE000-memory.dmp

              Filesize

              56KB

              Download

            • memory/3620-4-0x000000001BAB0000-0x000000001BAB8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3620-5-0x000000001BAC0000-0x000000001BADC000-memory.dmp

              Filesize

              112KB

              Download

            • memory/3620-7-0x000000001BAE0000-0x000000001BAE8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3620-8-0x000000001BAF0000-0x000000001BB00000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-34-0x000000001BB60000-0x000000001BB70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-6-0x000000001C070000-0x000000001C0C0000-memory.dmp

              Filesize

              320KB

              Download

            • memory/3620-9-0x000000001BB00000-0x000000001BB16000-memory.dmp

              Filesize

              88KB

              Download

            • memory/3620-10-0x000000001BB20000-0x000000001BB30000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-11-0x0000000003070000-0x000000000307A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/3620-12-0x0000000003080000-0x000000000308C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/3620-125-0x000000001BB60000-0x000000001BB70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-109-0x000000001BB60000-0x000000001BB70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-14-0x00000000030A0000-0x00000000030A8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3620-108-0x000000001BB60000-0x000000001BB70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-49-0x000000001CA40000-0x000000001CB40000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/3620-29-0x000000001BB60000-0x000000001BB70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-26-0x000000001C460000-0x000000001C46C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/3620-25-0x000000001C300000-0x000000001C30A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/3620-24-0x000000001C2F0000-0x000000001C2F8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3620-23-0x000000001C2E0000-0x000000001C2EC000-memory.dmp

              Filesize

              48KB

              Download

            • memory/3620-22-0x000000001C2D0000-0x000000001C2DE000-memory.dmp

              Filesize

              56KB

              Download

            • memory/3620-21-0x000000001C2C0000-0x000000001C2C8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3620-19-0x000000001BB60000-0x000000001BB70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-20-0x000000001BB50000-0x000000001BB5E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/3620-17-0x000000001BB40000-0x000000001BB4A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/3620-18-0x000000001BB60000-0x000000001BB70000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3620-16-0x000000001C410000-0x000000001C418000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3620-15-0x000000001BB30000-0x000000001BB3C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/3896-259-0x00007FFE33640000-0x00007FFE34101000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/4112-256-0x00007FFE33640000-0x00007FFE34101000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/4112-257-0x000001D4F7DB0000-0x000001D4F7DC0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4112-258-0x000001D4F7DB0000-0x000001D4F7DC0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4824-264-0x00000201EDD90000-0x00000201EDDA0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4824-131-0x00007FFE33640000-0x00007FFE34101000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/4824-133-0x00000201EDD90000-0x00000201EDDA0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4824-145-0x00000201EDD90000-0x00000201EDDA0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4920-126-0x00007FFE33640000-0x00007FFE34101000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/4920-129-0x000001D114280000-0x000001D114290000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4920-128-0x000001D114280000-0x000001D114290000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4920-144-0x000001D12CA40000-0x000001D12CA62000-memory.dmp

              Filesize

              136KB

              Download

            • memory/4936-161-0x00007FFE33640000-0x00007FFE34101000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/4936-187-0x000001E021830000-0x000001E021840000-memory.dmp

              Filesize

              64KB

              Download