Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2023, 01:46

General

  • Target

    NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe

  • Size

    1.4MB

  • MD5

    3d10e6755ac9695dca6850bb1ad727d0

  • SHA1

    b42d5db6a985f610548776ea62316c94940b183d

  • SHA256

    978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165

  • SHA512

    f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

  • SSDEEP

    24576:qBBkOlRe8ZcXPuCyRdaN1yV/vELneAcCg8:uOOy8eEa1Jct8

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 21 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 12 IoCs
  • DCRat payload 9 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • System policy modification 1 TTPs 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2036
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1872
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3524
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1788
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4348
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3776
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4480
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2284
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1548
    • C:\Recovery\WindowsRE\csrss.exe
      "C:\Recovery\WindowsRE\csrss.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5972
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c2eaf25-0bc9-4248-9ca6-b0ee9c4936e7.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5420
        • C:\Recovery\WindowsRE\csrss.exe
          C:\Recovery\WindowsRE\csrss.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2808
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05433070-5d83-45e0-abee-c89c7676a081.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3064
            • C:\Recovery\WindowsRE\csrss.exe
              C:\Recovery\WindowsRE\csrss.exe
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1872
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64f974b8-5488-49d1-9862-3176978aeb7c.vbs"
                7⤵
                  PID:5472
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0f96041-cc76-4e26-8870-e6a2b4b9afc8.vbs"
                  7⤵
                    PID:3948
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a731c2be-acd1-4a38-831f-4cecdaeec0c2.vbs"
                5⤵
                  PID:1688
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69f20187-8c32-43f4-b854-733e243d714a.vbs"
              3⤵
                PID:5484
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1664
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4276
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1744
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "NEAS.3d10e6755ac9695dca6850bb1ad727d0N" /sc MINUTE /mo 6 /tr "'C:\Windows\Offline Web Pages\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:5016
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "NEAS.3d10e6755ac9695dca6850bb1ad727d0" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4232
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "NEAS.3d10e6755ac9695dca6850bb1ad727d0N" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\NEAS.3d10e6755ac9695dca6850bb1ad727d0.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2332
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4544
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2660
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\Help\explorer.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:5040
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\Help\explorer.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2004
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1452
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3808
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:5096
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4272
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1624
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\SchCache\csrss.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2532
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\SchCache\csrss.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3084
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SchCache\csrss.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1224
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2860
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4928
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2948
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:436
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Help\Help\explorer.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2920

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Recovery\WindowsRE\StartMenuExperienceHost.exe

                  Filesize

                  1.4MB

                  MD5

                  3d10e6755ac9695dca6850bb1ad727d0

                  SHA1

                  b42d5db6a985f610548776ea62316c94940b183d

                  SHA256

                  978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165

                  SHA512

                  f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

                • C:\Recovery\WindowsRE\csrss.exe

                  Filesize

                  1.4MB

                  MD5

                  3d10e6755ac9695dca6850bb1ad727d0

                  SHA1

                  b42d5db6a985f610548776ea62316c94940b183d

                  SHA256

                  978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165

                  SHA512

                  f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

                • C:\Recovery\WindowsRE\csrss.exe

                  Filesize

                  1.4MB

                  MD5

                  3d10e6755ac9695dca6850bb1ad727d0

                  SHA1

                  b42d5db6a985f610548776ea62316c94940b183d

                  SHA256

                  978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165

                  SHA512

                  f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

                • C:\Recovery\WindowsRE\csrss.exe

                  Filesize

                  1.4MB

                  MD5

                  3d10e6755ac9695dca6850bb1ad727d0

                  SHA1

                  b42d5db6a985f610548776ea62316c94940b183d

                  SHA256

                  978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165

                  SHA512

                  f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

                • C:\Recovery\WindowsRE\csrss.exe

                  Filesize

                  1.4MB

                  MD5

                  3d10e6755ac9695dca6850bb1ad727d0

                  SHA1

                  b42d5db6a985f610548776ea62316c94940b183d

                  SHA256

                  978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165

                  SHA512

                  f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

                  Filesize

                  1KB

                  MD5

                  9b0256da3bf9a5303141361b3da59823

                  SHA1

                  d73f34951777136c444eb2c98394f62912ebcdac

                  SHA256

                  96cbc3f4e49d7ae13cd46e36ebb4819b6db1eabe5db910902638c1a24947208e

                  SHA512

                  9f014fef4b1bb71dbdd1d0bad11bd20437a9801eaa830ab386f901f6b5be374a26f68161d7638ea03483028e9a56bf97023cc24b45356a9c76cb755a53d9c164

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  2KB

                  MD5

                  d85ba6ff808d9e5444a4b369f5bc2730

                  SHA1

                  31aa9d96590fff6981b315e0b391b575e4c0804a

                  SHA256

                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                  SHA512

                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  cadef9abd087803c630df65264a6c81c

                  SHA1

                  babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                  SHA256

                  cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                  SHA512

                  7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  cadef9abd087803c630df65264a6c81c

                  SHA1

                  babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                  SHA256

                  cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                  SHA512

                  7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  cadef9abd087803c630df65264a6c81c

                  SHA1

                  babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                  SHA256

                  cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                  SHA512

                  7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  cadef9abd087803c630df65264a6c81c

                  SHA1

                  babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                  SHA256

                  cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                  SHA512

                  7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  cadef9abd087803c630df65264a6c81c

                  SHA1

                  babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                  SHA256

                  cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                  SHA512

                  7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  a8e8360d573a4ff072dcc6f09d992c88

                  SHA1

                  3446774433ceaf0b400073914facab11b98b6807

                  SHA256

                  bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

                  SHA512

                  4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  a8e8360d573a4ff072dcc6f09d992c88

                  SHA1

                  3446774433ceaf0b400073914facab11b98b6807

                  SHA256

                  bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

                  SHA512

                  4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  3a6bad9528f8e23fb5c77fbd81fa28e8

                  SHA1

                  f127317c3bc6407f536c0f0600dcbcf1aabfba36

                  SHA256

                  986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                  SHA512

                  846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  3a6bad9528f8e23fb5c77fbd81fa28e8

                  SHA1

                  f127317c3bc6407f536c0f0600dcbcf1aabfba36

                  SHA256

                  986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                  SHA512

                  846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  e448fe0d240184c6597a31d3be2ced58

                  SHA1

                  372b8d8c19246d3e38cd3ba123cc0f56070f03cd

                  SHA256

                  c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

                  SHA512

                  0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  3a6bad9528f8e23fb5c77fbd81fa28e8

                  SHA1

                  f127317c3bc6407f536c0f0600dcbcf1aabfba36

                  SHA256

                  986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                  SHA512

                  846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  e448fe0d240184c6597a31d3be2ced58

                  SHA1

                  372b8d8c19246d3e38cd3ba123cc0f56070f03cd

                  SHA256

                  c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

                  SHA512

                  0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

                • C:\Users\Admin\AppData\Local\Temp\05433070-5d83-45e0-abee-c89c7676a081.vbs

                  Filesize

                  707B

                  MD5

                  b650bcf3e17f7b3f3c7f6b9ad6fe7936

                  SHA1

                  56bc3388afb081b99b1c33137f15bcaf1accc753

                  SHA256

                  829aa0268be15ab62e700a2938a172bcde24a8db6247d0d94bb750bcce5945bf

                  SHA512

                  eee9de7dbb746e540522740aad0b6a3534638de78783d4f0b7cb0a76d641f1e852695b6c095c42696c35be1294cb5853805778a747d507cce0ae8b8862050b4c

                • C:\Users\Admin\AppData\Local\Temp\0c2eaf25-0bc9-4248-9ca6-b0ee9c4936e7.vbs

                  Filesize

                  707B

                  MD5

                  418413f400d679125f09990b4909c55d

                  SHA1

                  aab28d834aaf9fd0bd2f00335f18304f1108ff69

                  SHA256

                  d3ff178ffd07d5ba8e8db60f6f7fe0b4126531649ea6dd0955f2461cef7d8555

                  SHA512

                  492f7ba13aa14dbe61be5135e7e7c486df4bf735158c81a99b60e2c806d992c5ec807ffd8f2dc0e3f238b5cdae6ff110101c1c29def1e89f59458d1e6abe9118

                • C:\Users\Admin\AppData\Local\Temp\64f974b8-5488-49d1-9862-3176978aeb7c.vbs

                  Filesize

                  707B

                  MD5

                  0ed393d2139c0010ec82eb9fdb64e304

                  SHA1

                  19da0e326427b08091d60aa8432b2ebe9c480dff

                  SHA256

                  8216defbf93426eb3cbaf2da47a0915f9cd7364e9723b61871db71da200f34be

                  SHA512

                  0ec86f4d23df4d512597c4f9bfe2f3896088cf6fa86d17d52a73acfe60477192a3ab7dfbdfc7f05f6767a11fc19c9acb9dc6c99e4de430d82cb1aeba23241dd2

                • C:\Users\Admin\AppData\Local\Temp\69f20187-8c32-43f4-b854-733e243d714a.vbs

                  Filesize

                  483B

                  MD5

                  6ac6a025aafc0f846408e903f236b24c

                  SHA1

                  f10d686107400cf695c33cc38e0c0a4116251211

                  SHA256

                  1e5e20638bcf089dadc293e3982f7151bc67d4f63cfeab5edc7ed248fd354e46

                  SHA512

                  741dc7e8c6061332f230e6ba73b2f4250d78c5e10c71217efd419b27ad18a097bd662d67834acebf845759a1f38923a8a03f291b263a1af49b03086fd4a8e838

                • C:\Users\Admin\AppData\Local\Temp\838c2240ceaf51f4e1ea10f1e48c3a2d1612e317.exe

                  Filesize

                  1.4MB

                  MD5

                  3d10e6755ac9695dca6850bb1ad727d0

                  SHA1

                  b42d5db6a985f610548776ea62316c94940b183d

                  SHA256

                  978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165

                  SHA512

                  f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

                • C:\Users\Admin\AppData\Local\Temp\838c2240ceaf51f4e1ea10f1e48c3a2d1612e317.exe

                  Filesize

                  1.4MB

                  MD5

                  3d10e6755ac9695dca6850bb1ad727d0

                  SHA1

                  b42d5db6a985f610548776ea62316c94940b183d

                  SHA256

                  978f287cea0349f2b401815bad60117a162621521acb4c726126953c685bc165

                  SHA512

                  f9c81db74335f953a1780d8eb1522908b709557093ca6d7aa8e8746d401a8ff8f847a13b6c5eca7f728d55f4f005b136bce835ff5877a39bcf0249ccd8b6c538

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ejusapk.opm.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Admin\AppData\Local\Temp\a731c2be-acd1-4a38-831f-4cecdaeec0c2.vbs

                  Filesize

                  483B

                  MD5

                  6ac6a025aafc0f846408e903f236b24c

                  SHA1

                  f10d686107400cf695c33cc38e0c0a4116251211

                  SHA256

                  1e5e20638bcf089dadc293e3982f7151bc67d4f63cfeab5edc7ed248fd354e46

                  SHA512

                  741dc7e8c6061332f230e6ba73b2f4250d78c5e10c71217efd419b27ad18a097bd662d67834acebf845759a1f38923a8a03f291b263a1af49b03086fd4a8e838

                • C:\Users\Admin\AppData\Local\Temp\a731c2be-acd1-4a38-831f-4cecdaeec0c2.vbs

                  Filesize

                  483B

                  MD5

                  6ac6a025aafc0f846408e903f236b24c

                  SHA1

                  f10d686107400cf695c33cc38e0c0a4116251211

                  SHA256

                  1e5e20638bcf089dadc293e3982f7151bc67d4f63cfeab5edc7ed248fd354e46

                  SHA512

                  741dc7e8c6061332f230e6ba73b2f4250d78c5e10c71217efd419b27ad18a097bd662d67834acebf845759a1f38923a8a03f291b263a1af49b03086fd4a8e838

                • C:\Users\Admin\AppData\Local\Temp\c0f96041-cc76-4e26-8870-e6a2b4b9afc8.vbs

                  Filesize

                  483B

                  MD5

                  6ac6a025aafc0f846408e903f236b24c

                  SHA1

                  f10d686107400cf695c33cc38e0c0a4116251211

                  SHA256

                  1e5e20638bcf089dadc293e3982f7151bc67d4f63cfeab5edc7ed248fd354e46

                  SHA512

                  741dc7e8c6061332f230e6ba73b2f4250d78c5e10c71217efd419b27ad18a097bd662d67834acebf845759a1f38923a8a03f291b263a1af49b03086fd4a8e838

                • C:\Users\Public\Pictures\RuntimeBroker.exe

                  Filesize

                  1.4MB

                  MD5

                  a60f46fdd0f9b48ccd75fbd6c72ee702

                  SHA1

                  829a537487418e2e9f2475fc4b7146205ed5d1c5

                  SHA256

                  c91b3f56b731d67b626209d8f55bdad37c1b4cc0caa178b4aca794dc1b3b1bb3

                  SHA512

                  b78fd5053e8e599f4ba17df6b6bb24b2975690e0989d392ead5c20cdd66cfc0ce14aef8409395e8a26c51b1c07ba59155df255ae43c37154f55c773661201de8

                • memory/1548-153-0x0000020C708D0000-0x0000020C708E0000-memory.dmp

                  Filesize

                  64KB

                • memory/1548-154-0x0000020C708D0000-0x0000020C708E0000-memory.dmp

                  Filesize

                  64KB

                • memory/1548-152-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1664-157-0x000001A74E650000-0x000001A74E660000-memory.dmp

                  Filesize

                  64KB

                • memory/1664-156-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1664-318-0x000001A74E650000-0x000001A74E660000-memory.dmp

                  Filesize

                  64KB

                • memory/1664-159-0x000001A74E650000-0x000001A74E660000-memory.dmp

                  Filesize

                  64KB

                • memory/1788-137-0x00000228E7D80000-0x00000228E7D90000-memory.dmp

                  Filesize

                  64KB

                • memory/1788-138-0x00000228E7D80000-0x00000228E7D90000-memory.dmp

                  Filesize

                  64KB

                • memory/1788-317-0x00000228E7D80000-0x00000228E7D90000-memory.dmp

                  Filesize

                  64KB

                • memory/1788-165-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1872-309-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1872-172-0x0000026EBD870000-0x0000026EBD892000-memory.dmp

                  Filesize

                  136KB

                • memory/2036-320-0x000000001BEC0000-0x000000001BED0000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-22-0x000000001BE00000-0x000000001BE0E000-memory.dmp

                  Filesize

                  56KB

                • memory/2036-32-0x000000001BEC0000-0x000000001BED0000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-2-0x000000001BEC0000-0x000000001BED0000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-0-0x0000000000E20000-0x0000000000F8C000-memory.dmp

                  Filesize

                  1.4MB

                • memory/2036-131-0x000000001CBB0000-0x000000001CCB0000-memory.dmp

                  Filesize

                  1024KB

                • memory/2036-132-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2036-1-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2036-3-0x0000000001850000-0x000000000185E000-memory.dmp

                  Filesize

                  56KB

                • memory/2036-5-0x0000000001910000-0x000000000192C000-memory.dmp

                  Filesize

                  112KB

                • memory/2036-4-0x0000000001900000-0x0000000001908000-memory.dmp

                  Filesize

                  32KB

                • memory/2036-8-0x00000000031F0000-0x0000000003200000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-164-0x000000001BEC0000-0x000000001BED0000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-10-0x0000000003220000-0x0000000003230000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-11-0x0000000003230000-0x000000000323A000-memory.dmp

                  Filesize

                  40KB

                • memory/2036-9-0x0000000003200000-0x0000000003216000-memory.dmp

                  Filesize

                  88KB

                • memory/2036-12-0x00000000018C0000-0x00000000018CC000-memory.dmp

                  Filesize

                  48KB

                • memory/2036-15-0x00000000018F0000-0x00000000018FC000-memory.dmp

                  Filesize

                  48KB

                • memory/2036-316-0x000000001BEC0000-0x000000001BED0000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-16-0x0000000003240000-0x0000000003248000-memory.dmp

                  Filesize

                  32KB

                • memory/2036-18-0x000000001BEC0000-0x000000001BED0000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-106-0x000000001CBB0000-0x000000001CCB0000-memory.dmp

                  Filesize

                  1024KB

                • memory/2036-21-0x000000001BDF0000-0x000000001BDF8000-memory.dmp

                  Filesize

                  32KB

                • memory/2036-315-0x000000001BEC0000-0x000000001BED0000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-6-0x000000001BC30000-0x000000001BC80000-memory.dmp

                  Filesize

                  320KB

                • memory/2036-7-0x00000000031E0000-0x00000000031E8000-memory.dmp

                  Filesize

                  32KB

                • memory/2036-13-0x00000000018D0000-0x00000000018DC000-memory.dmp

                  Filesize

                  48KB

                • memory/2036-14-0x00000000018E0000-0x00000000018E8000-memory.dmp

                  Filesize

                  32KB

                • memory/2036-17-0x000000001BCC0000-0x000000001BCCA000-memory.dmp

                  Filesize

                  40KB

                • memory/2036-29-0x000000001BEC0000-0x000000001BED0000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-19-0x000000001BCD0000-0x000000001BCDE000-memory.dmp

                  Filesize

                  56KB

                • memory/2036-20-0x000000001BEC0000-0x000000001BED0000-memory.dmp

                  Filesize

                  64KB

                • memory/2036-24-0x000000001BE20000-0x000000001BE28000-memory.dmp

                  Filesize

                  32KB

                • memory/2036-26-0x000000001BE40000-0x000000001BE4C000-memory.dmp

                  Filesize

                  48KB

                • memory/2036-25-0x000000001BE30000-0x000000001BE3A000-memory.dmp

                  Filesize

                  40KB

                • memory/2036-23-0x000000001BE10000-0x000000001BE1C000-memory.dmp

                  Filesize

                  48KB

                • memory/2284-166-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3524-158-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3612-134-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3612-136-0x000002611EF00000-0x000002611EF10000-memory.dmp

                  Filesize

                  64KB

                • memory/3612-135-0x000002611EF00000-0x000002611EF10000-memory.dmp

                  Filesize

                  64KB

                • memory/3776-155-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3784-150-0x000001A8F2090000-0x000001A8F20A0000-memory.dmp

                  Filesize

                  64KB

                • memory/3784-148-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3784-151-0x000001A8F2090000-0x000001A8F20A0000-memory.dmp

                  Filesize

                  64KB

                • memory/4276-162-0x0000026F9C860000-0x0000026F9C870000-memory.dmp

                  Filesize

                  64KB

                • memory/4276-314-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4348-163-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4348-319-0x0000015BEF120000-0x0000015BEF130000-memory.dmp

                  Filesize

                  64KB

                • memory/4480-161-0x0000017DC4E90000-0x0000017DC4EA0000-memory.dmp

                  Filesize

                  64KB

                • memory/4480-160-0x00007FFF61EF0000-0x00007FFF629B1000-memory.dmp

                  Filesize

                  10.8MB