Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2023, 01:52

General

  • Target

    4d7463d7f489ec7de6ebea288af19270.exe

  • Size

    1.4MB

  • MD5

    4d7463d7f489ec7de6ebea288af19270

  • SHA1

    3a350b9badebb0d9f31bf6472d6f5c69d246ef39

  • SHA256

    bf5bf5a95a275819c1630814b9333fe1fe19d973ecb498de8c56938fa21bfb48

  • SHA512

    1dbc0a0de6fba1461383bcae6bbaece31684f395dd944a5c0b55a071180532772cf23d9b887be7b77e2baa447d54fcead93711709106baca58066d2d5604c6e4

  • SSDEEP

    24576:qBBkOlRe8ZcXPuCyRdaN1yV/vELneAcCg8:uOOy8eEa1Jct8

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 12 IoCs
  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • System policy modification 1 TTPs 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d7463d7f489ec7de6ebea288af19270.exe
    "C:\Users\Admin\AppData\Local\Temp\4d7463d7f489ec7de6ebea288af19270.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:8
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5028
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3924
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3532
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3036
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3756
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1048
    • C:\Program Files\Windows Defender\de-DE\wininit.exe
      "C:\Program Files\Windows Defender\de-DE\wininit.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5508
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2f59dd7-6169-4f69-ab51-594b56de6c90.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5280
        • C:\Program Files\Windows Defender\de-DE\wininit.exe
          "C:\Program Files\Windows Defender\de-DE\wininit.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:260
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa66a7cb-65d8-40cf-bb40-fa150af96a5d.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2372
            • C:\Program Files\Windows Defender\de-DE\wininit.exe
              "C:\Program Files\Windows Defender\de-DE\wininit.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4732
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9569fd1d-c2f0-4ba0-8992-74693b793316.vbs"
                7⤵
                  PID:3352
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac686863-9ccc-4589-95bb-f22e8fffe1d9.vbs"
                  7⤵
                    PID:2232
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c53138e1-5f69-4375-8358-2d4ac4715a7f.vbs"
                5⤵
                  PID:5488
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4cd69a9-5812-452d-94aa-8ab1c37c6641.vbs"
              3⤵
                PID:5352
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\sihost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2324
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\addins\sihost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4836
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\sihost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3872
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\de-DE\wininit.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1676
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\de-DE\wininit.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4904
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\wininit.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3968
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\StartMenuExperienceHost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4696
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\All Users\StartMenuExperienceHost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3728
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\StartMenuExperienceHost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:676
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\fontdrvhost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1440
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\fontdrvhost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1236
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\fontdrvhost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3796
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\lib\amd64\TextInputHost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1108
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jre-1.8\lib\amd64\TextInputHost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3544
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre-1.8\lib\amd64\TextInputHost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:648
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3836
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2544
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\backgroundTaskHost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4136

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files\Java\jre-1.8\lib\amd64\TextInputHost.exe

                  Filesize

                  1.4MB

                  MD5

                  4d7463d7f489ec7de6ebea288af19270

                  SHA1

                  3a350b9badebb0d9f31bf6472d6f5c69d246ef39

                  SHA256

                  bf5bf5a95a275819c1630814b9333fe1fe19d973ecb498de8c56938fa21bfb48

                  SHA512

                  1dbc0a0de6fba1461383bcae6bbaece31684f395dd944a5c0b55a071180532772cf23d9b887be7b77e2baa447d54fcead93711709106baca58066d2d5604c6e4

                • C:\Program Files\Windows Defender\de-DE\wininit.exe

                  Filesize

                  1.4MB

                  MD5

                  4d7463d7f489ec7de6ebea288af19270

                  SHA1

                  3a350b9badebb0d9f31bf6472d6f5c69d246ef39

                  SHA256

                  bf5bf5a95a275819c1630814b9333fe1fe19d973ecb498de8c56938fa21bfb48

                  SHA512

                  1dbc0a0de6fba1461383bcae6bbaece31684f395dd944a5c0b55a071180532772cf23d9b887be7b77e2baa447d54fcead93711709106baca58066d2d5604c6e4

                • C:\Program Files\Windows Defender\de-DE\wininit.exe

                  Filesize

                  1.4MB

                  MD5

                  4d7463d7f489ec7de6ebea288af19270

                  SHA1

                  3a350b9badebb0d9f31bf6472d6f5c69d246ef39

                  SHA256

                  bf5bf5a95a275819c1630814b9333fe1fe19d973ecb498de8c56938fa21bfb48

                  SHA512

                  1dbc0a0de6fba1461383bcae6bbaece31684f395dd944a5c0b55a071180532772cf23d9b887be7b77e2baa447d54fcead93711709106baca58066d2d5604c6e4

                • C:\Program Files\Windows Defender\de-DE\wininit.exe

                  Filesize

                  1.4MB

                  MD5

                  4d7463d7f489ec7de6ebea288af19270

                  SHA1

                  3a350b9badebb0d9f31bf6472d6f5c69d246ef39

                  SHA256

                  bf5bf5a95a275819c1630814b9333fe1fe19d973ecb498de8c56938fa21bfb48

                  SHA512

                  1dbc0a0de6fba1461383bcae6bbaece31684f395dd944a5c0b55a071180532772cf23d9b887be7b77e2baa447d54fcead93711709106baca58066d2d5604c6e4

                • C:\Program Files\Windows Defender\de-DE\wininit.exe

                  Filesize

                  1.4MB

                  MD5

                  4d7463d7f489ec7de6ebea288af19270

                  SHA1

                  3a350b9badebb0d9f31bf6472d6f5c69d246ef39

                  SHA256

                  bf5bf5a95a275819c1630814b9333fe1fe19d973ecb498de8c56938fa21bfb48

                  SHA512

                  1dbc0a0de6fba1461383bcae6bbaece31684f395dd944a5c0b55a071180532772cf23d9b887be7b77e2baa447d54fcead93711709106baca58066d2d5604c6e4

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  2KB

                  MD5

                  d85ba6ff808d9e5444a4b369f5bc2730

                  SHA1

                  31aa9d96590fff6981b315e0b391b575e4c0804a

                  SHA256

                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                  SHA512

                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

                  Filesize

                  1KB

                  MD5

                  9b0256da3bf9a5303141361b3da59823

                  SHA1

                  d73f34951777136c444eb2c98394f62912ebcdac

                  SHA256

                  96cbc3f4e49d7ae13cd46e36ebb4819b6db1eabe5db910902638c1a24947208e

                  SHA512

                  9f014fef4b1bb71dbdd1d0bad11bd20437a9801eaa830ab386f901f6b5be374a26f68161d7638ea03483028e9a56bf97023cc24b45356a9c76cb755a53d9c164

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  aaaac7c68d2b7997ed502c26fd9f65c2

                  SHA1

                  7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                  SHA256

                  8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                  SHA512

                  c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  101c3b86ef1c02c62b7d862c2a47363b

                  SHA1

                  3c5e8d309610e5ba41b6b9788bfb826e45864b46

                  SHA256

                  9174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c

                  SHA512

                  d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  101c3b86ef1c02c62b7d862c2a47363b

                  SHA1

                  3c5e8d309610e5ba41b6b9788bfb826e45864b46

                  SHA256

                  9174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c

                  SHA512

                  d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  d6536c16bcf5366ce342a8acf882fa54

                  SHA1

                  3cdbc184d2d5b7390741c131e37470f43c06fb50

                  SHA256

                  9feb7f3f57d6121d1afd6701d5661a62b8cd793ce61bbd8e8057e481e159a3de

                  SHA512

                  27a193f45e9ae767767ad2108d05aa7ea6ed13b321e36966cccc2603052a4921f8b2250e381b544550d0bbcf3edd7401d261b13b1c49e9192d9cd2fae9b04808

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  e8ce785f8ccc6d202d56fefc59764945

                  SHA1

                  ca032c62ddc5e0f26d84eff9895eb87f14e15960

                  SHA256

                  d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                  SHA512

                  66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  e8ce785f8ccc6d202d56fefc59764945

                  SHA1

                  ca032c62ddc5e0f26d84eff9895eb87f14e15960

                  SHA256

                  d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

                  SHA512

                  66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  17fbfbe3f04595e251287a6bfcdc35de

                  SHA1

                  b576aabfd5e6d5799d487011506ed1ae70688987

                  SHA256

                  2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

                  SHA512

                  449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  9611cc3fb39fedd4b0e81d90b044531c

                  SHA1

                  e35c10c1c1e29d44222114e0f72d58b3072880fd

                  SHA256

                  2090eae25be03e07ff54e5ab9d219902fb80e8c1f6fe52e73c9a4afcf5eec5ec

                  SHA512

                  92cf8fdd0353dd1e04856b6642483ac426ea32113a0b7436cf8224623912ae2f31078c7e70cef1c67f859504bd29e05f9af69f06533725e57244063e89e4954d

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  9611cc3fb39fedd4b0e81d90b044531c

                  SHA1

                  e35c10c1c1e29d44222114e0f72d58b3072880fd

                  SHA256

                  2090eae25be03e07ff54e5ab9d219902fb80e8c1f6fe52e73c9a4afcf5eec5ec

                  SHA512

                  92cf8fdd0353dd1e04856b6642483ac426ea32113a0b7436cf8224623912ae2f31078c7e70cef1c67f859504bd29e05f9af69f06533725e57244063e89e4954d

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  9611cc3fb39fedd4b0e81d90b044531c

                  SHA1

                  e35c10c1c1e29d44222114e0f72d58b3072880fd

                  SHA256

                  2090eae25be03e07ff54e5ab9d219902fb80e8c1f6fe52e73c9a4afcf5eec5ec

                  SHA512

                  92cf8fdd0353dd1e04856b6642483ac426ea32113a0b7436cf8224623912ae2f31078c7e70cef1c67f859504bd29e05f9af69f06533725e57244063e89e4954d

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  944B

                  MD5

                  9611cc3fb39fedd4b0e81d90b044531c

                  SHA1

                  e35c10c1c1e29d44222114e0f72d58b3072880fd

                  SHA256

                  2090eae25be03e07ff54e5ab9d219902fb80e8c1f6fe52e73c9a4afcf5eec5ec

                  SHA512

                  92cf8fdd0353dd1e04856b6642483ac426ea32113a0b7436cf8224623912ae2f31078c7e70cef1c67f859504bd29e05f9af69f06533725e57244063e89e4954d

                • C:\Users\Admin\AppData\Local\Temp\9569fd1d-c2f0-4ba0-8992-74693b793316.vbs

                  Filesize

                  727B

                  MD5

                  e9d3189dd9b2c8851a0cbd9fdf41f8be

                  SHA1

                  1f143a7e1722b97c73bafa3dcf25b0ffc8cb7100

                  SHA256

                  cb1d310b730b3c837071ffb0e3562acc7f8c9d4202bc376a15813a02ed899ba1

                  SHA512

                  733c6957ed04218f58a5068ef4d2bf1415cbadf53b8f0e8825dec02909b869c6487289f84c1c3ce49034a2cd334c62f82fb888da4ffd2b389e674d358bc1cbd8

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yowojx30.aj4.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Admin\AppData\Local\Temp\aa66a7cb-65d8-40cf-bb40-fa150af96a5d.vbs

                  Filesize

                  726B

                  MD5

                  d401d2959f55f79492d360e59e242db1

                  SHA1

                  e6256ce183b6b1f510810ee41eff0fa095a73440

                  SHA256

                  33817e9fbb2b5209270ea07401c41685cd939a006471f7b3926b0cd05c563b58

                  SHA512

                  b9ad583fe3212ab8c0259494887afa20f0de716da39108da87de47bc78bfcae05fa2f486b849d9da627ab35d01c0e981228a934679de6bf299acb1cfb4a694ba

                • C:\Users\Admin\AppData\Local\Temp\ab41a0df16d92f4034711e456d4c313a7ac7a831.exe

                  Filesize

                  1.4MB

                  MD5

                  4d7463d7f489ec7de6ebea288af19270

                  SHA1

                  3a350b9badebb0d9f31bf6472d6f5c69d246ef39

                  SHA256

                  bf5bf5a95a275819c1630814b9333fe1fe19d973ecb498de8c56938fa21bfb48

                  SHA512

                  1dbc0a0de6fba1461383bcae6bbaece31684f395dd944a5c0b55a071180532772cf23d9b887be7b77e2baa447d54fcead93711709106baca58066d2d5604c6e4

                • C:\Users\Admin\AppData\Local\Temp\ab41a0df16d92f4034711e456d4c313a7ac7a831.exe

                  Filesize

                  1.4MB

                  MD5

                  4d7463d7f489ec7de6ebea288af19270

                  SHA1

                  3a350b9badebb0d9f31bf6472d6f5c69d246ef39

                  SHA256

                  bf5bf5a95a275819c1630814b9333fe1fe19d973ecb498de8c56938fa21bfb48

                  SHA512

                  1dbc0a0de6fba1461383bcae6bbaece31684f395dd944a5c0b55a071180532772cf23d9b887be7b77e2baa447d54fcead93711709106baca58066d2d5604c6e4

                • C:\Users\Admin\AppData\Local\Temp\ac686863-9ccc-4589-95bb-f22e8fffe1d9.vbs

                  Filesize

                  503B

                  MD5

                  c102e36fa34d16b1f27b0ac168f08a06

                  SHA1

                  ec81d51e780575d8ddcd7850117b7f49bef6522e

                  SHA256

                  720a20170ed0167caceffce8b4db82625a02b39a6dbc8bd3e9bf996945552fb3

                  SHA512

                  039be8557f80aeb05d898315db6d38ab9ae2f3eda358c74c5ecccac1d7b4c3ad11c67a79cdc76a5ff9934c4f98d784393b128ea0926675a922986b236c2ba9b6

                • C:\Users\Admin\AppData\Local\Temp\b4cd69a9-5812-452d-94aa-8ab1c37c6641.vbs

                  Filesize

                  503B

                  MD5

                  c102e36fa34d16b1f27b0ac168f08a06

                  SHA1

                  ec81d51e780575d8ddcd7850117b7f49bef6522e

                  SHA256

                  720a20170ed0167caceffce8b4db82625a02b39a6dbc8bd3e9bf996945552fb3

                  SHA512

                  039be8557f80aeb05d898315db6d38ab9ae2f3eda358c74c5ecccac1d7b4c3ad11c67a79cdc76a5ff9934c4f98d784393b128ea0926675a922986b236c2ba9b6

                • C:\Users\Admin\AppData\Local\Temp\c53138e1-5f69-4375-8358-2d4ac4715a7f.vbs

                  Filesize

                  503B

                  MD5

                  c102e36fa34d16b1f27b0ac168f08a06

                  SHA1

                  ec81d51e780575d8ddcd7850117b7f49bef6522e

                  SHA256

                  720a20170ed0167caceffce8b4db82625a02b39a6dbc8bd3e9bf996945552fb3

                  SHA512

                  039be8557f80aeb05d898315db6d38ab9ae2f3eda358c74c5ecccac1d7b4c3ad11c67a79cdc76a5ff9934c4f98d784393b128ea0926675a922986b236c2ba9b6

                • C:\Users\Admin\AppData\Local\Temp\c53138e1-5f69-4375-8358-2d4ac4715a7f.vbs

                  Filesize

                  503B

                  MD5

                  c102e36fa34d16b1f27b0ac168f08a06

                  SHA1

                  ec81d51e780575d8ddcd7850117b7f49bef6522e

                  SHA256

                  720a20170ed0167caceffce8b4db82625a02b39a6dbc8bd3e9bf996945552fb3

                  SHA512

                  039be8557f80aeb05d898315db6d38ab9ae2f3eda358c74c5ecccac1d7b4c3ad11c67a79cdc76a5ff9934c4f98d784393b128ea0926675a922986b236c2ba9b6

                • C:\Users\Admin\AppData\Local\Temp\f2f59dd7-6169-4f69-ab51-594b56de6c90.vbs

                  Filesize

                  727B

                  MD5

                  7e8902373b0c660cf40ec7bcc10cdb55

                  SHA1

                  333d210325e3610c6075419ccdf683c7a3f279b0

                  SHA256

                  be60f1eb8f02c9a387551a7415978136ef6ec5cfefc77aa77b77c92ea0310504

                  SHA512

                  eb52e00854232eb3df5c28d76184dee692e3f4f20f011d24cf8956d4a307f9af9d73ac25417d52137a23ac45fd7c885c311f7fb322007d8461418243cc0120d0

                • memory/8-308-0x000001BEF3250000-0x000001BEF3260000-memory.dmp

                  Filesize

                  64KB

                • memory/8-312-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/8-309-0x000001BEF3250000-0x000001BEF3260000-memory.dmp

                  Filesize

                  64KB

                • memory/1048-247-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1612-170-0x00000277ED6C0000-0x00000277ED6D0000-memory.dmp

                  Filesize

                  64KB

                • memory/1612-168-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1612-318-0x00000277ED6C0000-0x00000277ED6D0000-memory.dmp

                  Filesize

                  64KB

                • memory/1796-311-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3036-319-0x000002AE005C0000-0x000002AE005D0000-memory.dmp

                  Filesize

                  64KB

                • memory/3036-283-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3036-298-0x000002AE005C0000-0x000002AE005D0000-memory.dmp

                  Filesize

                  64KB

                • memory/3328-303-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3328-304-0x0000020D26380000-0x0000020D26390000-memory.dmp

                  Filesize

                  64KB

                • memory/3532-171-0x000001E258A40000-0x000001E258A50000-memory.dmp

                  Filesize

                  64KB

                • memory/3532-167-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3532-169-0x000001E258A40000-0x000001E258A50000-memory.dmp

                  Filesize

                  64KB

                • memory/3532-314-0x000001E258A40000-0x000001E258A50000-memory.dmp

                  Filesize

                  64KB

                • memory/3756-307-0x00000278783A0000-0x00000278783B0000-memory.dmp

                  Filesize

                  64KB

                • memory/3756-306-0x00000278783A0000-0x00000278783B0000-memory.dmp

                  Filesize

                  64KB

                • memory/3756-305-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3924-300-0x00000177D6D80000-0x00000177D6D90000-memory.dmp

                  Filesize

                  64KB

                • memory/3924-315-0x00000177D6D80000-0x00000177D6D90000-memory.dmp

                  Filesize

                  64KB

                • memory/3924-296-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/3924-297-0x00000177D6D80000-0x00000177D6D90000-memory.dmp

                  Filesize

                  64KB

                • memory/3924-177-0x00000177D6D20000-0x00000177D6D42000-memory.dmp

                  Filesize

                  136KB

                • memory/4556-317-0x000001D0268D0000-0x000001D0268E0000-memory.dmp

                  Filesize

                  64KB

                • memory/4556-197-0x000001D0268D0000-0x000001D0268E0000-memory.dmp

                  Filesize

                  64KB

                • memory/4556-196-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4668-302-0x000002106A310000-0x000002106A320000-memory.dmp

                  Filesize

                  64KB

                • memory/4668-301-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4668-316-0x000002106A310000-0x000002106A320000-memory.dmp

                  Filesize

                  64KB

                • memory/4960-23-0x000000001C3A0000-0x000000001C3AC000-memory.dmp

                  Filesize

                  48KB

                • memory/4960-16-0x000000001C310000-0x000000001C318000-memory.dmp

                  Filesize

                  32KB

                • memory/4960-1-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4960-31-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

                  Filesize

                  64KB

                • memory/4960-94-0x000000001CB70000-0x000000001CC70000-memory.dmp

                  Filesize

                  1024KB

                • memory/4960-2-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

                  Filesize

                  64KB

                • memory/4960-0-0x0000000000E60000-0x0000000000FCC000-memory.dmp

                  Filesize

                  1.4MB

                • memory/4960-26-0x000000001C5D0000-0x000000001C5DC000-memory.dmp

                  Filesize

                  48KB

                • memory/4960-25-0x000000001C3C0000-0x000000001C3CA000-memory.dmp

                  Filesize

                  40KB

                • memory/4960-24-0x000000001C3B0000-0x000000001C3B8000-memory.dmp

                  Filesize

                  32KB

                • memory/4960-299-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/4960-22-0x000000001C390000-0x000000001C39E000-memory.dmp

                  Filesize

                  56KB

                • memory/4960-21-0x000000001C380000-0x000000001C388000-memory.dmp

                  Filesize

                  32KB

                • memory/4960-17-0x000000001C360000-0x000000001C36A000-memory.dmp

                  Filesize

                  40KB

                • memory/4960-20-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

                  Filesize

                  64KB

                • memory/4960-19-0x000000001C370000-0x000000001C37E000-memory.dmp

                  Filesize

                  56KB

                • memory/4960-18-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

                  Filesize

                  64KB

                • memory/4960-58-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

                  Filesize

                  64KB

                • memory/4960-15-0x000000001C200000-0x000000001C20C000-memory.dmp

                  Filesize

                  48KB

                • memory/4960-14-0x000000001C1F0000-0x000000001C1F8000-memory.dmp

                  Filesize

                  32KB

                • memory/4960-13-0x000000001C1E0000-0x000000001C1EC000-memory.dmp

                  Filesize

                  48KB

                • memory/4960-12-0x000000001C1D0000-0x000000001C1DC000-memory.dmp

                  Filesize

                  48KB

                • memory/4960-11-0x000000001C170000-0x000000001C17A000-memory.dmp

                  Filesize

                  40KB

                • memory/4960-10-0x000000001C160000-0x000000001C170000-memory.dmp

                  Filesize

                  64KB

                • memory/4960-9-0x000000001C140000-0x000000001C156000-memory.dmp

                  Filesize

                  88KB

                • memory/4960-8-0x000000001C130000-0x000000001C140000-memory.dmp

                  Filesize

                  64KB

                • memory/4960-7-0x000000001BBC0000-0x000000001BBC8000-memory.dmp

                  Filesize

                  32KB

                • memory/4960-6-0x000000001C180000-0x000000001C1D0000-memory.dmp

                  Filesize

                  320KB

                • memory/4960-5-0x000000001BBA0000-0x000000001BBBC000-memory.dmp

                  Filesize

                  112KB

                • memory/4960-4-0x0000000001910000-0x0000000001918000-memory.dmp

                  Filesize

                  32KB

                • memory/4960-3-0x00000000018F0000-0x00000000018FE000-memory.dmp

                  Filesize

                  56KB

                • memory/5028-310-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB

                • memory/5508-313-0x00007FFD901B0000-0x00007FFD90C71000-memory.dmp

                  Filesize

                  10.8MB