Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 05:25

General

  • Target

    857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe

  • Size

    3.2MB

  • MD5

    857ee271fe97719273d3a7df9586c7b0

  • SHA1

    a815a6730abd1044c011e71a142e7d2aa370ba81

  • SHA256

    ba26bbdfefe435d7ccf3bed77eeacdb9078a87468bce53916a05e6ed62091d77

  • SHA512

    1bc69d4932d44fcaff533257d9b0ffca80714ec766bd676052d84a2b0e3ae2d71fbb936420d2a243d288a3ee468e9f41667a192ccd4ebd846e7595dbcfea0186

  • SSDEEP

    49152:HC0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:HC0Fl8v/qXYrv5tG9uKJGAWl5N

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 24 IoCs
  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 16 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4660
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:592
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4656
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4972
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2252
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:940
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2192
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2188
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4076
    • C:\Windows\Offline Web Pages\fontdrvhost.exe
      "C:\Windows\Offline Web Pages\fontdrvhost.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3936
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb146de3-f490-45cb-b8da-3cc43b2b168d.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Windows\Offline Web Pages\fontdrvhost.exe
          "C:\Windows\Offline Web Pages\fontdrvhost.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4916
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6996dda1-fa2e-4f02-86af-bc6947a5e7fd.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4108
            • C:\Windows\Offline Web Pages\fontdrvhost.exe
              "C:\Windows\Offline Web Pages\fontdrvhost.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1500
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93d53960-2fb3-476d-98e9-ed7c6309ecf8.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4760
                • C:\Windows\Offline Web Pages\fontdrvhost.exe
                  "C:\Windows\Offline Web Pages\fontdrvhost.exe"
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4908
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39eb1c80-1c3f-49bf-ab0d-0426b4b80b6a.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4336
                    • C:\Windows\Offline Web Pages\fontdrvhost.exe
                      "C:\Windows\Offline Web Pages\fontdrvhost.exe"
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:436
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5adfa961-521b-4a1b-957b-1b028c305ac3.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:844
                        • C:\Windows\Offline Web Pages\fontdrvhost.exe
                          "C:\Windows\Offline Web Pages\fontdrvhost.exe"
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4352
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\877794ec-c394-488f-9263-a2718a7d7df0.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4152
                            • C:\Windows\Offline Web Pages\fontdrvhost.exe
                              "C:\Windows\Offline Web Pages\fontdrvhost.exe"
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:4556
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97a8278b-354d-4548-ae14-2c15b69577a9.vbs"
                                15⤵
                                  PID:3324
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0c93835-c5ca-4b76-94c9-43421d76d0f8.vbs"
                                  15⤵
                                    PID:2900
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6eaca409-40fa-452e-a315-3c747ffee63d.vbs"
                                13⤵
                                  PID:2856
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a1470ba-11f3-483d-ad67-6b8e9523efdf.vbs"
                              11⤵
                                PID:4160
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\491e2dc5-b229-45c8-a2c3-33175ac82fd8.vbs"
                            9⤵
                              PID:1952
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11fd0a3c-eeab-4b7c-95ca-91435b96eb2d.vbs"
                          7⤵
                            PID:3608
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af6891dc-0fde-4e47-a6c5-e2f4a342facf.vbs"
                        5⤵
                          PID:2188
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a40b1f81-bc61-4c34-9e64-f3228d9997c6.vbs"
                      3⤵
                        PID:1760
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Windows\SoftwareDistribution\SLS\SppExtComObj.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:376
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\SLS\SppExtComObj.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4748
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\SoftwareDistribution\SLS\SppExtComObj.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2948
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\IMETC\dllhost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4808
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\IME\IMETC\dllhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2780
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\IMETC\dllhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3408
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2772
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:392
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4160
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\shared\wininit.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4608
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\wininit.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2256
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\shared\wininit.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4516
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3488
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:452
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4400
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\OfficeClickToRun.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2228
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:744
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4440
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3644
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1864
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2352
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre-1.8\lib\ext\explorer.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4152
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\lib\ext\explorer.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3324
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jre-1.8\lib\ext\explorer.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2856

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files\dotnet\shared\wininit.exe

                    Filesize

                    3.2MB

                    MD5

                    cabcdf952989b1dcf1b586df3edbc36d

                    SHA1

                    5c8ac76273f3b1a08c4489b82719c7fdf03f24cd

                    SHA256

                    8fd73e3ddbcf491d5420e7de32c35823f6b2b81705c4cdb0766616c862fcff70

                    SHA512

                    906405863779c66e38b365ce0bd1c942c5a482c19c32cad11ca391bdc444f0b1fcc0b456d26e958dc50ffd730dc52654e0378f9f090d9688524979cd07d51271

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

                    Filesize

                    1KB

                    MD5

                    49b64127208271d8f797256057d0b006

                    SHA1

                    b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                    SHA256

                    2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                    SHA512

                    f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                    Filesize

                    2KB

                    MD5

                    d85ba6ff808d9e5444a4b369f5bc2730

                    SHA1

                    31aa9d96590fff6981b315e0b391b575e4c0804a

                    SHA256

                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                    SHA512

                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Filesize

                    944B

                    MD5

                    cadef9abd087803c630df65264a6c81c

                    SHA1

                    babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                    SHA256

                    cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                    SHA512

                    7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Filesize

                    944B

                    MD5

                    d28a889fd956d5cb3accfbaf1143eb6f

                    SHA1

                    157ba54b365341f8ff06707d996b3635da8446f7

                    SHA256

                    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                    SHA512

                    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Filesize

                    944B

                    MD5

                    6d3e9c29fe44e90aae6ed30ccf799ca8

                    SHA1

                    c7974ef72264bbdf13a2793ccf1aed11bc565dce

                    SHA256

                    2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                    SHA512

                    60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Filesize

                    944B

                    MD5

                    62623d22bd9e037191765d5083ce16a3

                    SHA1

                    4a07da6872672f715a4780513d95ed8ddeefd259

                    SHA256

                    95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                    SHA512

                    9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Filesize

                    944B

                    MD5

                    59d97011e091004eaffb9816aa0b9abd

                    SHA1

                    1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                    SHA256

                    18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                    SHA512

                    d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Filesize

                    944B

                    MD5

                    bd5940f08d0be56e65e5f2aaf47c538e

                    SHA1

                    d7e31b87866e5e383ab5499da64aba50f03e8443

                    SHA256

                    2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                    SHA512

                    c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                  • C:\Users\Admin\AppData\Local\Temp\39eb1c80-1c3f-49bf-ab0d-0426b4b80b6a.vbs

                    Filesize

                    720B

                    MD5

                    10ad04f438918aa61f8d68d813d239e4

                    SHA1

                    a6e2c1022e306db266293684fb11a984371ce5c5

                    SHA256

                    c14dde9a2502239511087c3d84c307a36c933c988f732cf01bd3e8be3dd5ce9e

                    SHA512

                    ffa145cff80336323a7699c2239bb71561965ffd9dd933781a8f9c989d282c7c981e493fa05e8b4ace33ab5fad4db0920feb685daf7af636cea06ed68acb45b3

                  • C:\Users\Admin\AppData\Local\Temp\5adfa961-521b-4a1b-957b-1b028c305ac3.vbs

                    Filesize

                    719B

                    MD5

                    500d969219a1b78b46ccf71efb4a9ae5

                    SHA1

                    3b5ff74cfee5e0a2b49bf946245d1176a955db2b

                    SHA256

                    7f5071aa438514db1dc7909e5f75326b7785ad12a2465dea0e48180600f476da

                    SHA512

                    c4576df0f318015b353ddf506365494b84d2441f67592f934c5753df7ad893d9973a6401904acf123ce8d2606907b7eccacbb4df873b2c6778675c79cb7904f7

                  • C:\Users\Admin\AppData\Local\Temp\6996dda1-fa2e-4f02-86af-bc6947a5e7fd.vbs

                    Filesize

                    720B

                    MD5

                    4b4b888228078efe9c1117b2e797bd0a

                    SHA1

                    f219e9c2546f551c34272756a8d6cc5548f7eb44

                    SHA256

                    f1b39bcd210df30160a30febb9baa27c614baa8d539cec66f0bf80616551d778

                    SHA512

                    3dffb50e88e6c2d2a5fb12976d7ac5d3a41c649ef0341c92dc71664a50c4f6bc2fa4b02d5db5d02b860b9934d5f8818b2f7fbcbabc8d1472e2487571ca89da3b

                  • C:\Users\Admin\AppData\Local\Temp\877794ec-c394-488f-9263-a2718a7d7df0.vbs

                    Filesize

                    720B

                    MD5

                    7d102d6e9348f2f8af743b6c14528db4

                    SHA1

                    9aefe7bd690927d98c464fe2b3ad16fb7d2dd5cd

                    SHA256

                    20e866fc6192f2c3bcd7c8a571a40c45cc56766906858116813da2aa72991868

                    SHA512

                    be07d352d6fcf33ff5429e18149db86ef69a5e5a7eaae30620275222dc6f393dd15151bdaeab7fa3fe092590b0fee4dab471a145ad3b9a6766306e5408ceb592

                  • C:\Users\Admin\AppData\Local\Temp\93d53960-2fb3-476d-98e9-ed7c6309ecf8.vbs

                    Filesize

                    720B

                    MD5

                    f9afc1708a1c9cc03292fae89514d39a

                    SHA1

                    3479a0ee9571ae2d88e71f8728ae564014a114e4

                    SHA256

                    46d1aa129237b641ee2cca72791ef77163291594c944c8b42af4103e204845f6

                    SHA512

                    c6c53f60ce4e429df63ee115ce7444f0052b6868790a19089132941a4451688dafc818df34bbe7e63d708d161e78c10f65463ff25bfa569387d8f1a9daf430f1

                  • C:\Users\Admin\AppData\Local\Temp\97a8278b-354d-4548-ae14-2c15b69577a9.vbs

                    Filesize

                    720B

                    MD5

                    9bf8190e99968221f24843cce7b37bc4

                    SHA1

                    dd382136e22b9eba85f71f262e6a641579553faf

                    SHA256

                    f3e8ec0b04804add0e8a0055592d90196a460bfe8c4dfcf947ee0366f624a60f

                    SHA512

                    14b23af230b1848f4e7c961f6ea4eac3641b16420070199c051d5afc6dce36b4882be418a817fb2d5cf563d06e208bd9ab55ed621630c3dc81fd142092a4005f

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g1rmqi2u.4jw.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\a40b1f81-bc61-4c34-9e64-f3228d9997c6.vbs

                    Filesize

                    496B

                    MD5

                    4f7b81c12ab5a7a3f26633c268149aa5

                    SHA1

                    7ae140e9d9c3184aaf64a2925891b20b1306ad19

                    SHA256

                    b3b55938d085ed03e82c620d6eba6764a02be786e79264d7ebd546563ec7febb

                    SHA512

                    02b1fddc637fedeb8cd85a485191b742414f03791dd9cbec8088c25694b915bff4be468a720c8ddba1884040357b774fe02a8cfff378a5448bed5e5b662c4ffb

                  • C:\Users\Admin\AppData\Local\Temp\fb146de3-f490-45cb-b8da-3cc43b2b168d.vbs

                    Filesize

                    720B

                    MD5

                    b8aa3a30aa85ea689e75a1a5219ca0e7

                    SHA1

                    1b5309a9db78991d794295fc94ffb04ba1fce683

                    SHA256

                    3276b9eac3291f16ee8845e6b7612a48aac2362a990ffc2a482a46b3dc860d14

                    SHA512

                    ea0e30b6ce6168a1829a964110941c096f1c703c0e8de7a9165769c9942ec2b330b0621b79cd084a9d2629ec7f66a0414604eb659ab307bf80d6b43511f41516

                  • C:\Windows\Offline Web Pages\fontdrvhost.exe

                    Filesize

                    3.2MB

                    MD5

                    2bd5876b597219f632c54705251c99a2

                    SHA1

                    90f6f22512e2297f43eb8104d492bf54f66d8a69

                    SHA256

                    52ab03f6941c21fb953f011d4f3de15c92fc566229ce42b1b2b1672c85683d6d

                    SHA512

                    ade4bff02bc00fbb137e9a450b612583685c9ffffaa222d4b48d98568fe76fedfa7d7a7201aa9630b70a02dc8ce106b5fc81be6dcd7ed4bbd46e5f51961d2881

                  • C:\Windows\Offline Web Pages\fontdrvhost.exe

                    Filesize

                    3.2MB

                    MD5

                    857ee271fe97719273d3a7df9586c7b0

                    SHA1

                    a815a6730abd1044c011e71a142e7d2aa370ba81

                    SHA256

                    ba26bbdfefe435d7ccf3bed77eeacdb9078a87468bce53916a05e6ed62091d77

                    SHA512

                    1bc69d4932d44fcaff533257d9b0ffca80714ec766bd676052d84a2b0e3ae2d71fbb936420d2a243d288a3ee468e9f41667a192ccd4ebd846e7595dbcfea0186

                  • memory/3032-15-0x0000000003450000-0x000000000345C000-memory.dmp

                    Filesize

                    48KB

                  • memory/3032-12-0x0000000003430000-0x0000000003440000-memory.dmp

                    Filesize

                    64KB

                  • memory/3032-22-0x000000001C550000-0x000000001C55C000-memory.dmp

                    Filesize

                    48KB

                  • memory/3032-23-0x000000001C560000-0x000000001C56C000-memory.dmp

                    Filesize

                    48KB

                  • memory/3032-24-0x000000001C570000-0x000000001C57C000-memory.dmp

                    Filesize

                    48KB

                  • memory/3032-29-0x000000001C7C0000-0x000000001C7CE000-memory.dmp

                    Filesize

                    56KB

                  • memory/3032-30-0x000000001C7D0000-0x000000001C7DC000-memory.dmp

                    Filesize

                    48KB

                  • memory/3032-32-0x000000001C830000-0x000000001C83A000-memory.dmp

                    Filesize

                    40KB

                  • memory/3032-33-0x000000001C840000-0x000000001C84C000-memory.dmp

                    Filesize

                    48KB

                  • memory/3032-34-0x00007FFCAA420000-0x00007FFCAAEE1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/3032-31-0x000000001C820000-0x000000001C828000-memory.dmp

                    Filesize

                    32KB

                  • memory/3032-28-0x000000001C7B0000-0x000000001C7B8000-memory.dmp

                    Filesize

                    32KB

                  • memory/3032-27-0x000000001C6A0000-0x000000001C6AE000-memory.dmp

                    Filesize

                    56KB

                  • memory/3032-26-0x000000001C690000-0x000000001C69A000-memory.dmp

                    Filesize

                    40KB

                  • memory/3032-25-0x000000001C680000-0x000000001C688000-memory.dmp

                    Filesize

                    32KB

                  • memory/3032-37-0x00007FFCAA420000-0x00007FFCAAEE1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/3032-20-0x000000001CA70000-0x000000001CF98000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/3032-19-0x000000001C510000-0x000000001C522000-memory.dmp

                    Filesize

                    72KB

                  • memory/3032-18-0x000000001C500000-0x000000001C508000-memory.dmp

                    Filesize

                    32KB

                  • memory/3032-1-0x0000000000E20000-0x000000000115C000-memory.dmp

                    Filesize

                    3.2MB

                  • memory/3032-17-0x000000001C4F0000-0x000000001C4FC000-memory.dmp

                    Filesize

                    48KB

                  • memory/3032-296-0x00007FFCAA420000-0x00007FFCAAEE1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/3032-2-0x00007FFCAA420000-0x00007FFCAAEE1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/3032-16-0x000000001C4E0000-0x000000001C4E8000-memory.dmp

                    Filesize

                    32KB

                  • memory/3032-0-0x00007FFCAA423000-0x00007FFCAA425000-memory.dmp

                    Filesize

                    8KB

                  • memory/3032-14-0x000000001C490000-0x000000001C4E6000-memory.dmp

                    Filesize

                    344KB

                  • memory/3032-13-0x0000000003440000-0x000000000344A000-memory.dmp

                    Filesize

                    40KB

                  • memory/3032-7-0x000000001C440000-0x000000001C490000-memory.dmp

                    Filesize

                    320KB

                  • memory/3032-21-0x000000001C540000-0x000000001C54C000-memory.dmp

                    Filesize

                    48KB

                  • memory/3032-10-0x0000000003400000-0x0000000003416000-memory.dmp

                    Filesize

                    88KB

                  • memory/3032-3-0x0000000003390000-0x000000000339E000-memory.dmp

                    Filesize

                    56KB

                  • memory/3032-11-0x0000000003420000-0x0000000003428000-memory.dmp

                    Filesize

                    32KB

                  • memory/3032-8-0x00000000033E0000-0x00000000033E8000-memory.dmp

                    Filesize

                    32KB

                  • memory/3032-9-0x00000000033F0000-0x0000000003400000-memory.dmp

                    Filesize

                    64KB

                  • memory/3032-5-0x00000000033B0000-0x00000000033B8000-memory.dmp

                    Filesize

                    32KB

                  • memory/3032-6-0x00000000033C0000-0x00000000033DC000-memory.dmp

                    Filesize

                    112KB

                  • memory/3032-4-0x00000000033A0000-0x00000000033AE000-memory.dmp

                    Filesize

                    56KB

                  • memory/3936-321-0x000000001B6A0000-0x000000001B6F6000-memory.dmp

                    Filesize

                    344KB

                  • memory/3936-297-0x0000000000630000-0x000000000096C000-memory.dmp

                    Filesize

                    3.2MB

                  • memory/4656-190-0x000002D99DD90000-0x000002D99DDB2000-memory.dmp

                    Filesize

                    136KB