Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 05:55

General

  • Target

    9053e1e0f0dc79857427f7ef64fa3530_NeikiAnalytics.exe

  • Size

    3.2MB

  • MD5

    9053e1e0f0dc79857427f7ef64fa3530

  • SHA1

    93298ff5140f6ba9724e31dda271148cd73c7511

  • SHA256

    5e18fece13e186284ad707df63c1d44b117dbffd5da5b814ebf1a68647679c5b

  • SHA512

    9bbcb60546639f4b995a817978c4f3331933fbf7dd409c2b1d06c84aeef1b437cd8e750abdf8dccafb558f5d68fe2f98f42feaeb01ccbee8934147f575cf5657

  • SSDEEP

    49152:/C0Fl8v/911bwaEYpdYUVsk3DZGAy55kBsfJGAW6KyWUcPmWQpE:/C0Fl8v/qXYrv5tG9uKJGAWl5N

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 24 IoCs
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 16 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9053e1e0f0dc79857427f7ef64fa3530_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9053e1e0f0dc79857427f7ef64fa3530_NeikiAnalytics.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1376
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4832
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4044
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4884
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:608
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1468
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2448
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1184
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2172
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m147yiIR6h.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:3900
        • C:\Program Files\WindowsPowerShell\Modules\dwm.exe
          "C:\Program Files\WindowsPowerShell\Modules\dwm.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3540
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7fd8752-89d6-4448-8864-7c6d7045c7d5.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1988
            • C:\Program Files\WindowsPowerShell\Modules\dwm.exe
              "C:\Program Files\WindowsPowerShell\Modules\dwm.exe"
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4460
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\592e7e33-f2df-47c9-9801-ccf9282b1397.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4356
                • C:\Program Files\WindowsPowerShell\Modules\dwm.exe
                  "C:\Program Files\WindowsPowerShell\Modules\dwm.exe"
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2424
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\937f4753-aa2a-4fc2-9a58-fd4eb9f790e6.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3740
                    • C:\Program Files\WindowsPowerShell\Modules\dwm.exe
                      "C:\Program Files\WindowsPowerShell\Modules\dwm.exe"
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:5068
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1206b3d4-8717-4578-8f5b-aa3423e1cac0.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4628
                        • C:\Program Files\WindowsPowerShell\Modules\dwm.exe
                          "C:\Program Files\WindowsPowerShell\Modules\dwm.exe"
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:424
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7197520a-4f41-40b3-b808-c13c64840f09.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4472
                            • C:\Program Files\WindowsPowerShell\Modules\dwm.exe
                              "C:\Program Files\WindowsPowerShell\Modules\dwm.exe"
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:1476
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\729a664b-a9de-488d-9df4-6937727967b5.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3040
                                • C:\Program Files\WindowsPowerShell\Modules\dwm.exe
                                  "C:\Program Files\WindowsPowerShell\Modules\dwm.exe"
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:1724
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70378bee-d86b-4fd6-a505-27d597c32a17.vbs"
                                    16⤵
                                      PID:3292
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e40eb784-9f3f-4fd9-992c-a2a05b4f8bd0.vbs"
                                      16⤵
                                        PID:4296
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9d8b9cc-326d-47e3-83a2-c2a0235b53c6.vbs"
                                    14⤵
                                      PID:4464
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4010bdd-1af1-46ab-b6db-933d54956e73.vbs"
                                  12⤵
                                    PID:4000
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\abe0f827-f4aa-4aa5-9115-dff9fc0f0c92.vbs"
                                10⤵
                                  PID:752
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\564346af-8872-4f9a-9087-4bb03a14c8c5.vbs"
                              8⤵
                                PID:2448
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f88d8242-e00c-4d97-9157-1bf4d49c4e05.vbs"
                            6⤵
                              PID:1052
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9877992c-a2b3-444f-aedb-cb4a50dd59bb.vbs"
                          4⤵
                            PID:4780
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\Modules\dwm.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:748
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\dwm.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:4404
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Modules\dwm.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:4608
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:3740
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:2644
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:4652
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Sun\Java\Deployment\csrss.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:544
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Sun\Java\Deployment\csrss.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:4468
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Sun\Java\Deployment\csrss.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:2732
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\fontdrvhost.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:1972
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\fontdrvhost.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:1664
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Desktop\fontdrvhost.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:4512
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Users\Public\backgroundTaskHost.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:4892
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Public\backgroundTaskHost.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:4588
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Users\Public\backgroundTaskHost.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:4976

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log

                      Filesize

                      1KB

                      MD5

                      49b64127208271d8f797256057d0b006

                      SHA1

                      b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                      SHA256

                      2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                      SHA512

                      f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      d85ba6ff808d9e5444a4b369f5bc2730

                      SHA1

                      31aa9d96590fff6981b315e0b391b575e4c0804a

                      SHA256

                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                      SHA512

                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      944B

                      MD5

                      bd5940f08d0be56e65e5f2aaf47c538e

                      SHA1

                      d7e31b87866e5e383ab5499da64aba50f03e8443

                      SHA256

                      2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                      SHA512

                      c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      944B

                      MD5

                      e243a38635ff9a06c87c2a61a2200656

                      SHA1

                      ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                      SHA256

                      af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                      SHA512

                      4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      944B

                      MD5

                      59d97011e091004eaffb9816aa0b9abd

                      SHA1

                      1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                      SHA256

                      18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                      SHA512

                      d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      944B

                      MD5

                      cadef9abd087803c630df65264a6c81c

                      SHA1

                      babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                      SHA256

                      cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                      SHA512

                      7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                    • C:\Users\Admin\AppData\Local\Temp\1206b3d4-8717-4578-8f5b-aa3423e1cac0.vbs

                      Filesize

                      726B

                      MD5

                      1ce417bf070fa03c3ad94720dac8c1a0

                      SHA1

                      812f9f9b4f267d23b5bb8f6cdf9f5c302469e4f3

                      SHA256

                      32e9036a6d24c90b022a6d2ff3b45df50fda070ade4b3cf08392791ee85bfdd6

                      SHA512

                      0b9894570e7c5fc09714a47ee8ffe003bf2ed4612ca3470b87f65812204d8b440449a3d0f38227319be2fa21f5993ff2e12858f25704fb80b541cfe5bad118f2

                    • C:\Users\Admin\AppData\Local\Temp\592e7e33-f2df-47c9-9801-ccf9282b1397.vbs

                      Filesize

                      726B

                      MD5

                      71ec42d4b4aec18cc266246c8e0caccf

                      SHA1

                      535ebca33fc025dd9bdf013a91b29b1358fc43f0

                      SHA256

                      614264d8c644795cd12d8ee13eddf1a7e8fd87a515f0f7978e1ace39576656ba

                      SHA512

                      507e0b3306e095d5e61ee75d493589c93ed7c0bbb8f0ac22b38db407e56c7cb4691fe3a059fe8707c82e0f9f2725522053297c76d5b731d840676d1479acc051

                    • C:\Users\Admin\AppData\Local\Temp\70378bee-d86b-4fd6-a505-27d597c32a17.vbs

                      Filesize

                      726B

                      MD5

                      8609acdee9a2eb5672d54fcef62d59a6

                      SHA1

                      9474a1aab3eca1e161ee4282b364f0642f1624f1

                      SHA256

                      6d7b32dd1798cda3ea22141d2cc3f852315b06ed63dad26187ebf463eafc9921

                      SHA512

                      8ddbb38efcdf8ac5bbeb11aba91c52b65a0aceaf8acd8c138b5c614a23a594ae0f07ca2c804d8824b03b2b6d3a2d0b0888f0532bffe5f45a31ff0e193032fbab

                    • C:\Users\Admin\AppData\Local\Temp\7197520a-4f41-40b3-b808-c13c64840f09.vbs

                      Filesize

                      725B

                      MD5

                      a24992b745863be63aafc63cbaa92a0a

                      SHA1

                      1575579fff8c470d16d5746400f82dcfcac06dee

                      SHA256

                      ca5c468a6a1568be2d4060b2dec99f0e654a7bf7367c262795e8ca903e824498

                      SHA512

                      9719daa1522e51e4a4f5ea8a6f9c77b47328ee2c4dd7e2b279f398b9a1c479f584c3e544227ad4960be2d5e89b6c292afba328c8133b8dff154853073f1f09c1

                    • C:\Users\Admin\AppData\Local\Temp\729a664b-a9de-488d-9df4-6937727967b5.vbs

                      Filesize

                      726B

                      MD5

                      dfd00aa7b7f5367e5389241a76569963

                      SHA1

                      4489baf1c07fef754282d994690e1be9fe07969e

                      SHA256

                      221149faba8aca81146d2ef336890957eab99d47fb3caf20276d2e575a3a0c92

                      SHA512

                      9b00c7d6c7e4d61448d07c009132f838c121c08207da913b4bd8ae526575658aed424fb65723eaf6981104bfd2742b253dca46650d8766bf8f06f8b48632b315

                    • C:\Users\Admin\AppData\Local\Temp\937f4753-aa2a-4fc2-9a58-fd4eb9f790e6.vbs

                      Filesize

                      726B

                      MD5

                      13f41cb4280c82e227fedbf01153696d

                      SHA1

                      fec6995c10ef46f4202614aebfca26ce5be99653

                      SHA256

                      c9b39b009158cde362c26218bbc67c6646c23773d79b5c859986de1bcd122017

                      SHA512

                      99dc4d7a7e99386ee5fe3691c4e4782b8a467b2dfbed8a352b029f18d3fce5629ecc1bc70fbe017571060753f2baef1384d8f8d7f4586986fb927579095550ab

                    • C:\Users\Admin\AppData\Local\Temp\9877992c-a2b3-444f-aedb-cb4a50dd59bb.vbs

                      Filesize

                      502B

                      MD5

                      51e4701212e749bc1229319ca50148c2

                      SHA1

                      356b560a2dae989354759234404681a23cfdc299

                      SHA256

                      e49de2ba26f710d97ecbd343ea775f90e981ef7d1ef1e7016a04608d85c6b839

                      SHA512

                      d8387fcd4e037993a6c9a05a5bedaa4d97cd710928efb86f6bcaeed1aeee639d7daae67d43e52a4a4c72ebaf5bc6ed9ce350d00b127ffc1de19114714dcb3c9f

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wvsd2rlu.rkm.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Admin\AppData\Local\Temp\c7fd8752-89d6-4448-8864-7c6d7045c7d5.vbs

                      Filesize

                      726B

                      MD5

                      d1fa70fc4202823d3726f8cba1f44117

                      SHA1

                      0ecc67a972a17bac55268bcf810729dee9ac9213

                      SHA256

                      e4e1fb86706ee252a2d5e722abf03962b32b306e47cb450532ad62a471cff5c8

                      SHA512

                      4e8d3f977216e34d5c4c53ce577a04c97ef02b38bd420488051b483e32f6265f9da3023d6b678891b4aedaa308734054baeee1d51070cefb5db6ec1c2366e9c0

                    • C:\Users\Admin\AppData\Local\Temp\m147yiIR6h.bat

                      Filesize

                      215B

                      MD5

                      09b8411ba466040f0a065eb6d98e0be0

                      SHA1

                      c98300c16d20b5ee0f7d7290d004ebf61f65177b

                      SHA256

                      5738b4823fef6d05561068072a1bad26b9dc3f5570b086fbcbc0920f171f3756

                      SHA512

                      1af230a4adcde6102bf0a79a000f6a2f3d126fe9b836d33286a560e9678669fd242a4c2c5d48cdf262a0dc420ae22f7a3657b908ad3960f2cac03a127cb3498b

                    • C:\Users\Public\backgroundTaskHost.exe

                      Filesize

                      3.2MB

                      MD5

                      9053e1e0f0dc79857427f7ef64fa3530

                      SHA1

                      93298ff5140f6ba9724e31dda271148cd73c7511

                      SHA256

                      5e18fece13e186284ad707df63c1d44b117dbffd5da5b814ebf1a68647679c5b

                      SHA512

                      9bbcb60546639f4b995a817978c4f3331933fbf7dd409c2b1d06c84aeef1b437cd8e750abdf8dccafb558f5d68fe2f98f42feaeb01ccbee8934147f575cf5657

                    • C:\Users\Public\backgroundTaskHost.exe

                      Filesize

                      3.2MB

                      MD5

                      a51a454388eeb9a95270a31ad6546ab7

                      SHA1

                      38d98cc56621361c308be94b0eb0cc57126cca40

                      SHA256

                      1da7b4de76527f3399f153cef1a74196f60cfc5f79314d7b66f0af2e4f0ee721

                      SHA512

                      4fb2c8b697b59c371054f1c1065e306c07ef3d2fecb7c20bf8ee6184fe6d99da29199722964c22f1711c2fa9b28dae08aed498883d4046cbcd28c41e924b493f

                    • C:\Windows\Sun\Java\Deployment\csrss.exe

                      Filesize

                      3.2MB

                      MD5

                      5db8c33266adeb678c51b9d076bb7b94

                      SHA1

                      3f5aeb36a3332ee9921f2c08802433f4144e9ac7

                      SHA256

                      5930f06bbd50ed3c90c39d186758521d062ce5f45bde52c31f62b62c88e26cf7

                      SHA512

                      1194e23793a8faf0acab2af83c73599ffb992af9942e7655f10543fa2ca1526e604e9910fa0db7922670a8dd75f7c658fd1fdb9128c426d1219377bfd23cb767

                    • memory/1376-14-0x000000001C410000-0x000000001C466000-memory.dmp

                      Filesize

                      344KB

                    • memory/1376-18-0x000000001C470000-0x000000001C478000-memory.dmp

                      Filesize

                      32KB

                    • memory/1376-21-0x000000001C4B0000-0x000000001C4BC000-memory.dmp

                      Filesize

                      48KB

                    • memory/1376-22-0x000000001C4C0000-0x000000001C4CC000-memory.dmp

                      Filesize

                      48KB

                    • memory/1376-23-0x000000001C4D0000-0x000000001C4DC000-memory.dmp

                      Filesize

                      48KB

                    • memory/1376-24-0x000000001C4E0000-0x000000001C4EC000-memory.dmp

                      Filesize

                      48KB

                    • memory/1376-25-0x000000001C560000-0x000000001C568000-memory.dmp

                      Filesize

                      32KB

                    • memory/1376-30-0x000000001C520000-0x000000001C52C000-memory.dmp

                      Filesize

                      48KB

                    • memory/1376-33-0x000000001C550000-0x000000001C55C000-memory.dmp

                      Filesize

                      48KB

                    • memory/1376-31-0x000000001C530000-0x000000001C538000-memory.dmp

                      Filesize

                      32KB

                    • memory/1376-29-0x000000001C780000-0x000000001C78E000-memory.dmp

                      Filesize

                      56KB

                    • memory/1376-28-0x000000001C510000-0x000000001C518000-memory.dmp

                      Filesize

                      32KB

                    • memory/1376-27-0x000000001C500000-0x000000001C50E000-memory.dmp

                      Filesize

                      56KB

                    • memory/1376-26-0x000000001C4F0000-0x000000001C4FA000-memory.dmp

                      Filesize

                      40KB

                    • memory/1376-32-0x000000001C540000-0x000000001C54A000-memory.dmp

                      Filesize

                      40KB

                    • memory/1376-36-0x00007FF9F8B40000-0x00007FF9F9601000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1376-37-0x00007FF9F8B40000-0x00007FF9F9601000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1376-38-0x00007FF9F8B40000-0x00007FF9F9601000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1376-19-0x000000001C480000-0x000000001C492000-memory.dmp

                      Filesize

                      72KB

                    • memory/1376-20-0x000000001CAB0000-0x000000001CFD8000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/1376-17-0x000000001C570000-0x000000001C57C000-memory.dmp

                      Filesize

                      48KB

                    • memory/1376-1-0x0000000000DA0000-0x00000000010DC000-memory.dmp

                      Filesize

                      3.2MB

                    • memory/1376-16-0x000000001C460000-0x000000001C468000-memory.dmp

                      Filesize

                      32KB

                    • memory/1376-126-0x00007FF9F8B40000-0x00007FF9F9601000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1376-15-0x000000001BDF0000-0x000000001BDFC000-memory.dmp

                      Filesize

                      48KB

                    • memory/1376-0-0x00007FF9F8B43000-0x00007FF9F8B45000-memory.dmp

                      Filesize

                      8KB

                    • memory/1376-13-0x000000001BD80000-0x000000001BD8A000-memory.dmp

                      Filesize

                      40KB

                    • memory/1376-12-0x000000001BD70000-0x000000001BD80000-memory.dmp

                      Filesize

                      64KB

                    • memory/1376-10-0x000000001BD40000-0x000000001BD56000-memory.dmp

                      Filesize

                      88KB

                    • memory/1376-11-0x000000001BD60000-0x000000001BD68000-memory.dmp

                      Filesize

                      32KB

                    • memory/1376-8-0x000000001BD20000-0x000000001BD28000-memory.dmp

                      Filesize

                      32KB

                    • memory/1376-9-0x000000001BD30000-0x000000001BD40000-memory.dmp

                      Filesize

                      64KB

                    • memory/1376-7-0x000000001BDA0000-0x000000001BDF0000-memory.dmp

                      Filesize

                      320KB

                    • memory/1376-6-0x0000000003220000-0x000000000323C000-memory.dmp

                      Filesize

                      112KB

                    • memory/1376-5-0x0000000003210000-0x0000000003218000-memory.dmp

                      Filesize

                      32KB

                    • memory/1376-4-0x0000000001A10000-0x0000000001A1E000-memory.dmp

                      Filesize

                      56KB

                    • memory/1376-3-0x0000000001A00000-0x0000000001A0E000-memory.dmp

                      Filesize

                      56KB

                    • memory/1376-2-0x00007FF9F8B40000-0x00007FF9F9601000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1468-125-0x0000027D72870000-0x0000027D72892000-memory.dmp

                      Filesize

                      136KB