Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 07:21

General

  • Target

    a2076a85de5c50013fd48e423e2c2050_NeikiAnalytics.exe

  • Size

    2.9MB

  • MD5

    a2076a85de5c50013fd48e423e2c2050

  • SHA1

    4ef4d4fd4cf21287ccb37baa4fc8a4efa31b6bd6

  • SHA256

    296ff7111b13564c6bffbc590f46a21188c873f95658d756c22425584453b9b6

  • SHA512

    ff45a43830600f097569378af3d957346f2e66bfbf65f5a89ba592c5b90ef0759bf7a587914fb84c3406b6624c2301652ed30440cde9701d18bdf68b46cfa1a3

  • SSDEEP

    49152:f4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:QDKmzjWnC8Wikx1DUN2/Uq

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 45 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 45 IoCs
  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 30 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 45 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2076a85de5c50013fd48e423e2c2050_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a2076a85de5c50013fd48e423e2c2050_NeikiAnalytics.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:720
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2136
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4772
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3496
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3748
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2676
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4648
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2404
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3268
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5004
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\48sAkNrSAB.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1508
        • C:\Recovery\WindowsRE\RuntimeBroker.exe
          "C:\Recovery\WindowsRE\RuntimeBroker.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3972
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5df52fb-3bd3-4eb9-aabe-947f1aeafc7b.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\Recovery\WindowsRE\RuntimeBroker.exe
              C:\Recovery\WindowsRE\RuntimeBroker.exe
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3228
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d944b65c-516e-444a-aa07-44664e8f62a3.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4348
                • C:\Recovery\WindowsRE\RuntimeBroker.exe
                  C:\Recovery\WindowsRE\RuntimeBroker.exe
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:720
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\040bc938-c31f-4199-b6f0-f70d235aa631.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3136
                    • C:\Recovery\WindowsRE\RuntimeBroker.exe
                      C:\Recovery\WindowsRE\RuntimeBroker.exe
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:952
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7de3ee7f-0f4b-4176-869d-240c966af155.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1912
                        • C:\Recovery\WindowsRE\RuntimeBroker.exe
                          C:\Recovery\WindowsRE\RuntimeBroker.exe
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:2232
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af082c4d-682c-419d-993d-b683b10828a4.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4436
                            • C:\Recovery\WindowsRE\RuntimeBroker.exe
                              C:\Recovery\WindowsRE\RuntimeBroker.exe
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:5056
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d09534af-13c7-4de7-a5b2-ee4846e35e3a.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4608
                                • C:\Recovery\WindowsRE\RuntimeBroker.exe
                                  C:\Recovery\WindowsRE\RuntimeBroker.exe
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:3504
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1682fb79-f2b1-4ae9-8e82-0eabf573fdec.vbs"
                                    16⤵
                                      PID:2640
                                      • C:\Recovery\WindowsRE\RuntimeBroker.exe
                                        C:\Recovery\WindowsRE\RuntimeBroker.exe
                                        17⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:2304
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d901daf0-d811-4b88-8d66-21b62690b5b1.vbs"
                                          18⤵
                                            PID:2468
                                            • C:\Recovery\WindowsRE\RuntimeBroker.exe
                                              C:\Recovery\WindowsRE\RuntimeBroker.exe
                                              19⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:1904
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c0d673f-1a5d-40cb-9b2b-484c4a186acf.vbs"
                                                20⤵
                                                  PID:640
                                                  • C:\Recovery\WindowsRE\RuntimeBroker.exe
                                                    C:\Recovery\WindowsRE\RuntimeBroker.exe
                                                    21⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:2676
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7be968a8-b845-4870-a53f-9a3b6d8c89b6.vbs"
                                                      22⤵
                                                        PID:2472
                                                        • C:\Recovery\WindowsRE\RuntimeBroker.exe
                                                          C:\Recovery\WindowsRE\RuntimeBroker.exe
                                                          23⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:4360
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\241bc3ee-8e86-4114-aced-1d747012f2e9.vbs"
                                                            24⤵
                                                              PID:1376
                                                              • C:\Recovery\WindowsRE\RuntimeBroker.exe
                                                                C:\Recovery\WindowsRE\RuntimeBroker.exe
                                                                25⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:1388
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ecca572a-31d5-40ab-a9ee-70e1976c1999.vbs"
                                                                  26⤵
                                                                    PID:3404
                                                                    • C:\Recovery\WindowsRE\RuntimeBroker.exe
                                                                      C:\Recovery\WindowsRE\RuntimeBroker.exe
                                                                      27⤵
                                                                      • UAC bypass
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:216
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\381fd8a6-fb7c-4d85-a2f7-ea78d0d5f992.vbs"
                                                                        28⤵
                                                                          PID:1080
                                                                          • C:\Recovery\WindowsRE\RuntimeBroker.exe
                                                                            C:\Recovery\WindowsRE\RuntimeBroker.exe
                                                                            29⤵
                                                                            • UAC bypass
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • System policy modification
                                                                            PID:4480
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b40b5a3-780c-4a3f-a7e7-4ab32a70888b.vbs"
                                                                              30⤵
                                                                                PID:1904
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1f579d8-f0b0-444e-bf3f-a1669746d3c6.vbs"
                                                                                30⤵
                                                                                  PID:1088
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31327b99-ec22-4e26-8375-d919ee1fdddb.vbs"
                                                                              28⤵
                                                                                PID:3152
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6a075a3-80ba-4a3a-ab25-92bafb1aa935.vbs"
                                                                            26⤵
                                                                              PID:224
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15cb67be-6bb2-4d7d-a37e-c5dd4cf1b251.vbs"
                                                                          24⤵
                                                                            PID:1620
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76363780-4244-4c2f-9ec6-c544a2595656.vbs"
                                                                        22⤵
                                                                          PID:2456
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89583493-abaf-43df-a59c-62aadc42e2d0.vbs"
                                                                      20⤵
                                                                        PID:2180
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eba36fd6-b8dd-48ac-aaf9-e5399890e103.vbs"
                                                                    18⤵
                                                                      PID:3396
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd988f1c-ac37-42a7-b599-f643e78050e2.vbs"
                                                                  16⤵
                                                                    PID:1492
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f795dac-606d-49c8-a4f3-864b20082917.vbs"
                                                                14⤵
                                                                  PID:4444
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea5b8577-0683-4760-9c59-23158d576ad8.vbs"
                                                              12⤵
                                                                PID:4596
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ec971c1-6ec3-4577-a03f-aa8ec31995aa.vbs"
                                                            10⤵
                                                              PID:796
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\126b996a-2224-4270-9c15-631bef969a1f.vbs"
                                                          8⤵
                                                            PID:3740
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33262717-c685-4977-958e-57dbee9517a7.vbs"
                                                        6⤵
                                                          PID:3732
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\213b4795-adef-4574-85d4-e63f95644206.vbs"
                                                      4⤵
                                                        PID:3684
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\Sun\Java\Deployment\dllhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4580
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Sun\Java\Deployment\dllhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4828
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Sun\Java\Deployment\dllhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1084
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Public\AccountPictures\Idle.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1352
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\Idle.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:2640
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Public\AccountPictures\Idle.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3684
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\Resources\fontdrvhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4656
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Resources\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4744
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\Resources\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3484
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4648
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3180
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:2356
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre8\lib\sihost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1492
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Java\jre8\lib\sihost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4672
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre8\lib\sihost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1904
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4844
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:2232
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4512
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4116
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1392
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1544
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3000
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1444
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:5032
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:528
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4720
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1144
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1840
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1860
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1820
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\unsecapp.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4028
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\unsecapp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3184
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\unsecapp.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3752
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\lsass.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:2540
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:952
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:4852
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\sppsvc.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1484
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\sppsvc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:408
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\sppsvc.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3388
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Start Menu\fontdrvhost.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:5020
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3460
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Start Menu\fontdrvhost.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3984
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Application Data\SppExtComObj.exe'" /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3660
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\SppExtComObj.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:3228
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Application Data\SppExtComObj.exe'" /rl HIGHEST /f
                                                  1⤵
                                                  • Process spawned unexpected child process
                                                  • Creates scheduled task(s)
                                                  PID:1960

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe

                                                  Filesize

                                                  2.9MB

                                                  MD5

                                                  1c8a169288baa053351d8a8957652003

                                                  SHA1

                                                  d41e7ccff1801959e966b818349017ce87451da5

                                                  SHA256

                                                  2856e4596a7e650b4978cda6b0e482b7c00aff2b736f072eb1735c24af0b22f4

                                                  SHA512

                                                  d00ac382f01500d8b9a2a39725851530f07c0ab8989221f3ac9cf24dbdfb262d2725afbeca0bf1b24f950117cdd832714f1319028ec9007159645abaf4b3953d

                                                • C:\Program Files\Java\jre8\lib\sihost.exe

                                                  Filesize

                                                  2.9MB

                                                  MD5

                                                  a2076a85de5c50013fd48e423e2c2050

                                                  SHA1

                                                  4ef4d4fd4cf21287ccb37baa4fc8a4efa31b6bd6

                                                  SHA256

                                                  296ff7111b13564c6bffbc590f46a21188c873f95658d756c22425584453b9b6

                                                  SHA512

                                                  ff45a43830600f097569378af3d957346f2e66bfbf65f5a89ba592c5b90ef0759bf7a587914fb84c3406b6624c2301652ed30440cde9701d18bdf68b46cfa1a3

                                                • C:\Recovery\WindowsRE\RuntimeBroker.exe

                                                  Filesize

                                                  2.9MB

                                                  MD5

                                                  89fd9805b81ee443cfc45649a131a483

                                                  SHA1

                                                  4857767c5e48d3ae858ba410aaeb3e4b78652295

                                                  SHA256

                                                  61620d980e6ebe7a0bbdec6e7254c369fbe6b9e28d8a6b820583273f5bf14f3e

                                                  SHA512

                                                  a76c7cadcff852525659bb6da1707da9073c77b7148c1671a219df064c546d81449486da0e6d57705cd98a000dbf317024eaa80e4cefcea9657ff93f13654380

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  4a667f150a4d1d02f53a9f24d89d53d1

                                                  SHA1

                                                  306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

                                                  SHA256

                                                  414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

                                                  SHA512

                                                  4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  d85ba6ff808d9e5444a4b369f5bc2730

                                                  SHA1

                                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                                  SHA256

                                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                  SHA512

                                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  d28a889fd956d5cb3accfbaf1143eb6f

                                                  SHA1

                                                  157ba54b365341f8ff06707d996b3635da8446f7

                                                  SHA256

                                                  21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                  SHA512

                                                  0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  6d3e9c29fe44e90aae6ed30ccf799ca8

                                                  SHA1

                                                  c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                  SHA256

                                                  2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                  SHA512

                                                  60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  2e907f77659a6601fcc408274894da2e

                                                  SHA1

                                                  9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                  SHA256

                                                  385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                  SHA512

                                                  34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  62623d22bd9e037191765d5083ce16a3

                                                  SHA1

                                                  4a07da6872672f715a4780513d95ed8ddeefd259

                                                  SHA256

                                                  95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                  SHA512

                                                  9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  e243a38635ff9a06c87c2a61a2200656

                                                  SHA1

                                                  ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                                                  SHA256

                                                  af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                                                  SHA512

                                                  4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  bd5940f08d0be56e65e5f2aaf47c538e

                                                  SHA1

                                                  d7e31b87866e5e383ab5499da64aba50f03e8443

                                                  SHA256

                                                  2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                                  SHA512

                                                  c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  59d97011e091004eaffb9816aa0b9abd

                                                  SHA1

                                                  1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                                  SHA256

                                                  18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                                  SHA512

                                                  d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                                • C:\Users\Admin\AppData\Local\Temp\040bc938-c31f-4199-b6f0-f70d235aa631.vbs

                                                  Filesize

                                                  714B

                                                  MD5

                                                  468b230bf966ba8c651c40e1e203f1e1

                                                  SHA1

                                                  abda1b16b7ab9c7979304862859cd99e357e9fa7

                                                  SHA256

                                                  7f69b220f86d30281adde9f5e0e2d130230ec6235842ce3f01e34854f7f4533f

                                                  SHA512

                                                  5ee5e3b47f793fee2d8e6403848cc6e8ee4d7a1376595d61a1d39be32cb222cf0419615699a254ac4d52a803225b21eac669056a55e540462ec60b02391a0de0

                                                • C:\Users\Admin\AppData\Local\Temp\1682fb79-f2b1-4ae9-8e82-0eabf573fdec.vbs

                                                  Filesize

                                                  715B

                                                  MD5

                                                  284ce2f0ade0ab7280bbc10c3c7d4f11

                                                  SHA1

                                                  be744ba155833ef1ea82c8d44671bf895f1efe34

                                                  SHA256

                                                  2bb5e9f812be958a773a53d31ff61403875222323b697e863a202fac188773ad

                                                  SHA512

                                                  e029b0701c32b3fe397661ae5b799416f871a08b4343ac00095be1fd7cc46b3443a9d04850cb3c5befcdf1ef462f6e84093d196c1932ca07f473335090f94c93

                                                • C:\Users\Admin\AppData\Local\Temp\213b4795-adef-4574-85d4-e63f95644206.vbs

                                                  Filesize

                                                  491B

                                                  MD5

                                                  0cc7ef608f19ac86cf5f64751304baa6

                                                  SHA1

                                                  4707b5d4666a2182698978f9291e99679b4cce48

                                                  SHA256

                                                  8e095a59dab14b3a5204feb3ddd8ea49b7d2700023b15579e0f8f47c3c864a66

                                                  SHA512

                                                  c3a9f8cbab04c5a2bc1e062c50a28367f1ddc22ebaa8be5cc8a785ab4effa8d43fcf437b150208b9683a69b9e9d9681ae26d7894104fda6f17c08f4eb1873dce

                                                • C:\Users\Admin\AppData\Local\Temp\241bc3ee-8e86-4114-aced-1d747012f2e9.vbs

                                                  Filesize

                                                  715B

                                                  MD5

                                                  2bcb774bda44a03e7e02af20a4968716

                                                  SHA1

                                                  47f66477e5761078c75091875ca8051773c4b4d5

                                                  SHA256

                                                  54fa4c022c0b7d3ec54b6ee9725f7c60b2365d79d236997c11afa6225ab29d3e

                                                  SHA512

                                                  9bf50817c331ded34884a01d44646d51b1d1761806566ff78ebc7eead79e6b638c71cc4ae5658bfb62a876ff0ce4942bbddf462d491972fac701dd05ad36fdb7

                                                • C:\Users\Admin\AppData\Local\Temp\381fd8a6-fb7c-4d85-a2f7-ea78d0d5f992.vbs

                                                  Filesize

                                                  714B

                                                  MD5

                                                  0b91a53925ffffa42dc9bbc2a47eccc7

                                                  SHA1

                                                  efcf36bcb0686f361f36190c0b2b535d82ac0ce8

                                                  SHA256

                                                  b0c437783c1d35a75971ae3fa21986c08fb99a1d1c0fdde8bf0118e12eb2ef88

                                                  SHA512

                                                  52410c644ad204d7504b54607ea24e85596d40d71f5af266d5ff76ae7f151bbb7d8f8b742eba440400e3b5d5d7274e4345130cf7a9a9fd6e6daca36087ef2ebe

                                                • C:\Users\Admin\AppData\Local\Temp\3c0d673f-1a5d-40cb-9b2b-484c4a186acf.vbs

                                                  Filesize

                                                  715B

                                                  MD5

                                                  d47d343a763472cb1bf25f56914a8523

                                                  SHA1

                                                  42d277db2b419fd8d02f9d6bc52ec15d36709a80

                                                  SHA256

                                                  d86b579fa24762585802c70d2250adc50cd42eb44c198e47d93bc2e494296b77

                                                  SHA512

                                                  cf02d751ffc5fb956d1d57ad5244cbe8d66269fa4ec612ec62f02b1f4bd60f97a8a1b81a63a2e4679957dfc3a09626ce1ab5e1f551a106581379cad6e5af6fb1

                                                • C:\Users\Admin\AppData\Local\Temp\48sAkNrSAB.bat

                                                  Filesize

                                                  204B

                                                  MD5

                                                  cfc5ca7ed8a24620d5fa42839110552d

                                                  SHA1

                                                  9365afda0abedf7f67622609df78e5b130443397

                                                  SHA256

                                                  8bc4d008d51079d6252c459f970d8e8dec82fd2b3ada050d3aba23409f9f6f08

                                                  SHA512

                                                  b2d154db858e8778863dd869cce71d18122fdd91a6dac81ea336804390a6d094b5e0fb7748861cfb66d10c888dca01cec6b0f606cc6ea7b936e88c20b907b2ee

                                                • C:\Users\Admin\AppData\Local\Temp\7be968a8-b845-4870-a53f-9a3b6d8c89b6.vbs

                                                  Filesize

                                                  715B

                                                  MD5

                                                  e291bad5ce93bfc227a0c59c82410f70

                                                  SHA1

                                                  2843a0c4d060d886cf62405256323b490534a133

                                                  SHA256

                                                  2d0daec5eb092ab0e1d65b9df055997491ac2b56dad6aac440865b8a74c0aad5

                                                  SHA512

                                                  f891e5fa40f25bbb3e329c36dd5056349db2a12c67b86e6469aee38616b1c528e8b0e2a55726abe1023bdbd65c239c47341f3bfd3c411aa02cf626df477866f0

                                                • C:\Users\Admin\AppData\Local\Temp\7de3ee7f-0f4b-4176-869d-240c966af155.vbs

                                                  Filesize

                                                  714B

                                                  MD5

                                                  74d6827a3a3f6fd62f488a038217cae5

                                                  SHA1

                                                  f6dbf7dcea8bd8652dc24d6828f0b7160942af38

                                                  SHA256

                                                  9ec1dd316ed5177f03ef30629008abfe32a02f7d5baa3bc2b2bac651d4ca5ab3

                                                  SHA512

                                                  9b02e5cb36582296e7b5ebcbdfd9194d576cf10f6cfb0784686a17ffd720453193b4e980fc0ed78b9a6e78412b8ccf33067f7eed3727a336fb1e9bea27bfca9e

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ux51evwv.nwh.ps1

                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                • C:\Users\Admin\AppData\Local\Temp\af082c4d-682c-419d-993d-b683b10828a4.vbs

                                                  Filesize

                                                  715B

                                                  MD5

                                                  c250da9266553d4e7c6d835037853b3a

                                                  SHA1

                                                  a7dd7f18a74e2b917a962a5c61878e3e95ef9a87

                                                  SHA256

                                                  377eb2430cc1e6d9f20cba9563fe4ae42a8a87a5f324c6db53837b77d643d653

                                                  SHA512

                                                  d8f68e433a8ae2d0f546637079c366826f20af4395a4a0c35931b607d22af3192914676bbd0b48ed9e4d58c652960ac616ddfac861823cb14146030430d7e4de

                                                • C:\Users\Admin\AppData\Local\Temp\b935b1f74bad2fdb1615016a349626c7457f2cac.exe

                                                  MD5

                                                  d41d8cd98f00b204e9800998ecf8427e

                                                  SHA1

                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                  SHA256

                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                  SHA512

                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                • C:\Users\Admin\AppData\Local\Temp\c5df52fb-3bd3-4eb9-aabe-947f1aeafc7b.vbs

                                                  Filesize

                                                  715B

                                                  MD5

                                                  3ecd4700ff00b0108400ad2f93fa19e4

                                                  SHA1

                                                  0bd9404aba566a22bdf739ae5c4628e48e282460

                                                  SHA256

                                                  068e62588172230b386dee27c6bfddb175ec98f5e2506462d13eb0cb87629410

                                                  SHA512

                                                  0bd8bba6fa8b2afeee579366a2a76caab23db77799fcbe77c4673fc878a88831faf2a7a86a92f82ab15edfc4ad723f1b5c69126835b32a2c782af73be4ed5baa

                                                • C:\Users\Admin\AppData\Local\Temp\d09534af-13c7-4de7-a5b2-ee4846e35e3a.vbs

                                                  Filesize

                                                  715B

                                                  MD5

                                                  30fc01150f183af0858e33b2035e3cee

                                                  SHA1

                                                  e3e5cb75136c3d4fc28386d85597993d21056822

                                                  SHA256

                                                  dbb379553215f4e6c7b9e600b47bf83fe8e33bd937b102f938ff3981a0e9681f

                                                  SHA512

                                                  951bc48324d7e62182f963bea7a25b700aba8e3ff0c872eba65e6767c182ff05677eb0c10434efd168786673ae08a077005a6123026ae364812dd13f5fcd658b

                                                • C:\Users\Admin\AppData\Local\Temp\d901daf0-d811-4b88-8d66-21b62690b5b1.vbs

                                                  Filesize

                                                  715B

                                                  MD5

                                                  c02c14da25231299b7d4cb32fdd321f3

                                                  SHA1

                                                  a8972bf4bfd8e816336418d7b112c61f8dee55fd

                                                  SHA256

                                                  0481a25082313c0251645d10befec7e5df0bba8545f724577e0284293f9a860f

                                                  SHA512

                                                  e7f59bcfc392fdcf14512a3cccf7550f0ff189f14f31003c646ff53761c510a49545b39c357103a8a24d488556cd9458784de58c8d5bfb05a873bc8d008d9bc5

                                                • C:\Users\Admin\AppData\Local\Temp\d944b65c-516e-444a-aa07-44664e8f62a3.vbs

                                                  Filesize

                                                  715B

                                                  MD5

                                                  97b7a99260d4893cb5f3069998d15059

                                                  SHA1

                                                  ce917bf6a93277fab5cf8c24c0ae734a4c8b28b7

                                                  SHA256

                                                  48b0c9ada8c8671e13e8cea54c8fd9e1a269e4992b447053c501e1df1137f25a

                                                  SHA512

                                                  99d29deb8f30aee116126de6081512c6ffc7d2eacfb5b98cb4dec9dc5f386f7e96b0895da7eec5f258d43a22c9af8d50a4912e4b6a015b5b891be69eabc0a90e

                                                • C:\Users\Admin\AppData\Local\Temp\ecca572a-31d5-40ab-a9ee-70e1976c1999.vbs

                                                  Filesize

                                                  715B

                                                  MD5

                                                  2f85828c82d356a719967fc7db833478

                                                  SHA1

                                                  009c915f9f476e714863d1bf4a265b9c98d1a0ff

                                                  SHA256

                                                  d944eb44582e21db46aa8be09c0468a3ba7aa798a672f3e08ef7a645034277bd

                                                  SHA512

                                                  de9abf9f0e92ae6a01ca56ad2edd567441d5240d7f33bf757bb04226665efea8eb875075e8cb0bf448e03e5715e285c94d7bdc01105862c2860c002ab8c8cb47

                                                • memory/720-189-0x00007FFB824E0000-0x00007FFB82FA1000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/720-9-0x000000001C1B0000-0x000000001C1B8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/720-0-0x00007FFB824E3000-0x00007FFB824E5000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/720-27-0x000000001C370000-0x000000001C37C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/720-22-0x000000001C320000-0x000000001C328000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/720-23-0x000000001C330000-0x000000001C33E000-memory.dmp

                                                  Filesize

                                                  56KB

                                                • memory/720-17-0x000000001C810000-0x000000001CD38000-memory.dmp

                                                  Filesize

                                                  5.2MB

                                                • memory/720-16-0x000000001C2B0000-0x000000001C2C2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/720-15-0x000000001C2A0000-0x000000001C2AC000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/720-14-0x000000001C290000-0x000000001C298000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/720-13-0x000000001C280000-0x000000001C28C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/720-12-0x000000001C230000-0x000000001C286000-memory.dmp

                                                  Filesize

                                                  344KB

                                                • memory/720-11-0x000000001C220000-0x000000001C22A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/720-10-0x000000001C1C0000-0x000000001C1D0000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/720-1-0x0000000000C40000-0x0000000000F26000-memory.dmp

                                                  Filesize

                                                  2.9MB

                                                • memory/720-24-0x000000001C340000-0x000000001C34C000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/720-8-0x000000001C1A0000-0x000000001C1A8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/720-25-0x000000001C350000-0x000000001C358000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/720-2-0x00007FFB824E0000-0x00007FFB82FA1000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/720-26-0x000000001C360000-0x000000001C36A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/720-318-0x000000001D5B0000-0x000000001D606000-memory.dmp

                                                  Filesize

                                                  344KB

                                                • memory/720-7-0x000000001C180000-0x000000001C196000-memory.dmp

                                                  Filesize

                                                  88KB

                                                • memory/720-5-0x00000000031C0000-0x00000000031C8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/720-18-0x000000001C2E0000-0x000000001C2E8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/720-19-0x000000001C2F0000-0x000000001C2F8000-memory.dmp

                                                  Filesize

                                                  32KB

                                                • memory/720-6-0x000000001B9F0000-0x000000001BA00000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/720-20-0x000000001C300000-0x000000001C30A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/720-21-0x000000001C310000-0x000000001C31E000-memory.dmp

                                                  Filesize

                                                  56KB

                                                • memory/720-4-0x000000001C1D0000-0x000000001C220000-memory.dmp

                                                  Filesize

                                                  320KB

                                                • memory/720-3-0x000000001BA10000-0x000000001BA2C000-memory.dmp

                                                  Filesize

                                                  112KB

                                                • memory/3228-306-0x000000001CDF0000-0x000000001CE02000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/3972-293-0x0000000000F50000-0x0000000001236000-memory.dmp

                                                  Filesize

                                                  2.9MB

                                                • memory/4772-169-0x0000022951360000-0x0000022951382000-memory.dmp

                                                  Filesize

                                                  136KB