dcrat | 454efc93e2a732c41a6f87a7a57fbe75df5bcdc0ebf2e9823d82adfde50f378d

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
Size 1.2MB
Sample240604-bmfs9sgg79
SHA256 454efc93e2a732c41a6f87a7a57fbe75df5bcdc0ebf2e9823d82adfde50f378d
MD5 1bcf29f290a2711054f3bce0998b7340
SHA1 7601fcd67bb61cec577f04d2c5c057fc27a88e5a
SHA512 ed3906317d7895a1da0bafd9922a2ad5cd1b6eb7c673e7ecb33568b74d58c3ff1e59e982933e01679bd955f01b6677222339ccfc95711b263ec92ffce8be6fae
SSDEEP 24576:hjsHZZEFtYuF/sxuU4JetyW0+0TNQicOEJxXRyoNyz:hAHZnWGFoTNQqE3XRyo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 63 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	4896	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	4896	schtasks.exe	91

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4504-1-0x0000000000A90000-0x0000000000BC8000-memory.dmp	dcrat
behavioral2/files/0x0007000000023285-27.dat	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
408	StartMenuExperienceHost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
29	pastebin.com
30	pastebin.com

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\csrss.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\lsass.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\6203df4a6bafc7	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft.NET\38384e6a620884	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\RuntimeBroker.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\9e8d7a4ca61bd9	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6203df4a6bafc7	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\0a1fd5f707cd16	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\7a0fd90576e088	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\csrss.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\886983d96e3d3e	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files\ModifiableWindowsApps\MusNotification.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\sppsvc.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft.NET\SearchApp.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lsass.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\twain_32\SearchApp.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Windows\twain_32\38384e6a620884	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
File created	C:\Windows\servicing\de-DE\msedge.exe	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 63 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4472	schtasks.exe
1900	schtasks.exe
4992	schtasks.exe
1520	schtasks.exe
3832	schtasks.exe
4904	schtasks.exe
456	schtasks.exe
4848	schtasks.exe
1400	schtasks.exe
4676	schtasks.exe
4632	schtasks.exe
1928	schtasks.exe
4028	schtasks.exe
3440	schtasks.exe
4520	schtasks.exe
4252	schtasks.exe
4580	schtasks.exe
4640	schtasks.exe
4932	schtasks.exe
4468	schtasks.exe
2088	schtasks.exe
3992	schtasks.exe
220	schtasks.exe
948	schtasks.exe
1428	schtasks.exe
3496	schtasks.exe
1072	schtasks.exe
1936	schtasks.exe
4180	schtasks.exe
1324	schtasks.exe
2032	schtasks.exe
3564	schtasks.exe
3484	schtasks.exe
540	schtasks.exe
5088	schtasks.exe
932	schtasks.exe
1528	schtasks.exe
5088	schtasks.exe
2080	schtasks.exe
3476	schtasks.exe
4844	schtasks.exe
4732	schtasks.exe
3448	schtasks.exe
4452	schtasks.exe
4180	schtasks.exe
1012	schtasks.exe
2912	schtasks.exe
3612	schtasks.exe
3508	schtasks.exe
1204	schtasks.exe
4856	schtasks.exe
1820	schtasks.exe
1712	schtasks.exe
4948	schtasks.exe
3640	schtasks.exe
4496	schtasks.exe
1744	schtasks.exe
4436	schtasks.exe
5092	schtasks.exe
3908	schtasks.exe
2844	schtasks.exe
4108	schtasks.exe
992	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4504	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2100	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe
408	StartMenuExperienceHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
408	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
Token: SeDebugPrivilege	2100	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
Token: SeDebugPrivilege	2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
Token: SeDebugPrivilege	408	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4432	4504	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe	98
PID 4504 wrote to memory of 4432	4504	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe	98
PID 4432 wrote to memory of 4536	4432	cmd.exe	100
PID 4432 wrote to memory of 4536	4432	cmd.exe	100
PID 4432 wrote to memory of 2100	4432	cmd.exe	101
PID 4432 wrote to memory of 2100	4432	cmd.exe	101
PID 2100 wrote to memory of 2356	2100	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe	108
PID 2100 wrote to memory of 2356	2100	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe	108
PID 2356 wrote to memory of 2232	2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe	162
PID 2356 wrote to memory of 2232	2356	1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe	162
PID 2232 wrote to memory of 376	2232	cmd.exe	164
PID 2232 wrote to memory of 376	2232	cmd.exe	164
PID 2232 wrote to memory of 408	2232	cmd.exe	167
PID 2232 wrote to memory of 408	2232	cmd.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rWMaFgMJhb.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4536
- - C:\Users\Admin\AppData\Local\Temp\1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe"
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe"
      4⤵
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0qkFta8l0t.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2232
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:376
      - C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
        
        "C:\Recovery\WindowsRE\StartMenuExperienceHost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Users\Default\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\Default\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Users\Default\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics1" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Documents\1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics" /sc ONLOGON /tr "'C:\Users\Default\Documents\1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics1" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Documents\1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Videos\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Videos\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\odt\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\Default User\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\twain_32\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Windows\twain_32\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1bcf29f290a2711054f3bce0998b7340_NeikiAnalytics.exe.log
Size 1KB
SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
MD5 7800fca2323a4130444c572374a030f4
SHA1 40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa
SHA512 c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554
MD5 SHA1 SHA512

Submit Download

0qkFta8l0t.bat

Path C:\Users\Admin\AppData\Local\Temp\0qkFta8l0t.bat
Size 214B
SHA256 f14c5a6ac276a889d41ad53494aaddd4e751253188645e5faf7eb93c20fc7ab0
MD5 cd708c8b776966bef099fa62ef2221ca
SHA1 ac3a596ae38eb411fafba6e09f6b55b0ed37f5a8
SHA512 6b42b207504836f2f65744716d78d1366642ab4c8a5886b58cecf90ab0748f21cf870d6f5528a650ee715a7003873e69846965fea872766963b50eae13b8b919
MD5 SHA1 SHA512

Submit Download

779c52ea2408c9b017b92a67f8eb19af6e28bc8f4.5.32026d766f108ae94828560f920d7e851dc4aee902

Path C:\Users\Admin\AppData\Local\Temp\779c52ea2408c9b017b92a67f8eb19af6e28bc8f4.5.32026d766f108ae94828560f920d7e851dc4aee902
Size 336B
SHA256 f11a2599b5e4ff487946da68461c7a7e44e1633d779f3f4451879ebba06d0283
MD5 1c1f9a28603a7f4bd4800ec68c76d9a6
SHA1 a8b0d31332bd52080d3cf057128ab7e172797232
SHA512 5749e966ad1c57e070ec6fe3da156fa280e302b8d076e6f7bb18bc75555f2e44a70e1003037be3da45b7427a5bebc22c74ba1b228f6075c47f6a026dede99e8c
MD5 SHA1 SHA512

Submit Download

779c52ea2408c9b017b92a67f8eb19af6e28bc8f4.5.32026d766f108ae94828560f920d7e851dc4aee902

Path C:\Users\Admin\AppData\Local\Temp\779c52ea2408c9b017b92a67f8eb19af6e28bc8f4.5.32026d766f108ae94828560f920d7e851dc4aee902
Size 1KB
SHA256 9180998992c91ff97bf81106ed5f020d37eb71bbe9149cefb3cb06e886666b8c
MD5 b7aed5f83bd7f900ee787fded83c70c0
SHA1 284325a9678bafe964371d900a325cc80f3e6e05
SHA512 38b7eb91a6e568bc6d19b56b8f50b5b87869c233953807b528bbee1491043f000cb529e0d49748da3e0848ab185ba1b88bc5021c5d4c35ac221fb0aac3432c5f
MD5 SHA1 SHA512

Submit Download

rWMaFgMJhb.bat

Path C:\Users\Admin\AppData\Local\Temp\rWMaFgMJhb.bat
Size 250B
SHA256 aa71960e7da81bc9c2237d47f678ba6f874119fa060a4cfc1d68a827b6bbfd47
MD5 c2cff708999e211c3b087be8837b6bb4
SHA1 5aceb293b8877c7c99dff18a1ae695ca3dd11436
SHA512 96bdaa8c2e167d8efb24c5aff5ccbad1903c2e5328215085450191c2cd8aacb2b80377ff91cb961976336a60bb8e0907c1bbc6cd006aabe9f0a89a914e6648da
MD5 SHA1 SHA512

Submit Download

61a52ddc9dd915

Path C:\Users\Default User\61a52ddc9dd915
Size 964B
SHA256 51d8ecbdebadcce7e2f57680629f7d0c1c5a6f6e03b4083453cd358c6cde6b9e
MD5 15fee5d67b5b280086799ff589856188
SHA1 66be2207e2df1c031c0ed710a5cbde2af21658e2
SHA512 c1ca5a01b878c920e1c9c1d4d83bf79fb34f28adbf3ceddb47f5e4964640aee411becd2f6c4a4587b7007a7f545304b95519d01df3572efc0d8125f577eb31f9
MD5 SHA1 SHA512

Submit Download

StartMenuExperienceHost.exe

Path C:\Users\Public\Videos\StartMenuExperienceHost.exe
Size 1.2MB
SHA256 454efc93e2a732c41a6f87a7a57fbe75df5bcdc0ebf2e9823d82adfde50f378d
MD5 1bcf29f290a2711054f3bce0998b7340
SHA1 7601fcd67bb61cec577f04d2c5c057fc27a88e5a
SHA512 ed3906317d7895a1da0bafd9922a2ad5cd1b6eb7c673e7ecb33568b74d58c3ff1e59e982933e01679bd955f01b6677222339ccfc95711b263ec92ffce8be6fae
SSDEEP 24576:hjsHZZEFtYuF/sxuU4JetyW0+0TNQicOEJxXRyoNyz:hAHZnWGFoTNQqE3XRyo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4504-4-0x000000001B840000-0x000000001B890000-memory.dmp

Download

memory/4504-18-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Download

memory/4504-7-0x0000000002E30000-0x0000000002E38000-memory.dmp

Download

memory/4504-6-0x0000000002E20000-0x0000000002E2E000-memory.dmp

Download

memory/4504-5-0x0000000002E00000-0x0000000002E16000-memory.dmp

Download

memory/4504-0-0x00007FFAE3683000-0x00007FFAE3685000-memory.dmp

Download

memory/4504-3-0x0000000002DE0000-0x0000000002DFC000-memory.dmp

Download

memory/4504-2-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Download

memory/4504-1-0x0000000000A90000-0x0000000000BC8000-memory.dmp

Download