Overview

overview

10

Static

static

3

71c18dc31e...bN.exe

windows7-x64

10

71c18dc31e...bN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 15:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    71c18dc31e53da4c75e40e6aeac6437058eb63527abe2eade9d7dc58c34b4f9bN.exe

  • Size

    1.5MB

  • MD5

    342d9786a05ca3ac788611225021e670

  • SHA1

    b0af40b9312f3dfd98bbb8c3b7fe70df606187c3

  • SHA256

    71c18dc31e53da4c75e40e6aeac6437058eb63527abe2eade9d7dc58c34b4f9b

  • SHA512

    622b9ae8acad10b431c4637432d4ae9f6647453efc5ea4cab9563bda9b0c3dd804260a21e339fea199d19b0a738cf9325f1f3d0ab323c78c347e0fe20e4f3399

  • SSDEEP

    24576:UNNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpR:kzhWhCXQFN+0IEuQgyiVK

Score
10/10
dcratevasionexecutioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 5 IoCs
    persistence
  • Process spawned unexpected child process 5 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 39 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 26 IoCs
    evasiontrojan
  • Drops file in System32 directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 39 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\71c18dc31e53da4c75e40e6aeac6437058eb63527abe2eade9d7dc58c34b4f9bN.exe
    "C:\Users\Admin\AppData\Local\Temp\71c18dc31e53da4c75e40e6aeac6437058eb63527abe2eade9d7dc58c34b4f9bN.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3016
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\71c18dc31e53da4c75e40e6aeac6437058eb63527abe2eade9d7dc58c34b4f9bN.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2332
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Utilman\fontdrvhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3276
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\credssp\fontdrvhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3852
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2264
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5052
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4276
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HP5H2dbekk.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:4980
        • C:\Recovery\WindowsRE\System.exe
          "C:\Recovery\WindowsRE\System.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2208
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a226da3-3537-415b-9ab3-ef901ff2d284.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\Recovery\WindowsRE\System.exe
              C:\Recovery\WindowsRE\System.exe
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3644
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6bad9d08-3ddf-47ac-bcaf-1cecf923a220.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4092
                • C:\Recovery\WindowsRE\System.exe
                  C:\Recovery\WindowsRE\System.exe
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4852
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43cf380f-c08b-4d11-8947-2d1d8e1b4731.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3064
                    • C:\Recovery\WindowsRE\System.exe
                      C:\Recovery\WindowsRE\System.exe
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:5060
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b271da94-34ae-4d3e-abdd-4f1191c08c89.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4388
                        • C:\Recovery\WindowsRE\System.exe
                          C:\Recovery\WindowsRE\System.exe
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:2232
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b48378c8-b9f8-4b0b-bc52-aeb232ba7089.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3472
                            • C:\Recovery\WindowsRE\System.exe
                              C:\Recovery\WindowsRE\System.exe
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:2544
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00e649a7-0b49-4b2d-a76b-eeddb01cd9bc.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4516
                                • C:\Recovery\WindowsRE\System.exe
                                  C:\Recovery\WindowsRE\System.exe
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:3048
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80ee73d9-b8d6-406e-97b2-98fd3b05c6cd.vbs"
                                    16⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1376
                                    • C:\Recovery\WindowsRE\System.exe
                                      C:\Recovery\WindowsRE\System.exe
                                      17⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:1896
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd2ce3d7-302a-4ed0-adc9-565c09eb0f32.vbs"
                                        18⤵
                                          PID:2400
                                          • C:\Recovery\WindowsRE\System.exe
                                            C:\Recovery\WindowsRE\System.exe
                                            19⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • System policy modification
                                            PID:1872
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8e12cd0-285d-406c-9a5f-854f20b7d3a1.vbs"
                                              20⤵
                                                PID:1964
                                                • C:\Recovery\WindowsRE\System.exe
                                                  C:\Recovery\WindowsRE\System.exe
                                                  21⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:4404
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34095d8e-c00b-4583-9f96-80fb3ec791ae.vbs"
                                                    22⤵
                                                      PID:4068
                                                      • C:\Recovery\WindowsRE\System.exe
                                                        C:\Recovery\WindowsRE\System.exe
                                                        23⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:400
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0c2c431-12e8-4f55-a1fb-c2793d11f4dd.vbs"
                                                          24⤵
                                                            PID:2228
                                                            • C:\Recovery\WindowsRE\System.exe
                                                              C:\Recovery\WindowsRE\System.exe
                                                              25⤵
                                                              • UAC bypass
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:4824
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be84158e-5b3b-467a-980d-fe8dbf24626c.vbs"
                                                                26⤵
                                                                  PID:3604
                                                                  • C:\Recovery\WindowsRE\System.exe
                                                                    C:\Recovery\WindowsRE\System.exe
                                                                    27⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:3824
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d943cdf-7c01-4805-b853-ecdd3ae7bb2e.vbs"
                                                                  26⤵
                                                                    PID:3740
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39df9e19-077a-4c93-bf6f-f1d386a4b523.vbs"
                                                                24⤵
                                                                  PID:532
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03bfba19-3637-4a79-9f58-de3dbb2d8d6b.vbs"
                                                              22⤵
                                                                PID:4964
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75de6224-2201-418d-8516-5c0dfa878925.vbs"
                                                            20⤵
                                                              PID:2920
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac600595-17b5-41e5-828c-9b5a57022bc8.vbs"
                                                          18⤵
                                                            PID:2708
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a42d7cde-b1a6-4764-ae1e-0b4798fca0cb.vbs"
                                                        16⤵
                                                          PID:4540
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\957b3a19-9f57-409e-a904-2528e51de1b7.vbs"
                                                      14⤵
                                                        PID:3792
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\582c44fb-95d8-4e71-ab9f-0667ea972058.vbs"
                                                    12⤵
                                                      PID:3772
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07e5a642-e957-40ea-b7ef-827c9e9f43ec.vbs"
                                                  10⤵
                                                    PID:2760
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fcde0746-9ba3-4862-b487-10032eea127a.vbs"
                                                8⤵
                                                  PID:4808
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70a482a1-9288-4e53-bc63-ee87ecffda04.vbs"
                                              6⤵
                                                PID:844
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fab9cf63-9cd7-4487-90de-56afce205cc3.vbs"
                                            4⤵
                                              PID:1000
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\Utilman\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2756
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\credssp\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4696
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1604
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:968
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4932

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      1
                                      T1059

                                      PowerShell

                                      1
                                      T1059.001

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Winlogon Helper DLL

                                      1
                                      T1547.004

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Privilege Escalation

                                      Abuse Elevation Control Mechanism

                                      1
                                      T1548

                                      Bypass User Account Control

                                      1
                                      T1548.002

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Winlogon Helper DLL

                                      1
                                      T1547.004

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Defense Evasion

                                      Abuse Elevation Control Mechanism

                                      1
                                      T1548

                                      Bypass User Account Control

                                      1
                                      T1548.002

                                      Impair Defenses

                                      1
                                      T1562

                                      Disable or Modify Tools

                                      1
                                      T1562.001

                                      Modify Registry

                                      4
                                      T1112

                                      Credential Access

                                      Discovery

                                      Query Registry

                                      2
                                      T1012

                                      System Information Discovery

                                      3
                                      T1082

                                      Lateral Movement

                                      Collection

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Recovery\WindowsRE\RuntimeBroker.exe
                                        Filesize

                                        1.5MB

                                        MD5

                                        342d9786a05ca3ac788611225021e670

                                        SHA1

                                        b0af40b9312f3dfd98bbb8c3b7fe70df606187c3

                                        SHA256

                                        71c18dc31e53da4c75e40e6aeac6437058eb63527abe2eade9d7dc58c34b4f9b

                                        SHA512

                                        622b9ae8acad10b431c4637432d4ae9f6647453efc5ea4cab9563bda9b0c3dd804260a21e339fea199d19b0a738cf9325f1f3d0ab323c78c347e0fe20e4f3399

                                        Download Submit

                                      • C:\Recovery\WindowsRE\RuntimeBroker.exe
                                        Filesize

                                        1.5MB

                                        MD5

                                        a9092384cfbe134a0cc2c1743d0d149c

                                        SHA1

                                        6043d9f783bb14d33b27b39d5f9c25dc7595f4c6

                                        SHA256

                                        304d5ade51f1360d02a719af8a2f3284f05dac7fdb0baa4bf55d87e0c910e11b

                                        SHA512

                                        361e135a0b39f0fcc5371b54b9c460102c33c9446e19dc9959db085d2b57df5b355a64add2db9c5d6dee0480a17efa5364b24837782c8d9457d72b2d6253e277

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log
                                        Filesize

                                        1KB

                                        MD5

                                        baf55b95da4a601229647f25dad12878

                                        SHA1

                                        abc16954ebfd213733c4493fc1910164d825cac8

                                        SHA256

                                        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                        SHA512

                                        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                        Filesize

                                        2KB

                                        MD5

                                        d85ba6ff808d9e5444a4b369f5bc2730

                                        SHA1

                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                        SHA256

                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                        SHA512

                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        944B

                                        MD5

                                        e243a38635ff9a06c87c2a61a2200656

                                        SHA1

                                        ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                                        SHA256

                                        af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                                        SHA512

                                        4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        944B

                                        MD5

                                        62623d22bd9e037191765d5083ce16a3

                                        SHA1

                                        4a07da6872672f715a4780513d95ed8ddeefd259

                                        SHA256

                                        95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                        SHA512

                                        9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        Filesize

                                        944B

                                        MD5

                                        6d42b6da621e8df5674e26b799c8e2aa

                                        SHA1

                                        ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                        SHA256

                                        5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                        SHA512

                                        53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\00e649a7-0b49-4b2d-a76b-eeddb01cd9bc.vbs
                                        Filesize

                                        708B

                                        MD5

                                        5f4e5f25dde17b6baee8d8169626be53

                                        SHA1

                                        e0175c7cfda4350aae8088422cfcec9817d1f680

                                        SHA256

                                        257e2533f0263783252ab84f29b47327f73a3c6b3f25dc32663642e42fe90af6

                                        SHA512

                                        363513d668e72c78d988d5e300a67494200a2ee5e4fd392a3efe9d428b23c82df2f133d5fed5a1dc7a3c0a06487c253c825fb3be55a8a2387d846a7f85b4739d

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\34095d8e-c00b-4583-9f96-80fb3ec791ae.vbs
                                        Filesize

                                        708B

                                        MD5

                                        cb681bfdd76e7cab6c69c87a6099da02

                                        SHA1

                                        3461979363d396aba875378a5ed8fc1356fb35bb

                                        SHA256

                                        6c7465a1d834138103b9669cd643eddc39dd0123c8311f0f584f2fa7cd81ffaf

                                        SHA512

                                        c01645ee0dd237d1dbdbf7a60a5b80efee8a28e5cf25ed8b44ed0e42356c3f9f868506a4e074551f651385e6cac9acc549b8f8451b1e7705338d3fbc0ccc7528

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\43cf380f-c08b-4d11-8947-2d1d8e1b4731.vbs
                                        Filesize

                                        708B

                                        MD5

                                        1250d795fcf227ce33c26aea4716a9a6

                                        SHA1

                                        89f2c45c9ed60fd596701d6719960c6a4b22ad58

                                        SHA256

                                        1f3c77d1dc1a8042f173500c55a52bb0ea78d5f83057a25878a47ae139180a5f

                                        SHA512

                                        4030e3b8317f9018b90dd1c773b23f46ccc69a272f0c52edfd5733e4ec2344e7e7f4484d058a56bfd932d6ee31b86f9701639aa067b1409345626f6be4657fdf

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\4a226da3-3537-415b-9ab3-ef901ff2d284.vbs
                                        Filesize

                                        708B

                                        MD5

                                        21e59d282b440776b8ccbacf1fb75e07

                                        SHA1

                                        f64e866700525b8d81922f3c22cee898417b74c0

                                        SHA256

                                        c24480d9714b3a9dc66553f865fbdb840ab55f817d0c00626818c825d8520a44

                                        SHA512

                                        3aa11bbf2b4fd9a3c0f38dab9cac51efafe8a138c3d9a416f9768710714e4c2ef37c63f49793c1779122fa2f60bd66762455420c83edc072ee03412a9631c5f0

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\6bad9d08-3ddf-47ac-bcaf-1cecf923a220.vbs
                                        Filesize

                                        708B

                                        MD5

                                        0585bda3f26f4a04863aced76feb4c4d

                                        SHA1

                                        504a9c21f6711d3eb5efd945b2a487ba49b1ff30

                                        SHA256

                                        84dad4fd6910f5ec2d0f96d1b57f6ba5e273da88bc1aa30c78301c7fb979209d

                                        SHA512

                                        508b96eaa6214cd82d45762fa5d5daf7fc257b91d6ea9558ab708767a6f4ecac5382e3c974da0417c0a26050b7b1e673cbc06a8aebefd8fe63088d5a331eaa5c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\80ee73d9-b8d6-406e-97b2-98fd3b05c6cd.vbs
                                        Filesize

                                        708B

                                        MD5

                                        fd981c58e3b4e378011d157a4e977da0

                                        SHA1

                                        913eb1920967b77ade8931bee01d7c3838ff2348

                                        SHA256

                                        9238b7f90508876c3ea59c515b22257698f335a3d4804ebddf1b885eb3d6e142

                                        SHA512

                                        5e81244b13e9738976bfae9d945340f0f3ed7a5496b4779207c4be8854ece3d862384128bd843d152b1877afba6ece16adb81a443c056e4d3a34f6c28d3d441f

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\HP5H2dbekk.bat
                                        Filesize

                                        196B

                                        MD5

                                        83f00c5aedda421f87fe76b145e963c1

                                        SHA1

                                        da5e4765e52ae64e00101f5d52ffe7dbb5ca0f28

                                        SHA256

                                        a2d75c99e53be461c58f2ef2dcfc6a545c86045b7ea243f122d5d8f1285e50fd

                                        SHA512

                                        e659b396f2e98aa5771e5738e8e748f463b7fafa387cc6dda5d31e02cb4ea7b03d03f4f38ad64b825ae5d061542bdae4310e8d2c2f600cbf1b2692a96f93a5a0

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fnqhetge.roy.ps1
                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\b271da94-34ae-4d3e-abdd-4f1191c08c89.vbs
                                        Filesize

                                        708B

                                        MD5

                                        3616e6e8f351ac15c550996fd1ac7efa

                                        SHA1

                                        6ace9ed914014a085813ec0615d876666e909a68

                                        SHA256

                                        639554dc08fa16dea461f905363d1f12c7c43aec75715013cd3c7a3536ae4c79

                                        SHA512

                                        d21813e5d9b470cb112d9f731ccb8e0f5e2f04e86d27c22dd4123f9c4fb8cd345c666f3184d203a31c82f78dce0e54219bc438d9a9623bf040e3fd1f8b8fe99c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\b48378c8-b9f8-4b0b-bc52-aeb232ba7089.vbs
                                        Filesize

                                        708B

                                        MD5

                                        12ca23324f641ef22bffebfd944663fd

                                        SHA1

                                        05ae601d17f4b345f23704e51140ba6d7a09e904

                                        SHA256

                                        0c4893f3e845376b8ae85e8ca24b7bb3a644957b73746f6122e0a376decb1645

                                        SHA512

                                        c83e5be691edc7af1564e1cd24713edc04582978843fd39fd80bd8d4e1385c226af38a57184c18fadb33c1e342699b9cc39418f8fbf096fe7d0d4383d074bf24

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\b8e12cd0-285d-406c-9a5f-854f20b7d3a1.vbs
                                        Filesize

                                        708B

                                        MD5

                                        971e016a4a9ba29c0ba71c5e305d7c39

                                        SHA1

                                        9c362ce1ba5655cb3e3966cc274d6cb2cf26a88f

                                        SHA256

                                        ec8dc95313bce95442e733e152c49daf2d00946715370b5db9baa46ee2d1d9b4

                                        SHA512

                                        16987133e081de2667a8f15ece5ddd9e75d700f3e46d694502987f74559ce3721676c3fa4c3176385edb2ddd80aa5999c46fbafb6451233946e4a1d7c7e75511

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\be84158e-5b3b-467a-980d-fe8dbf24626c.vbs
                                        Filesize

                                        708B

                                        MD5

                                        b32a20c19fb0538526ea5831cc73fe7f

                                        SHA1

                                        80dd0d738e8063af14488b7147c1a0f98ec746b2

                                        SHA256

                                        25386013ed0847d6fa5b95a8acf486c4d39b1ec97a5ecaf277012481090e88d7

                                        SHA512

                                        bd3a9a1c313d378eb67f43db84f63e953839bdb69af32eaec387f21f8cb7a81443d48fda740f05fafc50ddf9e92975f0e0b3d8abc40fd840de2f2d0bd8faef01

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\cd2ce3d7-302a-4ed0-adc9-565c09eb0f32.vbs
                                        Filesize

                                        708B

                                        MD5

                                        a093d01e6d89fb875f03bc0ac2234840

                                        SHA1

                                        8a1ae6b6bb1a81982213331fb4c1fdc3006eb209

                                        SHA256

                                        4db60819a54e6643b96228a2480d65445a3cb70ff4bfa0930633ea0fb8147291

                                        SHA512

                                        ff4c8e1c67d0041eba031873b8887693040ff405d800c13d20d12a5f07b364ed7de162aecbd27e96508c3045162d964351b7ae057dd21a417e61e259bb0f579a

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\f0c2c431-12e8-4f55-a1fb-c2793d11f4dd.vbs
                                        Filesize

                                        707B

                                        MD5

                                        33932b87223cedca35470eabace40e67

                                        SHA1

                                        dd422a18317143eae6788c1e7b00351f53a1957b

                                        SHA256

                                        0b2ce0ed988028f94e0e0a9e798ecc3e6886fb0adf49f5d566bf814a9c125da1

                                        SHA512

                                        4c940e5e717b19c8891faf7fe827f4c4211cd04c3627d3a7773028233207f24ef80d2ce1bf0e5c6ca921cba7e4aebac81b9979ddb51cc881e33a00b8a37e52db

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\fab9cf63-9cd7-4487-90de-56afce205cc3.vbs
                                        Filesize

                                        484B

                                        MD5

                                        6676188dfb67798a7b6f4cf40d0a5b3e

                                        SHA1

                                        601827e673a8baf3cef1cb98b09c6ac24f52a71d

                                        SHA256

                                        1959a34be8efdc2b6870dd79d3d6e99939e64363e1e45eab28ae9c3e8f750c8a

                                        SHA512

                                        574f56f0b8489b5fa1da4eeebe94264783c920aaeea3f81b9d816e1b60d855040783a81783956a56390e1103b7292378b07b2c3ae9bafaa96157f7a9a791a6fd

                                        Download Submit

                                      • memory/2544-206-0x0000000002220000-0x0000000002232000-memory.dmp

                                        Filesize

                                        72KB

                                        Download

                                      • memory/3016-24-0x00007FFAABF90000-0x00007FFAACA51000-memory.dmp

                                        Filesize

                                        10.8MB

                                        Download

                                      • memory/3016-2-0x00007FFAABF90000-0x00007FFAACA51000-memory.dmp

                                        Filesize

                                        10.8MB

                                        Download

                                      • memory/3016-11-0x0000000002C50000-0x0000000002C60000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/3016-13-0x0000000002C70000-0x0000000002C7A000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/3016-113-0x00007FFAABF90000-0x00007FFAACA51000-memory.dmp

                                        Filesize

                                        10.8MB

                                        Download

                                      • memory/3016-25-0x00007FFAABF90000-0x00007FFAACA51000-memory.dmp

                                        Filesize

                                        10.8MB

                                        Download

                                      • memory/3016-9-0x0000000002B10000-0x0000000002B1C000-memory.dmp

                                        Filesize

                                        48KB

                                        Download

                                      • memory/3016-8-0x0000000002B00000-0x0000000002B08000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/3016-7-0x0000000002AF0000-0x0000000002AFC000-memory.dmp

                                        Filesize

                                        48KB

                                        Download

                                      • memory/3016-6-0x0000000002AD0000-0x0000000002ADA000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/3016-5-0x0000000002AE0000-0x0000000002AEC000-memory.dmp

                                        Filesize

                                        48KB

                                        Download

                                      • memory/3016-12-0x0000000002C60000-0x0000000002C68000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/3016-3-0x0000000002AB0000-0x0000000002AB8000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/3016-14-0x0000000002C80000-0x0000000002C8C000-memory.dmp

                                        Filesize

                                        48KB

                                        Download

                                      • memory/3016-0-0x00007FFAABF93000-0x00007FFAABF95000-memory.dmp

                                        Filesize

                                        8KB

                                        Download

                                      • memory/3016-4-0x0000000002AC0000-0x0000000002AD2000-memory.dmp

                                        Filesize

                                        72KB

                                        Download

                                      • memory/3016-21-0x0000000002CE0000-0x0000000002CE8000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/3016-18-0x0000000002CC0000-0x0000000002CC8000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/3016-20-0x0000000002CD0000-0x0000000002CDC000-memory.dmp

                                        Filesize

                                        48KB

                                        Download

                                      • memory/3016-10-0x0000000002C40000-0x0000000002C50000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/3016-17-0x0000000002CB0000-0x0000000002CBC000-memory.dmp

                                        Filesize

                                        48KB

                                        Download

                                      • memory/3016-16-0x0000000002CA0000-0x0000000002CA8000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/3016-15-0x0000000002C90000-0x0000000002C9A000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/3016-1-0x0000000000720000-0x000000000089E000-memory.dmp

                                        Filesize

                                        1.5MB

                                        Download

                                      • memory/3276-80-0x000001ACC7720000-0x000001ACC7742000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/3644-161-0x0000000000A10000-0x0000000000A22000-memory.dmp

                                        Filesize

                                        72KB

                                        Download

                                      • memory/3824-285-0x0000000000910000-0x0000000000922000-memory.dmp

                                        Filesize

                                        72KB

                                        Download

                                      • memory/4404-251-0x0000000002F80000-0x0000000002F92000-memory.dmp

                                        Filesize

                                        72KB

                                        Download