Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 22:06
Behavioral task
behavioral1
Sample
5958e11d8981a7fe026fb065e6e6786b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5958e11d8981a7fe026fb065e6e6786b.exe
Resource
win10v2004-20220812-en
General
-
Target
5958e11d8981a7fe026fb065e6e6786b.exe
-
Size
1.7MB
-
MD5
5958e11d8981a7fe026fb065e6e6786b
-
SHA1
83cecc4d0227f5ea92bba5ee3dad5d418f77ebbf
-
SHA256
300b288ab3cdc59af5984619601115862dd26973b9dea07b6b7bde9b34480870
-
SHA512
2a0476cd0e04868fcdb294d378743409a7e2dffd14acc6dec8104c5a465091a2d179ac8206a868d70b31f171d73b97a4a983b7e0b6a1e1200f916c61f9a8bcb7
-
SSDEEP
24576:Mnq11bh7jPYVwOE4XW4mUy0ht7ERTpnzh7k3AC2UkModwnnAXl6JjhgvUMW1qdDG:+q1thGwOJJyimpnzlIdxMhlGmYkdD
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 11 IoCs
Processes:
5958e11d8981a7fe026fb065e6e6786b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\smss.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\smss.exe\", \"C:\\odt\\Registry.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\smss.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\services.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\smss.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\services.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\services.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Admin\\Local Settings\\OfficeClickToRun.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\fontdrvhost.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\smss.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\services.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\smss.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\services.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\services.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Globalization\\ELS\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\smss.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\services.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\services.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe -
Process spawned unexpected child process 33 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4932 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3448 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1136 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1224 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4804 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3636 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3540 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4648 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2256 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1752 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1424 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1440 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3800 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 208 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1580 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1308 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4328 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2096 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4624 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 392 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3880 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5076 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4720 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3224 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3064 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2336 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1288 4544 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4392 4544 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/4044-132-0x0000000000490000-0x0000000000654000-memory.dmp dcrat C:\Users\All Users\SoftwareDistribution\services.exe dcrat C:\ProgramData\SoftwareDistribution\services.exe dcrat -
Drops file in Drivers directory 1 IoCs
Processes:
5958e11d8981a7fe026fb065e6e6786b.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts 5958e11d8981a7fe026fb065e6e6786b.exe -
Executes dropped EXE 1 IoCs
Processes:
services.exepid process 1908 services.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5958e11d8981a7fe026fb065e6e6786b.exeservices.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 5958e11d8981a7fe026fb065e6e6786b.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation services.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 22 IoCs
Processes:
5958e11d8981a7fe026fb065e6e6786b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\services.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Globalization\\ELS\\Registry.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Globalization\\ELS\\Registry.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\fontdrvhost.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\fontdrvhost.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\SoftwareDistribution\\services.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Microsoft.NET\\smss.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Microsoft.NET\\smss.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\services.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\All Users\\SoftwareDistribution\\services.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Admin\\Local Settings\\OfficeClickToRun.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Admin\\Local Settings\\OfficeClickToRun.exe\"" 5958e11d8981a7fe026fb065e6e6786b.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 ipinfo.io 34 ipinfo.io -
Drops file in Program Files directory 7 IoCs
Processes:
5958e11d8981a7fe026fb065e6e6786b.exedescription ioc process File created C:\Program Files (x86)\Microsoft.NET\69ddcba757bf72 5958e11d8981a7fe026fb065e6e6786b.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\services.exe 5958e11d8981a7fe026fb065e6e6786b.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\c5b4cb5e9653cc 5958e11d8981a7fe026fb065e6e6786b.exe File created C:\Program Files\WindowsApps\SearchApp.exe 5958e11d8981a7fe026fb065e6e6786b.exe File created C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe 5958e11d8981a7fe026fb065e6e6786b.exe File created C:\Program Files (x86)\Windows Portable Devices\5b884080fd4f94 5958e11d8981a7fe026fb065e6e6786b.exe File created C:\Program Files (x86)\Microsoft.NET\smss.exe 5958e11d8981a7fe026fb065e6e6786b.exe -
Drops file in Windows directory 3 IoCs
Processes:
5958e11d8981a7fe026fb065e6e6786b.exedescription ioc process File opened for modification C:\Windows\Globalization\ELS\Registry.exe 5958e11d8981a7fe026fb065e6e6786b.exe File created C:\Windows\Globalization\ELS\ee2ad38f3d4382 5958e11d8981a7fe026fb065e6e6786b.exe File created C:\Windows\Globalization\ELS\Registry.exe 5958e11d8981a7fe026fb065e6e6786b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 33 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4624 schtasks.exe 5076 schtasks.exe 4648 schtasks.exe 2256 schtasks.exe 208 schtasks.exe 1728 schtasks.exe 1136 schtasks.exe 4804 schtasks.exe 1704 schtasks.exe 3800 schtasks.exe 4392 schtasks.exe 2428 schtasks.exe 1424 schtasks.exe 2336 schtasks.exe 3636 schtasks.exe 392 schtasks.exe 1440 schtasks.exe 1580 schtasks.exe 2096 schtasks.exe 3224 schtasks.exe 4932 schtasks.exe 2276 schtasks.exe 228 schtasks.exe 4720 schtasks.exe 3064 schtasks.exe 3448 schtasks.exe 3540 schtasks.exe 4328 schtasks.exe 1288 schtasks.exe 1308 schtasks.exe 3880 schtasks.exe 1224 schtasks.exe 1752 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
services.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings services.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5958e11d8981a7fe026fb065e6e6786b.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4092 powershell.exe 4192 powershell.exe 820 powershell.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 1220 powershell.exe 1220 powershell.exe 3152 powershell.exe 3152 powershell.exe 2216 powershell.exe 2216 powershell.exe 2780 powershell.exe 2780 powershell.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 4044 5958e11d8981a7fe026fb065e6e6786b.exe 2660 powershell.exe 2660 powershell.exe 5060 powershell.exe 3272 powershell.exe 5060 powershell.exe 3272 powershell.exe 4760 powershell.exe 4760 powershell.exe 3796 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
services.exepid process 1908 services.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
5958e11d8981a7fe026fb065e6e6786b.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeservices.exedescription pid process Token: SeDebugPrivilege 4044 5958e11d8981a7fe026fb065e6e6786b.exe Token: SeDebugPrivilege 4092 powershell.exe Token: SeDebugPrivilege 4192 powershell.exe Token: SeDebugPrivilege 820 powershell.exe Token: SeDebugPrivilege 1220 powershell.exe Token: SeDebugPrivilege 3152 powershell.exe Token: SeDebugPrivilege 2216 powershell.exe Token: SeDebugPrivilege 2780 powershell.exe Token: SeDebugPrivilege 2660 powershell.exe Token: SeDebugPrivilege 5060 powershell.exe Token: SeDebugPrivilege 3272 powershell.exe Token: SeDebugPrivilege 4760 powershell.exe Token: SeDebugPrivilege 3796 powershell.exe Token: SeDebugPrivilege 1908 services.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
5958e11d8981a7fe026fb065e6e6786b.exeservices.exedescription pid process target process PID 4044 wrote to memory of 4092 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 4092 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 4192 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 4192 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 820 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 820 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 1220 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 1220 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 3152 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 3152 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 2216 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 2216 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 2780 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 2780 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 2660 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 2660 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 3272 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 3272 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 5060 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 5060 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 3796 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 3796 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 4760 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 4760 4044 5958e11d8981a7fe026fb065e6e6786b.exe powershell.exe PID 4044 wrote to memory of 1908 4044 5958e11d8981a7fe026fb065e6e6786b.exe services.exe PID 4044 wrote to memory of 1908 4044 5958e11d8981a7fe026fb065e6e6786b.exe services.exe PID 1908 wrote to memory of 4016 1908 services.exe WScript.exe PID 1908 wrote to memory of 4016 1908 services.exe WScript.exe PID 1908 wrote to memory of 2732 1908 services.exe WScript.exe PID 1908 wrote to memory of 2732 1908 services.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5958e11d8981a7fe026fb065e6e6786b.exe"C:\Users\Admin\AppData\Local\Temp\5958e11d8981a7fe026fb065e6e6786b.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\All Users\SoftwareDistribution\services.exe"C:\Users\All Users\SoftwareDistribution\services.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df65a85c-d5b5-4006-97d1-01e9f570aaf2.vbs"3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adcb6dfd-3f57-44bb-a773-33f3d8dbdbc2.vbs"3⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Windows\Globalization\ELS\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Globalization\ELS\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\ELS\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\odt\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\SoftwareDistribution\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\SoftwareDistribution\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Local Settings\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Local Settings\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\SoftwareDistribution\services.exeFilesize
1.7MB
MD55958e11d8981a7fe026fb065e6e6786b
SHA183cecc4d0227f5ea92bba5ee3dad5d418f77ebbf
SHA256300b288ab3cdc59af5984619601115862dd26973b9dea07b6b7bde9b34480870
SHA5122a0476cd0e04868fcdb294d378743409a7e2dffd14acc6dec8104c5a465091a2d179ac8206a868d70b31f171d73b97a4a983b7e0b6a1e1200f916c61f9a8bcb7
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5c6c940df49fc678d1c74fea3c57a32f9
SHA179edd715358a82e6d29970998ff2e9b235ea4217
SHA2564e50925adb70141467a7081cc905c76fd6dab841195400683f9f67fc2602aa0a
SHA5123c1df9c18f1756ead841f68916dec03a066078b0705443d3f886fd990e2e42ebbffd46916be3f6fe39ea0505fc2c848fbdea56828fbd5aa5f24b329f8d979707
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5377c375f814a335a131901ed5d5eca44
SHA19919811b18b4f8153541b332232ae88eec42f9f7
SHA2567a73ac126468f3a94954656a0da1b494b18b6f7fc4ee09beb87573e82f300a10
SHA512c511dff1a34a5e32cf0ce2c56aa3adf71bd51e9a5afc7ae75320ac7563ebb4571f6ac5cd771fa52e9c7966112431bbdd20e4b74e1a125c273bc835f127b599b5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Temp\adcb6dfd-3f57-44bb-a773-33f3d8dbdbc2.vbsFilesize
728B
MD5dd319f22b41dca30a1692ad563ad03b0
SHA130ac003fe2c5367f428fc4857fedefcef37160da
SHA2560b2335e865523fbf8cd5cbafc3bf6142253dbd1777e04fb4ea917ee71ae3f992
SHA51223ac9e2f01f36fc6ba7c3e0ed95abedce0328c6e2b994f3c8c4c58c636c835bff00821297a5a0887742706bab55ab1cb9e8e2c799571b00c405c04f817bbe72d
-
C:\Users\Admin\AppData\Local\Temp\df65a85c-d5b5-4006-97d1-01e9f570aaf2.vbsFilesize
504B
MD514780e444b2f64c813baf826118add40
SHA120d7b37732e788ecb1bec70c605b39c42d5a3c89
SHA256f5009206b32be3b19386dbdd94bf69311b55129b496beb2f8d9d9e6c654671e1
SHA51237e0fc422536c9bb471473ee00f8dab480a2989024ef3ac39fec618d0136c48f83c225f9b7f4468307158c35a9bc7aeaa307d1d5685f9e2927b01dba10784514
-
C:\Users\All Users\SoftwareDistribution\services.exeFilesize
1.7MB
MD55958e11d8981a7fe026fb065e6e6786b
SHA183cecc4d0227f5ea92bba5ee3dad5d418f77ebbf
SHA256300b288ab3cdc59af5984619601115862dd26973b9dea07b6b7bde9b34480870
SHA5122a0476cd0e04868fcdb294d378743409a7e2dffd14acc6dec8104c5a465091a2d179ac8206a868d70b31f171d73b97a4a983b7e0b6a1e1200f916c61f9a8bcb7
-
memory/820-185-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/820-140-0x0000000000000000-mapping.dmp
-
memory/820-153-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/1220-181-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/1220-141-0x0000000000000000-mapping.dmp
-
memory/1220-157-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/1908-169-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/1908-154-0x0000000000000000-mapping.dmp
-
memory/1908-198-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/1908-199-0x0000000020BB0000-0x0000000020D72000-memory.dmpFilesize
1.8MB
-
memory/1908-200-0x00000000212B0000-0x00000000217D8000-memory.dmpFilesize
5.2MB
-
memory/2216-143-0x0000000000000000-mapping.dmp
-
memory/2216-159-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/2216-175-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/2660-163-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/2660-180-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/2660-145-0x0000000000000000-mapping.dmp
-
memory/2732-195-0x0000000000000000-mapping.dmp
-
memory/2780-176-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/2780-166-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/2780-144-0x0000000000000000-mapping.dmp
-
memory/3152-158-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/3152-182-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/3152-142-0x0000000000000000-mapping.dmp
-
memory/3272-191-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/3272-167-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/3272-146-0x0000000000000000-mapping.dmp
-
memory/3796-148-0x0000000000000000-mapping.dmp
-
memory/3796-165-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/3796-193-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/4016-194-0x0000000000000000-mapping.dmp
-
memory/4044-162-0x000000001CD40000-0x000000001CD44000-memory.dmpFilesize
16KB
-
memory/4044-135-0x000000001B449000-0x000000001B44F000-memory.dmpFilesize
24KB
-
memory/4044-160-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/4044-136-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/4044-137-0x000000001CD40000-0x000000001CD44000-memory.dmpFilesize
16KB
-
memory/4044-132-0x0000000000490000-0x0000000000654000-memory.dmpFilesize
1.8MB
-
memory/4044-134-0x0000000002860000-0x00000000028B0000-memory.dmpFilesize
320KB
-
memory/4044-161-0x000000001B449000-0x000000001B44F000-memory.dmpFilesize
24KB
-
memory/4044-133-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/4092-150-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/4092-138-0x0000000000000000-mapping.dmp
-
memory/4092-151-0x00000277FF360000-0x00000277FF382000-memory.dmpFilesize
136KB
-
memory/4092-183-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/4192-179-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/4192-139-0x0000000000000000-mapping.dmp
-
memory/4192-152-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/4760-149-0x0000000000000000-mapping.dmp
-
memory/4760-190-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/4760-164-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/5060-168-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB
-
memory/5060-147-0x0000000000000000-mapping.dmp
-
memory/5060-189-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmpFilesize
10.8MB