Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2023 23:57
Behavioral task
behavioral1
Sample
1fff5ee9044814883cfa8d76e281284c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1fff5ee9044814883cfa8d76e281284c.exe
Resource
win10v2004-20230220-en
General
-
Target
1fff5ee9044814883cfa8d76e281284c.exe
-
Size
2.5MB
-
MD5
1fff5ee9044814883cfa8d76e281284c
-
SHA1
519f65b397de210f1a69c95d8d6b4aebccdf6cee
-
SHA256
dcca5dae3518d25030ca6e89ab90cd5631ea028b8376e01a8d2a151eff2a744e
-
SHA512
0b3e60339d1b4a7e7d889b4db6f7187a0a10a7adb77ac21b664cd6434a9836ccb6ae7de005d4f41aeb49179fe36f09230cd5b0ed4b4695d0e1321794a3816536
-
SSDEEP
49152:jFhevimCMPQCEwTnppuDhWwBar79vwS1o5SGAY3A6S02Gb7RgtHCw9MP0:ZhrRwtkNqhwSktStGvRQHi
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1736 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2280 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4100 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1072 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2008 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2764 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2320 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4524 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2244 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2268 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4632 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4724 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3100 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4756 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1876 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1420 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1664 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2316 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 240 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2740 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2808 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1468 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2816 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1188 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1648 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4608 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1456 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4996 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3904 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2988 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2800 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1352 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4460 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2732 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4400 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3616 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1556 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4340 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2696 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1896 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2476 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2796 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5004 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3612 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3096 1692 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2540 1692 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/3700-133-0x0000000000470000-0x00000000006F6000-memory.dmp dcrat C:\Windows\en-US\Registry.exe dcrat C:\Users\Public\Videos\RuntimeBroker.exe dcrat C:\Users\Public\Videos\RuntimeBroker.exe dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1fff5ee9044814883cfa8d76e281284c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation 1fff5ee9044814883cfa8d76e281284c.exe -
Executes dropped EXE 1 IoCs
Processes:
RuntimeBroker.exepid process 1192 RuntimeBroker.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 16 IoCs
Processes:
1fff5ee9044814883cfa8d76e281284c.exedescription ioc process File created C:\Program Files (x86)\Windows Mail\29c1c3cc0f7685 1fff5ee9044814883cfa8d76e281284c.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX8383.tmp 1fff5ee9044814883cfa8d76e281284c.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhostw.exe 1fff5ee9044814883cfa8d76e281284c.exe File opened for modification C:\Program Files (x86)\Windows Mail\unsecapp.exe 1fff5ee9044814883cfa8d76e281284c.exe File created C:\Program Files (x86)\Windows Mail\Idle.exe 1fff5ee9044814883cfa8d76e281284c.exe File created C:\Program Files (x86)\Windows Mail\unsecapp.exe 1fff5ee9044814883cfa8d76e281284c.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe 1fff5ee9044814883cfa8d76e281284c.exe File opened for modification C:\Program Files (x86)\Windows Mail\RCX76DB.tmp 1fff5ee9044814883cfa8d76e281284c.exe File opened for modification C:\Program Files (x86)\Windows Mail\RCX94C1.tmp 1fff5ee9044814883cfa8d76e281284c.exe File opened for modification C:\Program Files (x86)\Windows Mail\Idle.exe 1fff5ee9044814883cfa8d76e281284c.exe File created C:\Program Files (x86)\Windows Mail\6ccacd8608530f 1fff5ee9044814883cfa8d76e281284c.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\5b884080fd4f94 1fff5ee9044814883cfa8d76e281284c.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhostw.exe 1fff5ee9044814883cfa8d76e281284c.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\ea9f0e6c9e2dcd 1fff5ee9044814883cfa8d76e281284c.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RCX96F5.tmp 1fff5ee9044814883cfa8d76e281284c.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe 1fff5ee9044814883cfa8d76e281284c.exe -
Drops file in Windows directory 4 IoCs
Processes:
1fff5ee9044814883cfa8d76e281284c.exedescription ioc process File opened for modification C:\Windows\en-US\RCX8130.tmp 1fff5ee9044814883cfa8d76e281284c.exe File opened for modification C:\Windows\en-US\Registry.exe 1fff5ee9044814883cfa8d76e281284c.exe File created C:\Windows\en-US\Registry.exe 1fff5ee9044814883cfa8d76e281284c.exe File created C:\Windows\en-US\ee2ad38f3d4382 1fff5ee9044814883cfa8d76e281284c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4608 schtasks.exe 4460 schtasks.exe 2796 schtasks.exe 3612 schtasks.exe 1420 schtasks.exe 1648 schtasks.exe 1352 schtasks.exe 2540 schtasks.exe 4524 schtasks.exe 220 schtasks.exe 3904 schtasks.exe 3616 schtasks.exe 2476 schtasks.exe 2320 schtasks.exe 1456 schtasks.exe 2808 schtasks.exe 4996 schtasks.exe 4632 schtasks.exe 4724 schtasks.exe 4756 schtasks.exe 1664 schtasks.exe 2316 schtasks.exe 240 schtasks.exe 2008 schtasks.exe 2764 schtasks.exe 4340 schtasks.exe 2696 schtasks.exe 5004 schtasks.exe 3096 schtasks.exe 2740 schtasks.exe 1468 schtasks.exe 3100 schtasks.exe 1188 schtasks.exe 2732 schtasks.exe 4100 schtasks.exe 4304 schtasks.exe 2816 schtasks.exe 2800 schtasks.exe 1556 schtasks.exe 1896 schtasks.exe 1072 schtasks.exe 1876 schtasks.exe 2244 schtasks.exe 2268 schtasks.exe 2988 schtasks.exe 4400 schtasks.exe 1736 schtasks.exe 2280 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
1fff5ee9044814883cfa8d76e281284c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 1fff5ee9044814883cfa8d76e281284c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1fff5ee9044814883cfa8d76e281284c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 3700 1fff5ee9044814883cfa8d76e281284c.exe 4560 powershell.exe 4560 powershell.exe 3172 powershell.exe 3172 powershell.exe 2460 powershell.exe 2460 powershell.exe 3100 powershell.exe 3100 powershell.exe 1960 powershell.exe 1960 powershell.exe 560 powershell.exe 560 powershell.exe 2248 powershell.exe 2248 powershell.exe 4796 powershell.exe 4796 powershell.exe 100 powershell.exe 100 powershell.exe 3760 powershell.exe 1628 powershell.exe 3760 powershell.exe 1628 powershell.exe 2924 powershell.exe 2924 powershell.exe 5008 powershell.exe 5008 powershell.exe 3984 powershell.exe 3984 powershell.exe 2432 powershell.exe 2432 powershell.exe 2212 powershell.exe 2212 powershell.exe 116 powershell.exe 116 powershell.exe 116 powershell.exe 3760 powershell.exe 1628 powershell.exe 2248 powershell.exe 3172 powershell.exe 3172 powershell.exe 2924 powershell.exe 1960 powershell.exe 4560 powershell.exe 4560 powershell.exe 560 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RuntimeBroker.exepid process 1192 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
1fff5ee9044814883cfa8d76e281284c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeRuntimeBroker.exedescription pid process Token: SeDebugPrivilege 3700 1fff5ee9044814883cfa8d76e281284c.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeDebugPrivilege 3172 powershell.exe Token: SeDebugPrivilege 2460 powershell.exe Token: SeDebugPrivilege 3100 powershell.exe Token: SeDebugPrivilege 2924 powershell.exe Token: SeDebugPrivilege 1960 powershell.exe Token: SeDebugPrivilege 560 powershell.exe Token: SeDebugPrivilege 2248 powershell.exe Token: SeDebugPrivilege 116 powershell.exe Token: SeDebugPrivilege 4796 powershell.exe Token: SeDebugPrivilege 100 powershell.exe Token: SeDebugPrivilege 3760 powershell.exe Token: SeDebugPrivilege 1628 powershell.exe Token: SeDebugPrivilege 5008 powershell.exe Token: SeDebugPrivilege 3984 powershell.exe Token: SeDebugPrivilege 2432 powershell.exe Token: SeDebugPrivilege 2212 powershell.exe Token: SeDebugPrivilege 1192 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
1fff5ee9044814883cfa8d76e281284c.exedescription pid process target process PID 3700 wrote to memory of 2460 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 2460 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 560 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 560 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 3172 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 3172 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 2248 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 2248 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 1628 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 1628 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 2924 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 2924 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 3100 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 3100 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 5008 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 5008 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 3760 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 3760 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 2432 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 2432 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 4560 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 4560 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 4796 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 4796 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 116 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 116 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 1960 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 1960 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 2212 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 2212 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 100 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 100 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 3984 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 3984 3700 1fff5ee9044814883cfa8d76e281284c.exe powershell.exe PID 3700 wrote to memory of 1192 3700 1fff5ee9044814883cfa8d76e281284c.exe RuntimeBroker.exe PID 3700 wrote to memory of 1192 3700 1fff5ee9044814883cfa8d76e281284c.exe RuntimeBroker.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fff5ee9044814883cfa8d76e281284c.exe"C:\Users\Admin\AppData\Local\Temp\1fff5ee9044814883cfa8d76e281284c.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1fff5ee9044814883cfa8d76e281284c.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\Idle.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\RuntimeBroker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\sppsvc.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\OneDrive\RuntimeBroker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\fontdrvhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\unsecapp.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\RuntimeBroker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\upfc.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\csrss.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhostw.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\Registry.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\Videos\RuntimeBroker.exe"C:\Users\Public\Videos\RuntimeBroker.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\odt\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\en-US\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\en-US\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Windows\en-US\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\odt\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\OneDrive\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\odt\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\odt\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5293a5e452e148112857e22e746feff34
SHA17a5018bf98a3e38970809531288a7e3efb979532
SHA25605e48657fb5340817f522c955b379cfb639977480af3ab1414682e9bf6616551
SHA5127332f2b22f4ab64bb67c1a493f7cf2b378e311d5be6c6c99339210d4e9022c17f01a698333cd679a0776cca23460e28ec88c2ccfcf50c732ee218ef25ab19049
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5293a5e452e148112857e22e746feff34
SHA17a5018bf98a3e38970809531288a7e3efb979532
SHA25605e48657fb5340817f522c955b379cfb639977480af3ab1414682e9bf6616551
SHA5127332f2b22f4ab64bb67c1a493f7cf2b378e311d5be6c6c99339210d4e9022c17f01a698333cd679a0776cca23460e28ec88c2ccfcf50c732ee218ef25ab19049
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5293a5e452e148112857e22e746feff34
SHA17a5018bf98a3e38970809531288a7e3efb979532
SHA25605e48657fb5340817f522c955b379cfb639977480af3ab1414682e9bf6616551
SHA5127332f2b22f4ab64bb67c1a493f7cf2b378e311d5be6c6c99339210d4e9022c17f01a698333cd679a0776cca23460e28ec88c2ccfcf50c732ee218ef25ab19049
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD52979eabc783eaca50de7be23dd4eafcf
SHA1d709ce5f3a06b7958a67e20870bfd95b83cad2ea
SHA256006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903
SHA51292bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f3v5f1n0.5oh.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Public\Videos\RuntimeBroker.exeFilesize
2.5MB
MD51fff5ee9044814883cfa8d76e281284c
SHA1519f65b397de210f1a69c95d8d6b4aebccdf6cee
SHA256dcca5dae3518d25030ca6e89ab90cd5631ea028b8376e01a8d2a151eff2a744e
SHA5120b3e60339d1b4a7e7d889b4db6f7187a0a10a7adb77ac21b664cd6434a9836ccb6ae7de005d4f41aeb49179fe36f09230cd5b0ed4b4695d0e1321794a3816536
-
C:\Users\Public\Videos\RuntimeBroker.exeFilesize
2.5MB
MD51fff5ee9044814883cfa8d76e281284c
SHA1519f65b397de210f1a69c95d8d6b4aebccdf6cee
SHA256dcca5dae3518d25030ca6e89ab90cd5631ea028b8376e01a8d2a151eff2a744e
SHA5120b3e60339d1b4a7e7d889b4db6f7187a0a10a7adb77ac21b664cd6434a9836ccb6ae7de005d4f41aeb49179fe36f09230cd5b0ed4b4695d0e1321794a3816536
-
C:\Windows\en-US\Registry.exeFilesize
2.5MB
MD51fff5ee9044814883cfa8d76e281284c
SHA1519f65b397de210f1a69c95d8d6b4aebccdf6cee
SHA256dcca5dae3518d25030ca6e89ab90cd5631ea028b8376e01a8d2a151eff2a744e
SHA5120b3e60339d1b4a7e7d889b4db6f7187a0a10a7adb77ac21b664cd6434a9836ccb6ae7de005d4f41aeb49179fe36f09230cd5b0ed4b4695d0e1321794a3816536
-
memory/100-352-0x000002385D5D0000-0x000002385D5E0000-memory.dmpFilesize
64KB
-
memory/100-511-0x000002385D5D0000-0x000002385D5E0000-memory.dmpFilesize
64KB
-
memory/100-530-0x000002385D5D0000-0x000002385D5E0000-memory.dmpFilesize
64KB
-
memory/100-520-0x000002385D5D0000-0x000002385D5E0000-memory.dmpFilesize
64KB
-
memory/116-514-0x0000028585570000-0x0000028585580000-memory.dmpFilesize
64KB
-
memory/560-510-0x000001F6A21F0000-0x000001F6A2200000-memory.dmpFilesize
64KB
-
memory/1628-515-0x000002DA63330000-0x000002DA63340000-memory.dmpFilesize
64KB
-
memory/1628-335-0x000002DA63330000-0x000002DA63340000-memory.dmpFilesize
64KB
-
memory/1628-524-0x000002DA63330000-0x000002DA63340000-memory.dmpFilesize
64KB
-
memory/1960-528-0x000001A5E19C0000-0x000001A5E19D0000-memory.dmpFilesize
64KB
-
memory/1960-517-0x000001A5E19C0000-0x000001A5E19D0000-memory.dmpFilesize
64KB
-
memory/2212-336-0x0000012274530000-0x0000012274540000-memory.dmpFilesize
64KB
-
memory/2248-340-0x0000028329730000-0x0000028329740000-memory.dmpFilesize
64KB
-
memory/2432-513-0x00000177E1410000-0x00000177E1420000-memory.dmpFilesize
64KB
-
memory/2432-533-0x00000177E1410000-0x00000177E1420000-memory.dmpFilesize
64KB
-
memory/2432-523-0x00000177E1410000-0x00000177E1420000-memory.dmpFilesize
64KB
-
memory/2460-519-0x000001E91D2C0000-0x000001E91D2D0000-memory.dmpFilesize
64KB
-
memory/2460-334-0x000001E91D2C0000-0x000001E91D2D0000-memory.dmpFilesize
64KB
-
memory/2924-527-0x00000245CA6D0000-0x00000245CA6E0000-memory.dmpFilesize
64KB
-
memory/2924-339-0x00000245CA6D0000-0x00000245CA6E0000-memory.dmpFilesize
64KB
-
memory/2924-338-0x00000245CA6D0000-0x00000245CA6E0000-memory.dmpFilesize
64KB
-
memory/2924-348-0x00000245E3480000-0x00000245E34A2000-memory.dmpFilesize
136KB
-
memory/3100-521-0x0000026F7BE00000-0x0000026F7BE10000-memory.dmpFilesize
64KB
-
memory/3100-337-0x0000026F7BE00000-0x0000026F7BE10000-memory.dmpFilesize
64KB
-
memory/3172-516-0x000002115EB80000-0x000002115EB90000-memory.dmpFilesize
64KB
-
memory/3172-333-0x000002115EB80000-0x000002115EB90000-memory.dmpFilesize
64KB
-
memory/3172-526-0x000002115EB80000-0x000002115EB90000-memory.dmpFilesize
64KB
-
memory/3700-134-0x000000001B4E0000-0x000000001B4F0000-memory.dmpFilesize
64KB
-
memory/3700-255-0x000000001B4E0000-0x000000001B4F0000-memory.dmpFilesize
64KB
-
memory/3700-135-0x0000000000F70000-0x0000000000FC0000-memory.dmpFilesize
320KB
-
memory/3700-136-0x000000001CAD0000-0x000000001CFF8000-memory.dmpFilesize
5.2MB
-
memory/3700-133-0x0000000000470000-0x00000000006F6000-memory.dmpFilesize
2.5MB
-
memory/3760-525-0x00000201F75C0000-0x00000201F75D0000-memory.dmpFilesize
64KB
-
memory/3984-358-0x000001D568D60000-0x000001D568D70000-memory.dmpFilesize
64KB
-
memory/3984-529-0x000001D568D60000-0x000001D568D70000-memory.dmpFilesize
64KB
-
memory/3984-518-0x000001D568D60000-0x000001D568D70000-memory.dmpFilesize
64KB
-
memory/4560-531-0x000002562C660000-0x000002562C670000-memory.dmpFilesize
64KB
-
memory/4560-341-0x000002562C660000-0x000002562C670000-memory.dmpFilesize
64KB
-
memory/4796-522-0x000001B5D4B50000-0x000001B5D4B60000-memory.dmpFilesize
64KB
-
memory/5008-363-0x0000022EA79B0000-0x0000022EA79C0000-memory.dmpFilesize
64KB
-
memory/5008-512-0x0000022EA79B0000-0x0000022EA79C0000-memory.dmpFilesize
64KB
-
memory/5008-532-0x0000022EA79B0000-0x0000022EA79C0000-memory.dmpFilesize
64KB