Malware Analysis Report

2024-10-10 12:50

Sample ID 240601-d6asgahb59
Target 8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f
SHA256 8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f
Tags
rat dcrat evasion infostealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f

Threat Level: Known bad

The file 8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f was found to be: Known bad.

Malicious Activity Summary

rat dcrat evasion infostealer trojan

UAC bypass

Process spawned unexpected child process

Dcrat family

DcRat

DCRat payload

DCRat payload

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

System policy modification

Modifies registry class

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 03:36

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 03:36

Reported

2024-06-01 03:39

Platform

win7-20240221-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\6ccacd8608530f C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
File created C:\Program Files\Windows Portable Devices\taskhost.exe C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
File created C:\Program Files\Windows Portable Devices\b75386f1303e64 C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Idle.exe C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A
N/A N/A C:\Program Files\Windows Portable Devices\taskhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2208 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 2208 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 2208 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 1888 wrote to memory of 1884 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1888 wrote to memory of 1884 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1888 wrote to memory of 1884 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1888 wrote to memory of 328 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1888 wrote to memory of 328 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1888 wrote to memory of 328 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1884 wrote to memory of 780 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 1884 wrote to memory of 780 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 1884 wrote to memory of 780 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 780 wrote to memory of 2780 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 780 wrote to memory of 2780 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 780 wrote to memory of 2780 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 780 wrote to memory of 2856 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 780 wrote to memory of 2856 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 780 wrote to memory of 2856 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2780 wrote to memory of 1824 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 2780 wrote to memory of 1824 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 2780 wrote to memory of 1824 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 1824 wrote to memory of 1052 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1824 wrote to memory of 1052 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1824 wrote to memory of 1052 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1824 wrote to memory of 2040 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1824 wrote to memory of 2040 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1824 wrote to memory of 2040 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1052 wrote to memory of 2316 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 1052 wrote to memory of 2316 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 1052 wrote to memory of 2316 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 2316 wrote to memory of 3048 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2316 wrote to memory of 3048 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2316 wrote to memory of 3048 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2316 wrote to memory of 1552 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2316 wrote to memory of 1552 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2316 wrote to memory of 1552 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 3048 wrote to memory of 1476 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 3048 wrote to memory of 1476 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 3048 wrote to memory of 1476 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 1476 wrote to memory of 2656 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1476 wrote to memory of 2656 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1476 wrote to memory of 2656 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1476 wrote to memory of 1136 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1476 wrote to memory of 1136 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 1476 wrote to memory of 1136 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2656 wrote to memory of 2452 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 2656 wrote to memory of 2452 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 2656 wrote to memory of 2452 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 2452 wrote to memory of 2124 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2452 wrote to memory of 2124 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2452 wrote to memory of 2124 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2452 wrote to memory of 2672 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2452 wrote to memory of 2672 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2452 wrote to memory of 2672 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2124 wrote to memory of 3024 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 2124 wrote to memory of 3024 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 2124 wrote to memory of 3024 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe
PID 3024 wrote to memory of 2324 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 3024 wrote to memory of 2324 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 3024 wrote to memory of 2324 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 3024 wrote to memory of 1728 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 3024 wrote to memory of 1728 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 3024 wrote to memory of 1728 N/A C:\Program Files\Windows Portable Devices\taskhost.exe C:\Windows\System32\WScript.exe
PID 2324 wrote to memory of 2428 N/A C:\Windows\System32\WScript.exe C:\Program Files\Windows Portable Devices\taskhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Portable Devices\taskhost.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe

"C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Idle.exe'" /rl HIGHEST /f

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52a88496-5088-432d-9019-d52fe0123b4c.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5c9d111-bbb1-47d3-b3cf-cbde828da910.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44f67e66-a866-44e1-a2b4-87cc6e40ad24.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37d1cfb0-71ff-4d15-9b86-be02b8084206.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fedba5c5-a0c9-47c5-ac60-feee0adbce15.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db1188cf-5b44-417e-a30c-0553c0aae164.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b269a291-598a-4d83-8e0c-185649af04fc.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8330d45-98c5-484e-a5fd-231bd9f80d50.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d459f6a-9327-42c9-8716-0cdb7c79c89a.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63472f59-55b5-4c83-9237-c0de1519a993.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49ff34e9-ccd5-42c5-b008-ca39e807182f.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4bf56fc6-2647-4d2e-a111-a8ef4fc86b51.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d5ccf36-55c4-4749-866f-d530d6a9f8d6.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79dec44e-42c6-4b09-84dd-799af4e4e4a9.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf00c334-8b4f-44a8-a9c9-7477ed0b483c.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d7d4f9c-4a22-4cbe-aeb2-412995d7a7af.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4bdce271-8749-4623-b100-e4585f744cab.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1bb88030-0422-414e-8957-ab3aa1352eb7.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75b4755b-c809-4624-b633-572fe59caec6.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50b5e020-9a17-48d8-a6de-add422b18a1c.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b2ab7d0-4964-4fb1-b40e-a74fef210e7a.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11a464b0-15df-4f17-b65c-17baf1a83309.vbs"

C:\Program Files\Windows Portable Devices\taskhost.exe

"C:\Program Files\Windows Portable Devices\taskhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7cf2ffd6-6f87-4a63-8ba2-b041ffcb95ed.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7069878e-aca0-424a-8bff-5ca121e46c8e.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 cj54390.tw1.ru udp
RU 185.114.247.232:80 cj54390.tw1.ru tcp
US 8.8.8.8:53 vh422.timeweb.ru udp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp

Files

memory/2208-0-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmp

memory/2208-1-0x0000000000CC0000-0x0000000000E2A000-memory.dmp

memory/2208-2-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

memory/2208-3-0x00000000006B0000-0x00000000006CC000-memory.dmp

memory/2208-4-0x00000000006D0000-0x00000000006E6000-memory.dmp

memory/2208-5-0x0000000000590000-0x000000000059A000-memory.dmp

memory/2208-6-0x00000000006F0000-0x00000000006FC000-memory.dmp

memory/2208-7-0x0000000000700000-0x000000000070C000-memory.dmp

memory/2208-8-0x0000000000710000-0x000000000071C000-memory.dmp

memory/2208-10-0x0000000000B60000-0x0000000000B6C000-memory.dmp

memory/2208-9-0x0000000000B50000-0x0000000000B5A000-memory.dmp

C:\Program Files\Windows Portable Devices\taskhost.exe

MD5 fc786f073330d13422f57de468f48a78
SHA1 105e24769704f2dfefcc2ba8c3d92d3721f3917e
SHA256 8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f
SHA512 9e6d0a6ad44cc30f8b7e1e6109a5b1b4d619d08ffd9ba7512ea4f75acb4a976cebfc94602eb0ce14d0dacb72183964fe360eac4b40ec5f10afd3ef49a24c6c63

memory/2208-26-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

memory/1888-25-0x00000000008A0000-0x0000000000A0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52a88496-5088-432d-9019-d52fe0123b4c.vbs

MD5 12f0c1af5b4226b69cade755916cb253
SHA1 68f678bc5776be86b5509656a65471a63cb869dc
SHA256 22a4201d8fe27934cf9fbe893831fa557d38e4d5c4f79ac64fb9519e942bef34
SHA512 4677173d91011fc9880579fac9ce2248317fde0569cf8d7415f3f618aefc6f58b7e4caf231953f3409cf61bb0c0e35e8b55a252ee58f0ee5a163ba62c439aa73

C:\Users\Admin\AppData\Local\Temp\d5c9d111-bbb1-47d3-b3cf-cbde828da910.vbs

MD5 d9c3d493cfcce5842648c4b23d754a5a
SHA1 98936168788a1a5e0ced8993864b769a8250a4aa
SHA256 8b38dc6a89a88c8e2a9387a20b90c650a69e8b6c820696fdf8ffbc3e5e043c2d
SHA512 96bcb891a532d5d7b87252b3491d53950027082bfe6e4f48d8039494d7d0fb8c5f4d50ca2658840fcd25e004e492de1ef89ab64738fe93f7af671845c7b1df8f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar2BD8.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/780-154-0x0000000001030000-0x000000000119A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44f67e66-a866-44e1-a2b4-87cc6e40ad24.vbs

MD5 b37559188269f05c420b0c2ccd11768f
SHA1 7ffe7553db70493c571172ecbdb5f53d99fa5b8d
SHA256 6f6d2f93dc34e230b704af666801e483d61e96c8c8875d9b78985ae3532b8253
SHA512 231d907958693ecbf88b47c111fc84b356774c0c468f914333143a00cb58e0569b412cee9019d49644ff87ef95427dafed2257b8ef6def969295d1a98090e5ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d8ba41a2bd54a22f80397be21b823a9
SHA1 95a4d10083018a15db583f700a0f90010d9627a8
SHA256 4a74fd08b437ee1e2abbd80476aa2d2b512a7f8915b9163c76561264190be419
SHA512 ebb44e17b5f9c78decb7d14faf97f04032c48c3f598fb7e9aa906cfc755633a8b903cde4c8cb953ce4dcc5fe89b076cc1216f0b69eb0a03568fc1846b8d97481

C:\Users\Admin\AppData\Local\Temp\fedba5c5-a0c9-47c5-ac60-feee0adbce15.vbs

MD5 141ff099c83658693f19ba8229842717
SHA1 41e1c82a3a8da0bd19715063a03b837ac42bd689
SHA256 0d6f198f3358b161738bf6cb15fc77f3d3d17b8095035fecad920dcb6c85e408
SHA512 4b67e30c995702369153c29a2829e74c2e3bb384af32189dd36261ed9b9e7adb13340420e816a84cc2df04e55c571051917d7695151628072a10fef0938baedf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f6fd40643bc199d78ac7086085c5241
SHA1 e182c6de3a83ec7309b859b8344e520aade409ad
SHA256 f0cad74a26e1ea3a5ca4b7e134679d5dd5706a388a2f8f4bb3e272501ad6ed1a
SHA512 ed7b8d54f8e84b831811910b6a54006be00c7ff663221f4121b0de2bc821ff3a4939062e9f60335f0708eadfcf2978d7a9913f2e9de422f52cfba1c9947068f0

memory/2316-392-0x0000000001210000-0x000000000137A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b269a291-598a-4d83-8e0c-185649af04fc.vbs

MD5 238c720a059fd8d8744f98a6fe64cc36
SHA1 cbf970bf9affc7cc6ca206701501dc72034c8f50
SHA256 327318bef56748746a2a84f1e8a4354b4c6e33b6947bbb90a8eb433e1b415f85
SHA512 1329cb981a2ab744518d875e283e9e8dd72f88a5c07e9deb74208ffdc985e4e9d29ae490e2405db3a5323be92ce00f52994937eeac1719e86bc85b17014c51f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c59ab517f4bdf71ccb0ee971ecf5c303
SHA1 1b2f37aa410d6263339955980f239c69f12e5743
SHA256 0ad14d7c3670e068b543c05f159091649e6a1c092dd2f5bd3e6bbd925c2cfde6
SHA512 3e84fc5d144f62db1e8809d24a27196ef9253f2b72bb843c0b1fc20108329b8ddf5add3cec5fb742487e9a1113f2dcdfb75813f6240e814f81efd8f933656373

C:\Users\Admin\AppData\Local\Temp\1d459f6a-9327-42c9-8716-0cdb7c79c89a.vbs

MD5 7cf73ce9e48840f5a88f29344912e85f
SHA1 2c1e7a0dc74822991461eb49538917845ff855d2
SHA256 41f75fcf5688554329bb4f419e3429e4d0b1ac9169ad4ad4eb080d7e124cd9d9
SHA512 39566010c71220166e1e107d2f9045a59cbc8d721e8e80e3f6738df64997b00f9e3ae3c11ad2ab061fcaea2c7e6aa750605dccb5cf136b463ee7c811060e9f5e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3b4c852fd40940463cb525a9d307f4d
SHA1 a44033b3d70b13ded20a8e447efc1e8a1d05fc0e
SHA256 19d563bd4b1df20695d573fdc85d44e845e9159435d49f2c1584c226d2d17acb
SHA512 e59bccfd2c7a65722a24c657ed0df79ac094aed3621c948088d678345e207f31ca5ced9008c00a6849011143c51de32ad0ee891779ad5169f9d25ff27a8ddd1e

C:\Users\Admin\AppData\Local\Temp\49ff34e9-ccd5-42c5-b008-ca39e807182f.vbs

MD5 b97e52cefc7b21b078e72339483b41f1
SHA1 8b89d1b996bd7374f1efa86a58183dfe0d6bd820
SHA256 c4a9cf136dfaa7cc2fc212b65d324a632fea7544fbf5028ffa2a312904e12542
SHA512 a7b0a2d738ecaa30bb537013194ec6b1a1098b56e04b3c08ef66ecef615b51c3415c56f8ec003d716f977e5218236fae8538a7501eb4012cade90dea678777b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9dd31e5ccd1f5f254a3fce260c73f048
SHA1 30b8200734771b1584c409cfc08d5136c5eaf8ab
SHA256 c256b81b195624be4832d195490c2aebb2e93c5f1f79d11c31b95147f694bf9b
SHA512 55e48ea5b632bb9fe68c619edad537ddeccfb6ac0d892f210f05d849751d568feedfcf601171326d74c312f6533a5f951141fe7d102112bfa53b23a6f23809a0

C:\Users\Admin\AppData\Local\Temp\0d5ccf36-55c4-4749-866f-d530d6a9f8d6.vbs

MD5 d42e0d3fb6f6620f6dba2653fb76bcfd
SHA1 d7285555c17c1357d830b12f8ace5bf353cf6212
SHA256 290c819fb5f513bc3fa329a09221974303e34df11ea43a6505092bfa19aa2d69
SHA512 b10e3ebb802dcd576c10ac501876078b300349c073330ce09363fce39ddbb82a0e5ca8d4c7bfa5128d1f97fe43227d525b077530830c230741981dd9ae48c0f3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15e49fd914c53279d29a705066be9783
SHA1 903ce955c25d8d4475b241e1e13cfe163daa316d
SHA256 113623c2223549d05e3d713c6800076428dc262cddbbe56c3795222e3cd4b841
SHA512 0f9bc4a7ed3f9ee4e869acae5ea4ed53d64c79840f151304de83cab21a8cba52817cce7876dca21402dd5c166d7e922254264da76a8a87073be0ee661151a255

memory/2428-865-0x0000000000060000-0x00000000001CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cf00c334-8b4f-44a8-a9c9-7477ed0b483c.vbs

MD5 8f544016cc840d29452a3cdd9e78045d
SHA1 1baa98db395c07a14d4aed4278741d5514f6a1f2
SHA256 4624ba672d468749d8b5106b72e5780cf0543d71243430bae0b0fce7e320786e
SHA512 7923d68767ef7e40dbd58f87d317178c53c6ad0bb4cd232969d9bc648b38203eb2126f6f3dd4685204e9ef15ded6f828612343d299b2be1a6b17d94d1cd6f40f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2496ed46dd578d25b8e3198280c7a0f1
SHA1 cfce870d71d6d597b47ae78308914f208ce2cf3a
SHA256 cc5d464f51868e42f75f1f3105f0883e1704c60c538151b5938740dd23949ec2
SHA512 8fc1e7fdb3b0b5b3f92a5bada4775b07b38fbde6dada76cd6a70c5a0596a9c05cabbd34c1e0e9bbc0d06a1503db1146b0c2e0ad3d0cd8d0f633cf856d10a97a4

memory/1532-984-0x0000000000EC0000-0x000000000102A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4bdce271-8749-4623-b100-e4585f744cab.vbs

MD5 2a9d25cffdcd27fbb632ddae5cc5598d
SHA1 565b2ebade38c485d950f1285aba4353ce329d9a
SHA256 2d3e164a84e4d1975078365b9c82dbb384bb5d9483eb9562a42661dfbad44876
SHA512 267e5b43e1805f38978d9ff15405ef35ba9a5f010a750b281b14585a536137220bf175650f3886725ec81969d7a3f1874d3de8fd3c81e2b25c9c695aeb6de4ab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 db6cac64f0894dda0d88422995e22e1f
SHA1 e83105e19d701959c5dba6172999c7fe638151fb
SHA256 68b36274265adf794dcff893b7e9250387f06b25ee7e8c22f3c8b1f893c3ca53
SHA512 0a8970294d4c80ded5ddcbd613ceb5b61e8ee6a7fe57573ece984accf6f7a541dd93bc5dc88371583c939da50f9be8287fc53999283e479c2f2004b35548f1d1

C:\Users\Admin\AppData\Local\Temp\75b4755b-c809-4624-b633-572fe59caec6.vbs

MD5 c2d99fe8a753af616682244c5de923a1
SHA1 a44438be8e06a2fcb2025853d933773ce0691484
SHA256 1b3f3c4564caed32c1dbba942056967ac36cb00462ad680f01abfe60f66e6c85
SHA512 644a791d8555f1d9c1d52452a857d3cb47a7771db518e13cc3b7dbd8710f19d91ca4fa907c2bb03f408870540847c6aa8b6d9663104014d42d380b3779850a6e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c020147a8b09357eabfddbd25e240c12
SHA1 45ad51174cde647a30451e7d3d59063996125df3
SHA256 97fd481d5acad47b91082d0704d0de2b75367d08981625384fa4e58532ca68c8
SHA512 ef803d402919c512a606677a6b7ea78822115275fb67f09fddc03d6894890fc82dca1ce95ec2e199c79633d3134380983a8bf64268efc67e23615780026aa865

memory/2576-1221-0x00000000000D0000-0x000000000023A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3b2ab7d0-4964-4fb1-b40e-a74fef210e7a.vbs

MD5 2f55bb61ca173d147e9179e347edd5d6
SHA1 e033e2540b6e3fa9b462b64ec49e7d1e26e4d429
SHA256 a59be3b43e555eb4157731e38a9f45896d4e5e5ed68273bb905d0fc1d5b886b4
SHA512 67a5748388b94a2966dcf34245d1eb5d7fe96aa1d85fb86922f98f1dc9eb0a43e4d575a3eb775592aadeb6d2f2bbfcfa7d0bdb2d323926df8ae0d4e04152f883

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cc6ae543211fdb88329fabe9edd5654
SHA1 d37cf9140a0579219301fa12be63104805a1e3ce
SHA256 7d3b7e6caf5d7679cb88266a8d2755ff7f4c5cb545a7613509c2eb185e95c870
SHA512 052f6c976f8bd761be23b6f26688bbfb3ce905a85cc16ae330841e84f565fc37b935b39b188f129ed6c564fb384ad53530247a374531c72479f9a7d4a75f44c6

memory/1576-1340-0x00000000010D0000-0x000000000123A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7cf2ffd6-6f87-4a63-8ba2-b041ffcb95ed.vbs

MD5 85a61227b505e7dd62450f94932bc805
SHA1 7f5a686f98b13c84092f9ff838c6a7fc1a505918
SHA256 f9bff40baddab9a4c3f850aed91eda9feebc96c0895e5bbe93f77bf67effe83a
SHA512 daf211afd1146d7be70c7dbfcc99ab0e2541c9fdd3033435f671de529540f5f0ecd619784ac8c5123f2a84af5edf7615348601e43447ef910f1bcfcaff195ab5

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 03:36

Reported

2024-06-01 03:39

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\odt\upfc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Defender\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
File created C:\Program Files\Windows Defender\5b884080fd4f94 C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\odt\upfc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A
N/A N/A C:\odt\upfc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A
Token: SeDebugPrivilege N/A C:\odt\upfc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe C:\Windows\System32\cmd.exe
PID 2252 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe C:\Windows\System32\cmd.exe
PID 1992 wrote to memory of 4700 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1992 wrote to memory of 4700 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1992 wrote to memory of 3184 N/A C:\Windows\System32\cmd.exe C:\odt\upfc.exe
PID 1992 wrote to memory of 3184 N/A C:\Windows\System32\cmd.exe C:\odt\upfc.exe
PID 3184 wrote to memory of 2372 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3184 wrote to memory of 2372 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3184 wrote to memory of 2088 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3184 wrote to memory of 2088 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 2372 wrote to memory of 1600 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 2372 wrote to memory of 1600 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 1600 wrote to memory of 1768 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1600 wrote to memory of 1768 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1600 wrote to memory of 1196 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1600 wrote to memory of 1196 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1768 wrote to memory of 3348 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 1768 wrote to memory of 3348 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 3348 wrote to memory of 3464 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3348 wrote to memory of 3464 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3348 wrote to memory of 1516 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3348 wrote to memory of 1516 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3464 wrote to memory of 3744 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 3464 wrote to memory of 3744 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 3744 wrote to memory of 2532 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3744 wrote to memory of 2532 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3744 wrote to memory of 4688 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3744 wrote to memory of 4688 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 2532 wrote to memory of 4848 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 2532 wrote to memory of 4848 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 4848 wrote to memory of 432 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 4848 wrote to memory of 432 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 4848 wrote to memory of 1600 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 4848 wrote to memory of 1600 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 432 wrote to memory of 2720 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 432 wrote to memory of 2720 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 2720 wrote to memory of 1172 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 2720 wrote to memory of 1172 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 2720 wrote to memory of 3804 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 2720 wrote to memory of 3804 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1172 wrote to memory of 3052 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 1172 wrote to memory of 3052 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 3052 wrote to memory of 5100 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3052 wrote to memory of 5100 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3052 wrote to memory of 2692 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 3052 wrote to memory of 2692 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 5100 wrote to memory of 1760 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 5100 wrote to memory of 1760 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 1760 wrote to memory of 2532 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1760 wrote to memory of 2532 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1760 wrote to memory of 4616 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1760 wrote to memory of 4616 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 2532 wrote to memory of 640 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 2532 wrote to memory of 640 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 640 wrote to memory of 5028 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 640 wrote to memory of 5028 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 640 wrote to memory of 3668 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 640 wrote to memory of 3668 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 5028 wrote to memory of 1640 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 5028 wrote to memory of 1640 N/A C:\Windows\System32\WScript.exe C:\odt\upfc.exe
PID 1640 wrote to memory of 1220 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1640 wrote to memory of 1220 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1640 wrote to memory of 4524 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe
PID 1640 wrote to memory of 4524 N/A C:\odt\upfc.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\odt\upfc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\odt\upfc.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe

"C:\Users\Admin\AppData\Local\Temp\8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\odt\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\odt\upfc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Documents\msedge.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\Admin\Documents\msedge.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Documents\msedge.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Templates\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\odt\msedge.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\odt\msedge.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\odt\msedge.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yfA9FeeY0f.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\odt\upfc.exe

"C:\odt\upfc.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd279103-6128-46e3-af94-2b3f9a6c0f6e.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95a2a74a-8ffd-44fc-9608-6a93b2c23bd4.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72191e93-c7bd-4f6d-979a-397037aa67a5.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24acafa9-38cb-4bea-8cb7-3ec54dd806d2.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e96ca5a2-6ac7-4555-ba7f-f762eb74ef92.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aab17896-6ed7-4a11-9f8a-187c4c11d8ce.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b31a9bb8-0b38-473c-a879-a43b8d547b40.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5600750c-2f9e-4cef-8572-4422603260bd.vbs"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75c64ae4-c54a-4f6a-949a-c0055e5ca865.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\998090d8-d03d-45e8-9c70-281d8b0664ed.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\195a8f81-5fa7-4be7-8d94-3ac651c8cd06.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55eb1092-5120-415b-a88e-e38f08148d04.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36c7f436-6fcb-4069-af54-a38d2cc3fe78.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95ee7fbf-91b4-43a1-b7c6-30c4d0cc31cc.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6324a53c-cae4-4c34-a3ac-1f3a32b47e05.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f596dfa4-d468-4ed6-9dac-623801408cf7.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f8881ed-5159-48a4-9b01-6f3cba7a161d.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aaefd109-fd06-4655-a80b-829c9f0a4361.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5faca53-ce7d-427b-9020-a0494c8e9d91.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70953362-f0a0-48d6-a75a-0b84c47ce532.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a75048ce-4920-4eda-8a28-444918b72eb6.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\533d1556-de88-4b74-92e1-42e5f6f48a18.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6029f12-c5c5-4c03-a906-f1393e421a1f.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76e681ca-e88a-47df-a786-7e884577120d.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a202be8-280a-494c-bc0f-d6afa2c2680b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aee024c2-8e4b-4da9-9611-030cc4de18a8.vbs"

C:\odt\upfc.exe

C:\odt\upfc.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3bb317a8-f208-4014-bbf6-15d529603f72.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20e13f31-b42b-4d3f-a3e9-e425ad7741e3.vbs"

Network

Country Destination Domain Proto
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 cj54390.tw1.ru udp
RU 185.114.247.232:80 cj54390.tw1.ru tcp
US 8.8.8.8:53 vh422.timeweb.ru udp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
US 8.8.8.8:53 232.247.114.185.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 13.107.253.64:443 tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp
RU 185.114.247.232:80 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp

Files

memory/2252-0-0x00007FFD3FDC3000-0x00007FFD3FDC5000-memory.dmp

memory/2252-1-0x0000000000D30000-0x0000000000E9A000-memory.dmp

memory/2252-2-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

memory/2252-3-0x00000000030C0000-0x00000000030DC000-memory.dmp

memory/2252-4-0x000000001C030000-0x000000001C080000-memory.dmp

memory/2252-5-0x00000000030E0000-0x00000000030F6000-memory.dmp

memory/2252-6-0x0000000003100000-0x000000000310A000-memory.dmp

memory/2252-7-0x0000000003110000-0x000000000311C000-memory.dmp

memory/2252-8-0x0000000003120000-0x000000000312C000-memory.dmp

memory/2252-9-0x0000000003130000-0x000000000313C000-memory.dmp

memory/2252-11-0x0000000001780000-0x000000000178C000-memory.dmp

memory/2252-10-0x0000000001770000-0x000000000177A000-memory.dmp

C:\Users\Default\Registry.exe

MD5 fc786f073330d13422f57de468f48a78
SHA1 105e24769704f2dfefcc2ba8c3d92d3721f3917e
SHA256 8c0267fb7146c54c0ed4e7d9e3f98ca0cb5cf483458d7e1d3a2aad6a8e05e94f
SHA512 9e6d0a6ad44cc30f8b7e1e6109a5b1b4d619d08ffd9ba7512ea4f75acb4a976cebfc94602eb0ce14d0dacb72183964fe360eac4b40ec5f10afd3ef49a24c6c63

C:\Users\Admin\AppData\Local\Temp\yfA9FeeY0f.bat

MD5 4cca8eac2967a61a2b36008d0ccdc23a
SHA1 a72fbbe34df2abf55f4de405c16646951856b421
SHA256 2ba47c4ec3cea66acd55e27befe1462060bdd816d057762db2f61a52eb340612
SHA512 a9f6a6ca2c0c1791bd128d3a8ee609275333e787db655dbe1a1efe742fb5b5100aa7f7f7f441ee6c740ae931ac8277006ef126de07711728a42fbc7eede4cee3

memory/2252-38-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cd279103-6128-46e3-af94-2b3f9a6c0f6e.vbs

MD5 2db0d019399a1f74b9af6b9b92bdde85
SHA1 b180aed994de4d54c3c34c21883917b50dab3fa8
SHA256 58a6470f02f7fb3a5f0698aeb7fa17428fc4fcae774839850fc70e2a3c42e1d4
SHA512 cc3ab8a0848597b59a75a88c753b37dcad890dde057c4dcae7a56053523ba1a0670564679b44f7db7eeb77eb32f57844bae58b0eb11b40893eb567bfb7d68a25

C:\Users\Admin\AppData\Local\Temp\95a2a74a-8ffd-44fc-9608-6a93b2c23bd4.vbs

MD5 6f8d42c1066cf16c243a3a9f3d153153
SHA1 7d5b39cdf77ad5668f74c19a3191b137ad4c2eb4
SHA256 64c32007b1f64b4536211f4beee2d4c75217a027c80057791b7c36922fb8301e
SHA512 216e58467ea0cf2a75b23b13177eb200eea52e41dde80a5fd153a15250b18c7550f97ca11bf11c349ab20e730cf8d9a51e21dd00908515b49f2580e0caee9395

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\upfc.exe.log

MD5 3ad9a5252966a3ab5b1b3222424717be
SHA1 5397522c86c74ddbfb2585b9613c794f4b4c3410
SHA256 27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249
SHA512 b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6

C:\Users\Admin\AppData\Local\Temp\72191e93-c7bd-4f6d-979a-397037aa67a5.vbs

MD5 24adf3f635605afdf301f57560bfb31c
SHA1 d67edd3d362141340b5172ddf0aeb261a202e55e
SHA256 ff5ed179a0cb57d5a118a799f84c823537c1882a2ac6290bca4db21af72160ed
SHA512 960859db516ca71b411fa0eb20a51f26843e488a1223a0bd88af8cde4298fe92f3169fefa633b8a6b0772ee3e1fbf2d94928afd178ee0bd86e0187e4fa0e2d43

C:\Users\Admin\AppData\Local\Temp\e96ca5a2-6ac7-4555-ba7f-f762eb74ef92.vbs

MD5 48f1d52b5e143e757f1f1c8dedaed193
SHA1 3e3a446c06aedcddf2049ea206eba3d590dc8051
SHA256 f859a8fa49332a16e6196e339584173c9ed64033cc9b707aff9dd36f8413b2b2
SHA512 f82da06dcd2d06261f90ed1da17579b9af04775d4b7bb59a5b2f250455a4cd678ff740ba1d99987d74a768bf96415b1557795fbd9c5a9af9d155dd969b5eb2c7

C:\Users\Admin\AppData\Local\Temp\b31a9bb8-0b38-473c-a879-a43b8d547b40.vbs

MD5 b65af62ddcb8d859bf4ff694b3ea7ab7
SHA1 951f0401b694a6f539986136c4d05e812cec3212
SHA256 84e397b6eede9c2d988d099268fb18d7556cea8c7a1f08351b2c296d9dc41c89
SHA512 63822f6b57ceba5b78d66c5b88e287f7fec9e3ed999d66c9a324de9893ea8af950f67beb868fc78904c471bdfc6bd6bffcca8fd0801e38e33a05c097918fbd57

C:\Users\Admin\AppData\Local\Temp\75c64ae4-c54a-4f6a-949a-c0055e5ca865.vbs

MD5 ce58db3abba896ffd1de55982802932e
SHA1 f09f66826297a61c97965fa84c138720d13c276a
SHA256 3e5cf0897f990317c72b7134f466fd1cfb9a3c12d7b2be661bdc643752613c9c
SHA512 cfc4f737633538c7423f2ead2129ebc1d1966d498e2dbfbbf64dc67b0af06709336b74423dc08987a4d22e4d70853098cdd3bec272df013e532a227bd0a8be33

C:\Users\Admin\AppData\Local\Temp\195a8f81-5fa7-4be7-8d94-3ac651c8cd06.vbs

MD5 f83dbb4f24186596afa88746bc93c8ee
SHA1 f4346b2a834e57900d565b7b6937bc1af787e711
SHA256 6c4516ad570a137264867279dacfef1985a42a4bb4c724f52d09ed454a1ab243
SHA512 bfa459c585086b6e217aeadae8e9bf5e0aafbc573ea8344c3bd9e15d86aa37cf99237d5aa9a501bbf91fa9a98e46eda24f722e0553edaeacd047bf826ff754ae

C:\Users\Admin\AppData\Local\Temp\36c7f436-6fcb-4069-af54-a38d2cc3fe78.vbs

MD5 2f0591ea1f2cc9eb53dc9d3e43443b67
SHA1 26cc5ae29bf51c2107e89eb8dbbd5a6998eb3b8f
SHA256 05d1146b2aa67f66b4e6f4bacc74ee5db4190918c2ad8dd2c402b63a266087dc
SHA512 45add1192bd09e998a6c971d08eb9e0ad5c67cbcb9ea7ae02bf1f9f26bbe062d7a1f5cb00990e8dadd0d77985b680b26f013a0e0c2db0c95db0a4c7089c8edac

C:\Users\Admin\AppData\Local\Temp\6324a53c-cae4-4c34-a3ac-1f3a32b47e05.vbs

MD5 eeffbdb4b7cb66878aa5bd00c4b1c463
SHA1 ad535fc9313543bc3ab8869b5f84c372a97e3aa5
SHA256 d20437d43443e0e9ea0fd2735950591490d63faee913b6e95338ea45563b073c
SHA512 3c32e2debc023a08bbed9140661c2521c7e5b074c56658aa3701e6902e4c553b00178b6fdda2bdf87b1aa6c5c7ca1c99dc50df7e093cad6e76d518901efa16e0

C:\Users\Admin\AppData\Local\Temp\6f8881ed-5159-48a4-9b01-6f3cba7a161d.vbs

MD5 3d75ce88811828e1d27022e9a881a396
SHA1 4229c80fce95e7b2d13226b89ce55f2fc10cd27c
SHA256 7b89679edb772da2222a208053d8c85b02910d51096f57845e9b8fcf8576e23f
SHA512 233bc0e69ba2dce5da922351c22eff30ad140e78520bb80161fed1251a8964ada02a554710c4cbbc69e881e04862067a36a46267699df9a0a5c1384d4d9fdc1e

C:\Users\Admin\AppData\Local\Temp\b5faca53-ce7d-427b-9020-a0494c8e9d91.vbs

MD5 94b72b86a092397ac94c20fea5bbb75d
SHA1 3397863b37efd8caa7eab9234effc0c193dfbefc
SHA256 09d5271e36a8fc186254939603b9e88374b67741e56455388d4914b90876f2b4
SHA512 ec547079c0fe4268aa5d0f12481da6d5de3916de18993c4fc0644e53f037148838aa2b7ba73dfb031d329545f669dfed3edb9024129381d59d525d9c6a7849b6

C:\Users\Admin\AppData\Local\Temp\a75048ce-4920-4eda-8a28-444918b72eb6.vbs

MD5 799714f74e52bc5284485719342c08d9
SHA1 bc9a9844775ab0b7898436a103eb4a956e6db38c
SHA256 51ac82ab282e01c97d168778f7bf7c9d653d71f6557acfff27ec33815dda8080
SHA512 86705531a181289afe0987cc1d87f2e82e3543a6d18717b477c463e152b63ead6dfc612c4c731eb5e88daf22368d5af875b38b56b69bfb3c924049d8c1aefb5d

C:\Users\Admin\AppData\Local\Temp\a6029f12-c5c5-4c03-a906-f1393e421a1f.vbs

MD5 05826fba9e1ef13e96841805c0251301
SHA1 7930236535b822e440c4a654b62df309e10c0e65
SHA256 718ba436a7ff45058a149d48a1c54a50d21bedee3f6ba7e04f8dcfd707df614a
SHA512 7afc0947b5c15191cb7696c1d375e420de47ea28ebc295d25e9e1d634363a242a95fa2e86cb5e434e01f6d3120f137b1d0c468da727a4eb7f238dc977383d484

C:\Users\Admin\AppData\Local\Temp\8a202be8-280a-494c-bc0f-d6afa2c2680b.vbs

MD5 a5b2867b4462cb8141d06703f23c386e
SHA1 9d869bb1d0b13474080457221e92a4c6a60d4e67
SHA256 f02156e8b5193f51c8b903613e695f8f8ed900fea3d3b8f20851643ac6db65fb
SHA512 4194c5c71ee230c1f755d01fc84d9c1ce427da2448515d3173d81158a7c48df98167b8fec6c7dbf5719985f2e9ca351ad5e36afefd72f5f0d695c98721a83cca

C:\Users\Admin\AppData\Local\Temp\3bb317a8-f208-4014-bbf6-15d529603f72.vbs

MD5 56add913f95aebbd5619f974b2bd6e69
SHA1 c4126877a8a9f360c46cdcad9da69bd040176e4e
SHA256 d3eb543b480f8deea9dbf134a3d93edd5f24db5ae5c44f49b04808b3a477f91a
SHA512 1a23534d582f275ddf1c0a01cfefa9f30aa957906b609aaa50223c66467fa01f735dd9e34d6dbac730f720813c9ca16167a04184c512c37fdec5ef95f00ff391