Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-09-2024 03:45
Static task
static1
Behavioral task
behavioral1
Sample
8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe
Resource
win7-20240903-en
General
-
Target
8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe
-
Size
4.9MB
-
MD5
2c5faad0c4c5b9d351a4c51797e97240
-
SHA1
b34a6bd05c0f79d5a74817c1ed4fc2d3d9fa01d6
-
SHA256
8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78e
-
SHA512
0dc0495c73f494ffb2f12722960932340dfec112a5a9c1ba35c5f769c8773bc8a092545d9b1c1c07856ef9e716b76dea8ed7e6b4549fdf589d859ce5c3a4f19e
-
SSDEEP
49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 57 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4416 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2932 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4968 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 924 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1408 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3352 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3360 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3568 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4800 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4792 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1056 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 552 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 604 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3660 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5060 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 732 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2696 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3640 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1792 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3108 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 708 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 428 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 452 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5036 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2256 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2948 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 224 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3008 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2076 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4088 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1580 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2872 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 232 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1860 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2924 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2920 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 996 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2252 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4776 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1848 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1220 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1332 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2844 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3220 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1132 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3948 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3712 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3332 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 540 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4056 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4012 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2300 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4608 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4936 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3608 4004 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4052 4004 schtasks.exe 82 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe -
resource yara_rule behavioral2/memory/4616-3-0x000000001C0C0000-0x000000001C1EE000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4604 powershell.exe 3452 powershell.exe 1216 powershell.exe 4512 powershell.exe 4476 powershell.exe 3704 powershell.exe 4272 powershell.exe 4876 powershell.exe 4536 powershell.exe 2776 powershell.exe 1588 powershell.exe -
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation services.exe -
Executes dropped EXE 40 IoCs
pid Process 8 tmp7D02.tmp.exe 3800 tmp7D02.tmp.exe 4644 services.exe 2720 tmpC94B.tmp.exe 4052 tmpC94B.tmp.exe 3328 tmpC94B.tmp.exe 760 services.exe 1572 tmpE5CC.tmp.exe 2444 tmpE5CC.tmp.exe 4012 services.exe 5084 tmp171D.tmp.exe 1716 tmp171D.tmp.exe 4640 tmp171D.tmp.exe 4760 services.exe 2504 tmp337F.tmp.exe 1708 tmp337F.tmp.exe 3592 services.exe 1932 tmp50BB.tmp.exe 2308 tmp50BB.tmp.exe 4260 services.exe 2292 tmp6EE2.tmp.exe 3664 tmp6EE2.tmp.exe 4748 services.exe 4300 tmp8CAB.tmp.exe 5068 tmp8CAB.tmp.exe 2312 services.exe 948 tmpBE0B.tmp.exe 3804 tmpBE0B.tmp.exe 4116 services.exe 3980 tmpDB28.tmp.exe 4892 tmpDB28.tmp.exe 4560 tmpDB28.tmp.exe 2396 services.exe 5092 tmpBDD.tmp.exe 1904 tmpBDD.tmp.exe 4468 tmpBDD.tmp.exe 380 tmpBDD.tmp.exe 64 services.exe 3764 tmp3C92.tmp.exe 4932 tmp3C92.tmp.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA services.exe -
Suspicious use of SetThreadContext 12 IoCs
description pid Process procid_target PID 8 set thread context of 3800 8 tmp7D02.tmp.exe 144 PID 4052 set thread context of 3328 4052 tmpC94B.tmp.exe 180 PID 1572 set thread context of 2444 1572 tmpE5CC.tmp.exe 187 PID 1716 set thread context of 4640 1716 tmp171D.tmp.exe 195 PID 2504 set thread context of 1708 2504 tmp337F.tmp.exe 201 PID 1932 set thread context of 2308 1932 tmp50BB.tmp.exe 207 PID 2292 set thread context of 3664 2292 tmp6EE2.tmp.exe 213 PID 4300 set thread context of 5068 4300 tmp8CAB.tmp.exe 219 PID 948 set thread context of 3804 948 tmpBE0B.tmp.exe 225 PID 4892 set thread context of 4560 4892 tmpDB28.tmp.exe 232 PID 4468 set thread context of 380 4468 tmpBDD.tmp.exe 240 PID 3764 set thread context of 4932 3764 tmp3C92.tmp.exe 246 -
Drops file in Program Files directory 29 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\56085415360792 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files (x86)\Google\winlogon.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\56085415360792 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files (x86)\Google\RCX9DE8.tmp 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files (x86)\Google\winlogon.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files (x86)\Windows Multimedia Platform\55b276f4edf653 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\wininit.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files\Windows Media Player\de-DE\38384e6a620884 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\0a1fd5f707cd16 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wininit.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files (x86)\Google\cc11b995f2a76d 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX90F2.tmp 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\AppxMetadata\TextInputHost.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files (x86)\Windows Portable Devices\StartMenuExperienceHost.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\wininit.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\RCX8EDD.tmp 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\StartMenuExperienceHost.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files (x86)\Windows Portable Devices\55b276f4edf653 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files\Windows Media Player\de-DE\RCX8A47.tmp 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files\Windows Media Player\de-DE\SearchApp.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\RCX9943.tmp 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\RCX9FFC.tmp 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Program Files\Windows Media Player\de-DE\SearchApp.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wininit.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCX8C5C.tmp 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\LiveKernelReports\unsecapp.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File created C:\Windows\LiveKernelReports\29c1c3cc0f7685 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Windows\LiveKernelReports\RCX81F6.tmp 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe File opened for modification C:\Windows\LiveKernelReports\unsecapp.exe 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpC94B.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp337F.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBDD.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp171D.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp50BB.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp8CAB.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpDB28.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBDD.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp7D02.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpE5CC.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp171D.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp6EE2.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBE0B.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpDB28.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBDD.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpC94B.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp3C92.tmp.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings services.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4776 schtasks.exe 3568 schtasks.exe 552 schtasks.exe 2696 schtasks.exe 5036 schtasks.exe 2948 schtasks.exe 3008 schtasks.exe 996 schtasks.exe 4608 schtasks.exe 452 schtasks.exe 224 schtasks.exe 4800 schtasks.exe 2644 schtasks.exe 3608 schtasks.exe 4968 schtasks.exe 3352 schtasks.exe 1056 schtasks.exe 2872 schtasks.exe 2924 schtasks.exe 1220 schtasks.exe 1332 schtasks.exe 4088 schtasks.exe 1580 schtasks.exe 232 schtasks.exe 3660 schtasks.exe 3332 schtasks.exe 1848 schtasks.exe 3948 schtasks.exe 604 schtasks.exe 732 schtasks.exe 3712 schtasks.exe 4416 schtasks.exe 4792 schtasks.exe 3108 schtasks.exe 1860 schtasks.exe 4056 schtasks.exe 4012 schtasks.exe 1408 schtasks.exe 428 schtasks.exe 2256 schtasks.exe 2920 schtasks.exe 1132 schtasks.exe 4936 schtasks.exe 4052 schtasks.exe 2932 schtasks.exe 924 schtasks.exe 2844 schtasks.exe 2252 schtasks.exe 3220 schtasks.exe 2300 schtasks.exe 3360 schtasks.exe 3640 schtasks.exe 1792 schtasks.exe 708 schtasks.exe 5060 schtasks.exe 2076 schtasks.exe 540 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 3452 powershell.exe 3452 powershell.exe 2776 powershell.exe 2776 powershell.exe 4604 powershell.exe 4604 powershell.exe 4876 powershell.exe 4876 powershell.exe 4536 powershell.exe 4536 powershell.exe 1216 powershell.exe 1216 powershell.exe 3704 powershell.exe 3704 powershell.exe 4476 powershell.exe 4476 powershell.exe 1588 powershell.exe 1588 powershell.exe 4512 powershell.exe 4512 powershell.exe 4272 powershell.exe 4272 powershell.exe 1588 powershell.exe 1216 powershell.exe 4476 powershell.exe 4876 powershell.exe 3452 powershell.exe 4512 powershell.exe 2776 powershell.exe 4536 powershell.exe 4604 powershell.exe 3704 powershell.exe 4272 powershell.exe 4644 services.exe 760 services.exe 4012 services.exe 4760 services.exe 3592 services.exe 4260 services.exe 4748 services.exe 2312 services.exe 4116 services.exe 2396 services.exe 64 services.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Token: SeDebugPrivilege 3452 powershell.exe Token: SeDebugPrivilege 2776 powershell.exe Token: SeDebugPrivilege 4604 powershell.exe Token: SeDebugPrivilege 4512 powershell.exe Token: SeDebugPrivilege 1216 powershell.exe Token: SeDebugPrivilege 4876 powershell.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeDebugPrivilege 3704 powershell.exe Token: SeDebugPrivilege 4476 powershell.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeDebugPrivilege 4272 powershell.exe Token: SeDebugPrivilege 4644 services.exe Token: SeDebugPrivilege 760 services.exe Token: SeDebugPrivilege 4012 services.exe Token: SeDebugPrivilege 4760 services.exe Token: SeDebugPrivilege 3592 services.exe Token: SeDebugPrivilege 4260 services.exe Token: SeDebugPrivilege 4748 services.exe Token: SeDebugPrivilege 2312 services.exe Token: SeDebugPrivilege 4116 services.exe Token: SeDebugPrivilege 2396 services.exe Token: SeDebugPrivilege 64 services.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 8 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 142 PID 4616 wrote to memory of 8 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 142 PID 4616 wrote to memory of 8 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 142 PID 8 wrote to memory of 3800 8 tmp7D02.tmp.exe 144 PID 8 wrote to memory of 3800 8 tmp7D02.tmp.exe 144 PID 8 wrote to memory of 3800 8 tmp7D02.tmp.exe 144 PID 8 wrote to memory of 3800 8 tmp7D02.tmp.exe 144 PID 8 wrote to memory of 3800 8 tmp7D02.tmp.exe 144 PID 8 wrote to memory of 3800 8 tmp7D02.tmp.exe 144 PID 8 wrote to memory of 3800 8 tmp7D02.tmp.exe 144 PID 4616 wrote to memory of 1588 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 149 PID 4616 wrote to memory of 1588 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 149 PID 4616 wrote to memory of 4272 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 150 PID 4616 wrote to memory of 4272 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 150 PID 4616 wrote to memory of 4876 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 151 PID 4616 wrote to memory of 4876 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 151 PID 4616 wrote to memory of 4604 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 152 PID 4616 wrote to memory of 4604 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 152 PID 4616 wrote to memory of 3452 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 153 PID 4616 wrote to memory of 3452 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 153 PID 4616 wrote to memory of 1216 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 154 PID 4616 wrote to memory of 1216 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 154 PID 4616 wrote to memory of 4536 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 155 PID 4616 wrote to memory of 4536 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 155 PID 4616 wrote to memory of 4512 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 156 PID 4616 wrote to memory of 4512 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 156 PID 4616 wrote to memory of 4476 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 157 PID 4616 wrote to memory of 4476 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 157 PID 4616 wrote to memory of 2776 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 158 PID 4616 wrote to memory of 2776 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 158 PID 4616 wrote to memory of 3704 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 159 PID 4616 wrote to memory of 3704 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 159 PID 4616 wrote to memory of 4728 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 170 PID 4616 wrote to memory of 4728 4616 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe 170 PID 4728 wrote to memory of 1608 4728 cmd.exe 173 PID 4728 wrote to memory of 1608 4728 cmd.exe 173 PID 4728 wrote to memory of 4644 4728 cmd.exe 174 PID 4728 wrote to memory of 4644 4728 cmd.exe 174 PID 4644 wrote to memory of 1072 4644 services.exe 175 PID 4644 wrote to memory of 1072 4644 services.exe 175 PID 4644 wrote to memory of 3192 4644 services.exe 176 PID 4644 wrote to memory of 3192 4644 services.exe 176 PID 4644 wrote to memory of 2720 4644 services.exe 177 PID 4644 wrote to memory of 2720 4644 services.exe 177 PID 4644 wrote to memory of 2720 4644 services.exe 177 PID 2720 wrote to memory of 4052 2720 tmpC94B.tmp.exe 179 PID 2720 wrote to memory of 4052 2720 tmpC94B.tmp.exe 179 PID 2720 wrote to memory of 4052 2720 tmpC94B.tmp.exe 179 PID 4052 wrote to memory of 3328 4052 tmpC94B.tmp.exe 180 PID 4052 wrote to memory of 3328 4052 tmpC94B.tmp.exe 180 PID 4052 wrote to memory of 3328 4052 tmpC94B.tmp.exe 180 PID 4052 wrote to memory of 3328 4052 tmpC94B.tmp.exe 180 PID 4052 wrote to memory of 3328 4052 tmpC94B.tmp.exe 180 PID 4052 wrote to memory of 3328 4052 tmpC94B.tmp.exe 180 PID 4052 wrote to memory of 3328 4052 tmpC94B.tmp.exe 180 PID 1072 wrote to memory of 760 1072 WScript.exe 181 PID 1072 wrote to memory of 760 1072 WScript.exe 181 PID 760 wrote to memory of 3168 760 services.exe 182 PID 760 wrote to memory of 3168 760 services.exe 182 PID 760 wrote to memory of 4392 760 services.exe 183 PID 760 wrote to memory of 4392 760 services.exe 183 PID 760 wrote to memory of 1572 760 services.exe 185 PID 760 wrote to memory of 1572 760 services.exe 185 PID 760 wrote to memory of 1572 760 services.exe 185 -
System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" services.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe"C:\Users\Admin\AppData\Local\Temp\8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\tmp7D02.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7D02.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\tmp7D02.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7D02.tmp.exe"3⤵
- Executes dropped EXE
PID:3800
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3704
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OLAwo344mv.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:1608
-
-
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4644 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c1902c1-1bc8-4eb8-9cae-863282ca1d16.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:760 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5fe7e6f-4477-491a-84ea-464a32fe8aaa.vbs"6⤵PID:3168
-
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4012 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c7cf6eb-1ecc-4254-a270-2466183f511b.vbs"8⤵PID:4764
-
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4760 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7b57dd2-c51f-42fc-8c0b-c6fa6c3105d1.vbs"10⤵PID:3804
-
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3592 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e93202ad-bbbc-4f30-8d35-d6b91e1342d5.vbs"12⤵PID:3480
-
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4260 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88687092-8a58-4e6e-9995-19182c3df804.vbs"14⤵PID:1768
-
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4748 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f9dee18-3cbd-42f6-bc81-e706d78a6ae1.vbs"16⤵PID:1112
-
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2312 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2aa02766-e02c-4b59-93ea-ace3f145f9b6.vbs"18⤵PID:4476
-
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4116 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\317fdc9b-4c35-4bbb-8f61-635b4c5283fd.vbs"20⤵PID:4372
-
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2396 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18f76c1d-893a-4f21-892c-921295dbb623.vbs"22⤵PID:2096
-
C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"C:\Users\All Users\regid.1991-06.com.microsoft\services.exe"23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:64 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad2c153c-eda7-4c1a-94aa-b0e2e7d9ed40.vbs"24⤵PID:4764
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95cbe32f-8aa5-48a0-9fc0-af01c7693997.vbs"24⤵PID:4524
-
-
C:\Users\Admin\AppData\Local\Temp\tmp3C92.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3C92.tmp.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\tmp3C92.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3C92.tmp.exe"25⤵
- Executes dropped EXE
PID:4932
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\894c0461-97a0-4c6f-a17f-0c9958ef15e0.vbs"22⤵PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\tmpBDD.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBDD.tmp.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\tmpBDD.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBDD.tmp.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\tmpBDD.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBDD.tmp.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\tmpBDD.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBDD.tmp.exe"25⤵
- Executes dropped EXE
PID:380
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2fd26c82-d0d9-4b4f-94f7-57395a9553c2.vbs"20⤵PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\tmpDB28.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDB28.tmp.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\tmpDB28.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDB28.tmp.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\tmpDB28.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDB28.tmp.exe"22⤵
- Executes dropped EXE
PID:4560
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52378ab4-b7b2-41b0-b166-70db4c6cfdd8.vbs"18⤵PID:1548
-
-
C:\Users\Admin\AppData\Local\Temp\tmpBE0B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE0B.tmp.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:948 -
C:\Users\Admin\AppData\Local\Temp\tmpBE0B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE0B.tmp.exe"19⤵
- Executes dropped EXE
PID:3804
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2429a206-708e-44ce-8d60-6110f7e5e5ad.vbs"16⤵PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\tmp8CAB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8CAB.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\tmp8CAB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8CAB.tmp.exe"17⤵
- Executes dropped EXE
PID:5068
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15f7e295-9838-499f-8cc2-a500a9bc520b.vbs"14⤵PID:3672
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6EE2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6EE2.tmp.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\tmp6EE2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6EE2.tmp.exe"15⤵
- Executes dropped EXE
PID:3664
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be10fea3-2b98-4266-9c4a-d3ef74e050c3.vbs"12⤵PID:4428
-
-
C:\Users\Admin\AppData\Local\Temp\tmp50BB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp50BB.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\tmp50BB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp50BB.tmp.exe"13⤵
- Executes dropped EXE
PID:2308
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6a98a21-a681-4e25-96fc-b3443eb0522c.vbs"10⤵PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\tmp337F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp337F.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\tmp337F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp337F.tmp.exe"11⤵
- Executes dropped EXE
PID:1708
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0913155f-1af0-4b8e-b4ac-14fe95efe359.vbs"8⤵PID:1404
-
-
C:\Users\Admin\AppData\Local\Temp\tmp171D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp171D.tmp.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\tmp171D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp171D.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\tmp171D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp171D.tmp.exe"10⤵
- Executes dropped EXE
PID:4640
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4423289-a086-4d3e-88ad-e5a9c518c498.vbs"6⤵PID:4392
-
-
C:\Users\Admin\AppData\Local\Temp\tmpE5CC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE5CC.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\tmpE5CC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE5CC.tmp.exe"7⤵
- Executes dropped EXE
PID:2444
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74d6307a-1db7-4823-a2f8-f47d6857bd74.vbs"4⤵PID:3192
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC94B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC94B.tmp.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\tmpC94B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC94B.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\tmpC94B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC94B.tmp.exe"6⤵
- Executes dropped EXE
PID:3328
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Templates\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Templates\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Templates\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Windows\LiveKernelReports\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN8" /sc MINUTE /mo 6 /tr "'C:\Users\Public\8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN" /sc ONLOGON /tr "'C:\Users\Public\8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN8" /sc MINUTE /mo 9 /tr "'C:\Users\Public\8286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78eN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\de-DE\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\de-DE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\de-DE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD52c5faad0c4c5b9d351a4c51797e97240
SHA1b34a6bd05c0f79d5a74817c1ed4fc2d3d9fa01d6
SHA2568286bc5b89759048ad65136a2d8d4ee52a431798a4664917e926dea98c61e78e
SHA5120dc0495c73f494ffb2f12722960932340dfec112a5a9c1ba35c5f769c8773bc8a092545d9b1c1c07856ef9e716b76dea8ed7e6b4549fdf589d859ce5c3a4f19e
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD56c47b3f4e68eebd47e9332eebfd2dd4e
SHA167f0b143336d7db7b281ed3de5e877fa87261834
SHA2568c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
SHA5120acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
735B
MD5225b8302912d15e130c05dbbfe384610
SHA150b6c253c307f83e620398e583b5b7281cc02c9c
SHA256f1242ae113dc11c0e624472b30fa6fd21f89dcc135ffa16c2b36d414919c824e
SHA5129aaf88808e0444e7231cacc2c22d6a84b14f5ae0358ceab429e4a12ff29e38136758537587772254f03192e9ff61aeda15cd4d55381e2533dc2b7bc6c112ea39
-
Filesize
735B
MD5b789296aef2e9c2c9e402298c32cd165
SHA10e5a01aca06452cb0179ada402fc6f44dc931059
SHA25631b909c4f4e0d8be44765fe6ba0033b04ddb2357eb48a166c362d9f47328d772
SHA512c650f1e34e2b3c4dd153e7c3eb4e65f45925c8455a102185907727facac7113f05dafd1ec04789d2c771e5a82631d0603a3a74c133a35547c907250ad79be294
-
Filesize
735B
MD5c65a9adfd47e4baf6e8b66461288f781
SHA1c5c42dbe52a5c2b6935419aba8d7725bc5b8a911
SHA2562f354490bf4b10dca25224b5fcbc1f49e1bb84b5532c5c328dba2e5fddbce26c
SHA51285eb948779981d69a24b058c858e24ea2c26e35e3cbe5b80761b66b6b7cca9d599496b9730f4dd0fa843e33784286001ea10d5d0b47cc7f213e5647d187ced6d
-
Filesize
511B
MD531f8e826b75db774a6b39296dc9d6e4f
SHA1c65de0a529ddbec79f094ce132fbdf6f4170a45f
SHA256649c7c25c50bd3043a0b3b80ea9c5e5315598177e2d46a2bd27ce582aa83028f
SHA5123c67892170cc715da370ad2d0e3b22761eaac2ada4c68f2755eddb799a7a5c8b349735280b7173ab4743ae87e09df527112050a4dfce8c487fba419132974b8e
-
Filesize
735B
MD533164e7c03d5a464e6e964fe4dd3bf96
SHA12173e5890ba7bc9238fb13cf76b3a7ea74c767c8
SHA25658e33d78f20844be178bd0bc30be247bf0d25c24dadc0adaf6c44371f27a829e
SHA51282dcf2c055220ac4442c0abc26c7ff5ff3f914fa585c08680b97d42ec8f522855fc3078cb609a757bf3b957270bfc0a5cb4722e03df61a983027c4aee7d541ff
-
Filesize
224B
MD5df5d98d9c5a21332a2d139bb446a09e3
SHA10064b8cc4de58fb20f4e3957cf7f79fb571f310b
SHA2561db4b6820559c40b07e5a6ee69ecda63b16c2e2a3604bbaa3ec6faecc2077c10
SHA512f3ca7f54f4784a270e5be1c3dba5a85864c73e042480eaad526a115bbd922fc6f42c2b6d26161eaf370d36674bbb83b142944d10fb7a28b90f6539e697b0e5a7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
735B
MD5c0522259b3bbae52165e667c5011026f
SHA17333cf1b3216e54c7b82797f2656bae0dd5c3a42
SHA256cb481271f1ab502bf6c71e2c593c1b8901ccd56ff13d47da48d92e44cd872fa1
SHA51278aabd2e8ba22315fef6c112cb2741220dcffcdc6d24325e4cee584d8cbe3a7937675a328425a0cbaea30df932e83a460c3616fe04a4b3bde81eaffa2874e51f
-
Filesize
734B
MD5d1d51578a58fe2cc45113d10dc5740b7
SHA13038c360eebb8c07fb3d3f94affcd1dfd0890abf
SHA256e7348cb7ed70c479480d03e51e5603465a2f520c60ac2a755e4c5cd9c26497db
SHA5122a418cf5ecad387062262c6201e14dcd98c16ac7969dc14e1b8dd7f66d88c97ca83fd26bbcbc9ede1741ec21461d83d31ea83095658dcc7c3a59ce6ddc2688b0
-
Filesize
735B
MD5277d9653600004c06f63b0e37152eb0a
SHA10e727b8bb31f9237478c97115db7b5285a97584e
SHA2562496b35a0d5cc11603991a95606e83af7a9f714f199fbf56dfa4796648956bf8
SHA51268c623d302343ada7c096a6e5b44291442b31d66bd9a5a00555ad179e4b2d73a9feb6fc2b73c91c62d8a9710c95819c0e5b5adff763e7c98a70beb8db89b2fd3
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2