Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 22:52
General
-
Target
d76d0eede5de9005760ee65ef39708c43f9327d0ba9ebaefcd39906c951eb3d1N.exe
-
Size
4.9MB
-
MD5
b21ada03a51a7236ecf51f3b094ba460
-
SHA1
94767c26a9cf793e3fe7f095b8d548d12317e04a
-
SHA256
d76d0eede5de9005760ee65ef39708c43f9327d0ba9ebaefcd39906c951eb3d1
-
SHA512
93c38e3210cbb72e1dae14cb5656b066b8e6a719a1b749c194bdab9b129aaace59557bf1e05e611c52695e85fba84608ad5613762f9f87e7860b433cf2177e4f
-
SSDEEP
49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Score
10/10
Malware Config
Extracted
Family
colibri
Version
1.2.0
Botnet
Build1
C2
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 45 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 36 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 44 IoCs
-
Checks whether UAC is enabled 1 TTPs 24 IoCs
-
Suspicious use of SetThreadContext 11 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Drops file in Windows directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 12 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 57 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 36 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d76d0eede5de9005760ee65ef39708c43f9327d0ba9ebaefcd39906c951eb3d1N.exe"C:\Users\Admin\AppData\Local\Temp\d76d0eede5de9005760ee65ef39708c43f9327d0ba9ebaefcd39906c951eb3d1N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp7830.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7830.tmp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7830.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7830.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7830.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7830.tmp.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f62492fd-ed4f-4f00-bf62-c3d3dfb767fa.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f15468b-10f0-4377-8211-e3f46b6cb69d.vbs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\685b5aa6-7a28-42b3-84d4-2a6cf242c58c.vbs"7⤵
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25ff5771-583e-4158-bbc5-bc2a81bb67a0.vbs"9⤵
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2542a7b0-0f47-4098-b29f-c831e93bde47.vbs"11⤵
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\297ab896-4794-4dba-8868-f738a35911ae.vbs"13⤵
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b9159604-5e75-4a75-8607-242a34122077.vbs"15⤵
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\094b0c2d-1290-4f14-9168-3ea703448cd7.vbs"17⤵
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08fedd5e-04de-4bb8-84dc-6767afe1e1fb.vbs"19⤵
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c9305f5-b484-4d0c-a4c7-6eaa069d9323.vbs"21⤵
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe"22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\935a8907-181c-48e3-ae47-1433d6c4cb2e.vbs"23⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e8dc520-21ec-4b37-88a1-d6f22bd242e8.vbs"23⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp287D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp287D.tmp.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp287D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp287D.tmp.exe"24⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c02766cb-f841-45d2-9e27-5fcb956e8aee.vbs"21⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpD25.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD25.tmp.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpD25.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD25.tmp.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpD25.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD25.tmp.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpD25.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD25.tmp.exe"24⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9794e6fc-6351-40a8-8054-5193ec700973.vbs"19⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpF102.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF102.tmp.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF102.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF102.tmp.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF102.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF102.tmp.exe"21⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19617997-d272-487d-b4e0-e32edc73cdd8.vbs"17⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpC138.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC138.tmp.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpC138.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC138.tmp.exe"18⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed2fc335-b77d-4a9a-976b-cb98ec90dc7e.vbs"15⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp90D1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp90D1.tmp.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp90D1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp90D1.tmp.exe"16⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\acfdf898-9121-4722-a505-1dd41b378b27.vbs"13⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp6155.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6155.tmp.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6155.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6155.tmp.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6155.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6155.tmp.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6155.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6155.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6155.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6155.tmp.exe"17⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e333b763-c0da-48d1-a362-f15bcfe3d95f.vbs"11⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp2F58.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2F58.tmp.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2F58.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2F58.tmp.exe"12⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cfeeb8fd-6e02-48cb-8d8a-92f2ac3a4b81.vbs"9⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpFE36.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFE36.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpFE36.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFE36.tmp.exe"10⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b9bad8a-2263-4cf3-bc5f-d96264381f73.vbs"7⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpE222.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE222.tmp.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpE222.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE222.tmp.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpE222.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE222.tmp.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpE222.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE222.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpE222.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE222.tmp.exe"11⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d47f7391-c127-4e5e-b275-53a3194b20da.vbs"5⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a8b0eee-f2bd-4e79-8359-43bb38356d4f.vbs"3⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpA79A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA79A.tmp.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpA79A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA79A.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpA79A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA79A.tmp.exe"5⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Public\Pictures\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Windows\bcastdvr\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\bcastdvr\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\bcastdvr\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Adobe\Setup\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Adobe\Setup\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\Application\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\en-US\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\en-US\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Pictures\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Windows\Offline Web Pages\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe\SearchApp.exeFilesize
4.9MB
MD5b21ada03a51a7236ecf51f3b094ba460
SHA194767c26a9cf793e3fe7f095b8d548d12317e04a
SHA256d76d0eede5de9005760ee65ef39708c43f9327d0ba9ebaefcd39906c951eb3d1
SHA51293c38e3210cbb72e1dae14cb5656b066b8e6a719a1b749c194bdab9b129aaace59557bf1e05e611c52695e85fba84608ad5613762f9f87e7860b433cf2177e4f
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.logFilesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Temp\0a8b0eee-f2bd-4e79-8359-43bb38356d4f.vbsFilesize
513B
MD5e60da83b5a59e075d2d2eb02206f00e4
SHA1650a19bbc51a70df6474750a3f54f796697e8799
SHA25623717a9eb60741af9a8285aca07f91fc61dfa8654b453f554fd9cfcfa3ef87e0
SHA512acd80bf1cc2ec3a6f21b9e9203ce3233f683b891d64411cc4566dd4f9812bbe06ca154a5512a3582a5a0f8b16bb8daf91e2db4ccee72f13b56549b3997694f1f
-
C:\Users\Admin\AppData\Local\Temp\2542a7b0-0f47-4098-b29f-c831e93bde47.vbsFilesize
737B
MD5d8277a168082b9199e377e241db84677
SHA1e7dc558886e935f9835645ebfa542a4117d6c73e
SHA256f1f9c3bb6b96b9ce335167d0b4f4d30bdc3411d82beec605ecc66408b879c3b2
SHA5124d3bb3f079955ec6b4803faea1cd5251e2994934924947e636b20ec371addf007cd45d570ba90b50c3b09b46ff46b041d1d8fc37258a51c18e5462b21739b436
-
C:\Users\Admin\AppData\Local\Temp\25ff5771-583e-4158-bbc5-bc2a81bb67a0.vbsFilesize
737B
MD5f1764d35f802cf9b3cb65372ee9ee7ba
SHA149130868ab8fba137ac3224c504540dfd901ae68
SHA2562988fbc8f26752b2adafa879b7cb4667e5f0d8824dc92de4bd728d86ebf16a1a
SHA512cd04bd365301b8b5a9509affeb2ba5cd31c5900879325f3475fc7b0d69986f281eefe18e8db2c82add835ff7b4d63aecc2c6a01370306e46c8a690e3372a8d8b
-
C:\Users\Admin\AppData\Local\Temp\297ab896-4794-4dba-8868-f738a35911ae.vbsFilesize
736B
MD574c76731cf969bf52fc502dfeb06f96b
SHA1793779c1762c6058761e6160444982ba191c926c
SHA256df301683b6ecdab2978c39b14e41cd42194998b52f0b408bf515faf177d7c05e
SHA512c8b602944e5ff0b6979c372936d52b0d314812ca808bcccf51d3b818148a87a104703797cee92ecd93c23f9b5410abbc420406cea837f8e5359e96b081e87bc9
-
C:\Users\Admin\AppData\Local\Temp\685b5aa6-7a28-42b3-84d4-2a6cf242c58c.vbsFilesize
737B
MD585db644f9252a5f27b0a3f57e304ed09
SHA1f752ea0721bea0319f1aa3a162b55964f0e42969
SHA2565f2ea2cb40ba702d1f23617e31892e55c93a50b2583bd31504244335621130e7
SHA5122d4bcf9bfeb104bb7aa8ae1348f5b5fe7b2fb9fc79051b25552546c222f467933edfaebb324c0c1b3574cb442461f3f2217287c611d19998ad67d9dc0bf88585
-
C:\Users\Admin\AppData\Local\Temp\9f15468b-10f0-4377-8211-e3f46b6cb69d.vbsFilesize
737B
MD59f346892dcf10ad7a278036109670a6d
SHA1cd2c09f1b607f328e5bb25dc068f18edd746bfe7
SHA25673cc9914399483db996a95ed7a902d4e5d1ef38d2c2ca2112072373c6ba666ec
SHA5124f5af444e4f2c5aeabe80b0bd8490b7e017ec18affac8d15e3eb3864d1d9abca481419123b62d8096670ebf382dd09a10de745085381442011b6c7b047809f37
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5arw22fk.uz2.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\f62492fd-ed4f-4f00-bf62-c3d3dfb767fa.vbsFilesize
737B
MD51566b6dc86065e30860117739bb6e6f2
SHA1cbae1bac8d446b8c6b0ad2c9faafd9416ae9506e
SHA256da1e728ee4e70da51fd5af4c67c99b268eae84c0ca0585ced9047f88d9c60409
SHA5125ab982f856bb13d7dc4624dfb84d1f11b1cbb82335da4ece9c3a13d9fd97b384de3475dd4a88ff8b9e448fd6389b24956b51e099c6bbf6cbaaf24dbc76fcfd8b
-
C:\Users\Admin\AppData\Local\Temp\tmp7830.tmp.exeFilesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
C:\Windows\Offline Web Pages\RCX9441.tmpFilesize
4.9MB
MD577a15647ea3bb47803a38807a961fc58
SHA123f87eaf39a603c25e9f7476113c5186f5f51f80
SHA256aeb5e212aa2f05bfb1c263a9cbd43b2f33c9d1d6d139610d935b84bc8b05c66d
SHA51245772cb55df8970c6a21426efe8b4e4127373f668aa6336002086b4e48b5bc43bce9509d561ca117a10ae2da2403603c192296e11e1070e84813554b10e5b9b3
-
C:\Windows\bcastdvr\RCX7860.tmpFilesize
4.9MB
MD5a9228f7fcf612f11cd239718d128ada8
SHA122036e92df5496c6c2c6a0a20f8c093c005f177c
SHA2566559e44d8cc799e39fd7fbf0054d3a52e9e92df17174ee59d4bcbf89aa730c7a
SHA51209335a39fd585c9dd06ebd867092f41d5477b5e14dd1197205fee84956dbc26ed169e5b6c8571ae3a581b11835020f07d392c94dca845a9ab5bdd044be138093
-
memory/736-504-0x000000001BAA0000-0x000000001BAB2000-memory.dmpFilesize
72KB
-
memory/860-471-0x000000001B810000-0x000000001B822000-memory.dmpFilesize
72KB
-
memory/2920-225-0x000002183B110000-0x000002183B132000-memory.dmpFilesize
136KB
-
memory/3028-447-0x000000001B910000-0x000000001B922000-memory.dmpFilesize
72KB
-
memory/3048-423-0x00000000032E0000-0x00000000032F2000-memory.dmpFilesize
72KB
-
memory/3924-538-0x000000001BC60000-0x000000001BC72000-memory.dmpFilesize
72KB
-
memory/3936-329-0x00007FFF286D0000-0x00007FFF29191000-memory.dmpFilesize
10.8MB
-
memory/3936-7-0x0000000002FA0000-0x0000000002FB0000-memory.dmpFilesize
64KB
-
memory/3936-16-0x000000001C2F0000-0x000000001C2F8000-memory.dmpFilesize
32KB
-
memory/3936-13-0x000000001C2C0000-0x000000001C2CA000-memory.dmpFilesize
40KB
-
memory/3936-14-0x000000001C2D0000-0x000000001C2DE000-memory.dmpFilesize
56KB
-
memory/3936-17-0x000000001C300000-0x000000001C308000-memory.dmpFilesize
32KB
-
memory/3936-15-0x000000001C2E0000-0x000000001C2EE000-memory.dmpFilesize
56KB
-
memory/3936-12-0x000000001C890000-0x000000001CDB8000-memory.dmpFilesize
5.2MB
-
memory/3936-11-0x000000001BB60000-0x000000001BB72000-memory.dmpFilesize
72KB
-
memory/3936-10-0x000000001BB50000-0x000000001BB5A000-memory.dmpFilesize
40KB
-
memory/3936-9-0x000000001BB40000-0x000000001BB50000-memory.dmpFilesize
64KB
-
memory/3936-8-0x0000000002FB0000-0x0000000002FC6000-memory.dmpFilesize
88KB
-
memory/3936-6-0x0000000002F80000-0x0000000002F88000-memory.dmpFilesize
32KB
-
memory/3936-18-0x000000001C360000-0x000000001C36C000-memory.dmpFilesize
48KB
-
memory/3936-5-0x000000001C310000-0x000000001C360000-memory.dmpFilesize
320KB
-
memory/3936-1-0x00000000008D0000-0x0000000000DC4000-memory.dmpFilesize
5.0MB
-
memory/3936-4-0x0000000002F60000-0x0000000002F7C000-memory.dmpFilesize
112KB
-
memory/3936-0-0x00007FFF286D3000-0x00007FFF286D5000-memory.dmpFilesize
8KB
-
memory/3936-3-0x000000001BB80000-0x000000001BCAE000-memory.dmpFilesize
1.2MB
-
memory/3936-159-0x00007FFF286D0000-0x00007FFF29191000-memory.dmpFilesize
10.8MB
-
memory/3936-2-0x00007FFF286D0000-0x00007FFF29191000-memory.dmpFilesize
10.8MB
-
memory/3936-152-0x00007FFF286D3000-0x00007FFF286D5000-memory.dmpFilesize
8KB
-
memory/4012-85-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4320-390-0x000000001BE20000-0x000000001BE32000-memory.dmpFilesize
72KB
-
memory/4744-339-0x000000001C2C0000-0x000000001C2D2000-memory.dmpFilesize
72KB