Malware Analysis Report

2024-10-23 16:29

Sample ID 241014-ssnvhawajl
Target 5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN
SHA256 5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4f
Tags
dcrat evasion execution infostealer rat trojan colibri build1 discovery loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4f

Threat Level: Known bad

The file 5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN was found to be: Known bad.

Malicious Activity Summary

dcrat evasion execution infostealer rat trojan colibri build1 discovery loader

DcRat

Colibri Loader

UAC bypass

Process spawned unexpected child process

DCRat payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Modifies registry class

System policy modification

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-14 15:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-14 15:23

Reported

2024-10-14 15:26

Platform

win7-20240903-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files\Windows Defender\fr-FR\Idle.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files\Windows Defender\fr-FR\6ccacd8608530f C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\System.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files\Windows Defender\fr-FR\Idle.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files\Windows Defender\fr-FR\RCXEE8B.tmp C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\0a1fd5f707cd16 C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\System.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\27d1bcfc3c54e0 C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\RCXE35E.tmp C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\RCXE5CF.tmp C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Performance\System.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Windows\Prefetch\ReadyBoot\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Windows\Prefetch\ReadyBoot\0a1fd5f707cd16 C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Windows\Performance\System.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Windows\Performance\27d1bcfc3c54e0 C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Windows\Prefetch\ReadyBoot\RCXE7E3.tmp C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Windows\Prefetch\ReadyBoot\sppsvc.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Windows\Performance\RCXF31F.tmp C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A
N/A N/A C:\Users\Default User\winlogon.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Default User\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2012 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 904 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\cmd.exe
PID 2012 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\cmd.exe
PID 2012 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\cmd.exe
PID 1680 wrote to memory of 1848 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1680 wrote to memory of 1848 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1680 wrote to memory of 1848 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1680 wrote to memory of 1876 N/A C:\Windows\System32\cmd.exe C:\Users\Default User\winlogon.exe
PID 1680 wrote to memory of 1876 N/A C:\Windows\System32\cmd.exe C:\Users\Default User\winlogon.exe
PID 1680 wrote to memory of 1876 N/A C:\Windows\System32\cmd.exe C:\Users\Default User\winlogon.exe
PID 1876 wrote to memory of 2904 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 1876 wrote to memory of 2904 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 1876 wrote to memory of 2904 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 1876 wrote to memory of 1656 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 1876 wrote to memory of 1656 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 1876 wrote to memory of 1656 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 2904 wrote to memory of 1712 N/A C:\Windows\System32\WScript.exe C:\Users\Default User\winlogon.exe
PID 2904 wrote to memory of 1712 N/A C:\Windows\System32\WScript.exe C:\Users\Default User\winlogon.exe
PID 2904 wrote to memory of 1712 N/A C:\Windows\System32\WScript.exe C:\Users\Default User\winlogon.exe
PID 1712 wrote to memory of 2484 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 1712 wrote to memory of 2484 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 1712 wrote to memory of 2484 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 1712 wrote to memory of 2712 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 1712 wrote to memory of 2712 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 1712 wrote to memory of 2712 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe
PID 2484 wrote to memory of 1872 N/A C:\Windows\System32\WScript.exe C:\Users\Default User\winlogon.exe
PID 2484 wrote to memory of 1872 N/A C:\Windows\System32\WScript.exe C:\Users\Default User\winlogon.exe
PID 2484 wrote to memory of 1872 N/A C:\Windows\System32\WScript.exe C:\Users\Default User\winlogon.exe
PID 1872 wrote to memory of 1440 N/A C:\Users\Default User\winlogon.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default User\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default User\winlogon.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe

"C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\ReadyBoot\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Prefetch\ReadyBoot\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\fr-FR\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\fr-FR\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Performance\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\Performance\System.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jg9U23qGKp.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6177f11f-9927-48b6-89a9-8ecfe9926fb5.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27e49ed5-3f57-4fa0-aa29-318b6368ac9f.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b5f18b6-c931-4856-87ca-415e01e28ee1.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a7c201f-3b29-433e-806f-2a7413783fd4.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94a3c899-b4ba-4356-94e4-57b35303ad09.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cdea5008-6677-46c9-b2c5-1a2efd217e82.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fe87976-4528-4eeb-a501-efbf7a7f5ff6.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e2670ad-b8d7-4676-bc1c-fae1d7410733.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb98886c-0f40-469b-8598-5f198fbbb1ba.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39423374-8079-43d8-86cf-4cf813b28f75.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79aa90de-535e-4739-bc49-6cb57280ab6b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cfd109c7-832c-4334-ad6b-2299824e3139.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3aedb908-3fcb-4d37-b17b-87bc5e61c5ec.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a681308e-604a-4440-a943-f3b29ae15a70.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2acd06d1-0803-4ea1-9faf-1af6f518eb7b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a39201dd-5555-4e33-a4a3-3d271ead9cd4.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4aaac55d-0543-470f-8b89-10899346a9e8.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc1a9d3c-dfc1-4b6b-add5-0fccd7f51306.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\459b1409-981d-4638-a236-6f2b189b8de4.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7deae3a8-1352-4334-aa41-96a35cf993f7.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\679c7be1-efd8-4af2-8dd4-6ce052b846da.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\035b4429-f840-4f83-9975-ea0459b6f449.vbs"

C:\Users\Default User\winlogon.exe

"C:\Users\Default User\winlogon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce46bdb0-7c9e-4a63-af1f-c4c8c119ab99.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e5f1d68-1bbc-4655-81a3-aa931e7afcd1.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 81888.cllt.nyashteam.ru udp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 81888.cllt.nyashteam.ru udp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp

Files

memory/2012-0-0x000007FEF59C3000-0x000007FEF59C4000-memory.dmp

memory/2012-1-0x00000000011A0000-0x0000000001694000-memory.dmp

memory/2012-2-0x000000001B5A0000-0x000000001B6CE000-memory.dmp

memory/2012-3-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

memory/2012-4-0x0000000000650000-0x000000000066C000-memory.dmp

memory/2012-5-0x0000000000670000-0x0000000000678000-memory.dmp

memory/2012-6-0x0000000000680000-0x0000000000690000-memory.dmp

memory/2012-7-0x0000000000690000-0x00000000006A6000-memory.dmp

memory/2012-8-0x0000000000B60000-0x0000000000B70000-memory.dmp

memory/2012-9-0x0000000000B70000-0x0000000000B7A000-memory.dmp

memory/2012-10-0x0000000000B80000-0x0000000000B92000-memory.dmp

memory/2012-11-0x0000000000B90000-0x0000000000B9A000-memory.dmp

memory/2012-12-0x0000000000BA0000-0x0000000000BAE000-memory.dmp

memory/2012-13-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

memory/2012-14-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

memory/2012-16-0x0000000000CE0000-0x0000000000CEC000-memory.dmp

memory/2012-15-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\spoolsv.exe

MD5 4cb19f29a50b590b4e049659105ec340
SHA1 80bc53b20a62cf2d790376f121ec32ef2b1dc905
SHA256 5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4f
SHA512 53f74cb5cb83953316d0801c003e29c090acf4bb3d28f924ce70c188475dc052844abe7fd06825e068453496a5106f23d81e574c405b8887fa6445a71ed9ddd9

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 bd47dc0d0d52de0e92e28ccd19841eb0
SHA1 210f0ca3b0e19d64c7c32461e78688c117793b6c
SHA256 4085d5ef3d033cfdb00df62eff27228bda617d04cd4f1876d4ef98ab4f5ca1b0
SHA512 8588b99e89ba9741fa6057067da3f60a6d6b816ebc9003f701b08e0ff2f26dc0fbb23171a87d10bf662e87b23130e476f54a7199b61b98b7f484c583d27ad49d

memory/1612-113-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

memory/2012-133-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

memory/904-134-0x0000000002790000-0x0000000002798000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jg9U23qGKp.bat

MD5 352eed6c108eba5b3af14c03dc58fd31
SHA1 0892ece459891a35e02a01ae6ef904173a409b0d
SHA256 6e106850cf908ca973ed821ccf0e6882d26aa60eb99ba5c1d4b658f2362b1952
SHA512 2ef6cd6afa84f3160d014f2387f3a7c644fe7f18406626f7419ef74eba10938f4b630b54889aade3989e8cd3bed80e891d564305d3f3049f657665b9d2e80a98

memory/1876-159-0x0000000000120000-0x0000000000614000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\27e49ed5-3f57-4fa0-aa29-318b6368ac9f.vbs

MD5 3268e93bafe1508f5af4ad76b37250c6
SHA1 c9a4e20b68f39862e85f9f33d6d17a9ac81fffea
SHA256 c4fb021729b0989ba2ca68e3f3bfafd07d666e94c30bf76f22086ca51256e148
SHA512 682343c5535a28e7e91b9886ed620ab591790d3d47537c160b26ec7e80dc77853882d4af5b1594c61a858f7a98cba1a70793801a02dced84660014b7b631749f

C:\Users\Admin\AppData\Local\Temp\6177f11f-9927-48b6-89a9-8ecfe9926fb5.vbs

MD5 d2b16c5c5350101b1aaab3f7b91eecb3
SHA1 e06c3084a204b9959eb51f2dab1f23ede10959f4
SHA256 572bbee3c1e61c67c1b3fdaf7d42686de9e3c55a5eaf5f5e2da6a25ab19cac7f
SHA512 6ebd8f0e8f202f2eb44075ee09eb0bda4cf0ac7043ddd4d28333c1683edf0b37c44c918a65d4d69a42e829fc42b5ceb6f10b73240d098c21ff58bc4eef57696f

C:\Users\Admin\AppData\Local\Temp\tmp195A.tmp.exe

MD5 e0a68b98992c1699876f818a22b5b907
SHA1 d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA256 2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512 856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

memory/1712-173-0x0000000000F30000-0x0000000001424000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9b5f18b6-c931-4856-87ca-415e01e28ee1.vbs

MD5 a88671c3047aa358593d87ae53e0f663
SHA1 713901ce1d1c63bdfd4af1ffd977e2cdecd10882
SHA256 e9af51dbc2e057bbba5ec55322e8fca2221fb919c7c728a7c5cf0b37724d6b16
SHA512 4b114a32538b233d2e60f34b6c5d0fa8deda32e0cb3465e932f4ee648bba671005f44b2dc13cda7b93bdd4c510b2d4ec17aff5dc2916172cdff28156629029e8

C:\Users\Admin\AppData\Local\Temp\94a3c899-b4ba-4356-94e4-57b35303ad09.vbs

MD5 a716dc0032043d8274a54b4b9c4c0bb2
SHA1 071c368293ab6764a33d76713c4a4f5f9da4a483
SHA256 a440254a582d04396e38efed8e9990d4c839eaf7111384519ae7888539f695e0
SHA512 cdeed9b7b2e7859aef043c60a5c87f706fe6dcf3a530ca86349d096cb2ef83ac717dc47469b24c1c536e268e817c9671cc18e95c6a4e094e277c0390f47e7e30

memory/2544-202-0x0000000000160000-0x0000000000654000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6fe87976-4528-4eeb-a501-efbf7a7f5ff6.vbs

MD5 dc9fec6cd13de6cd6a44e9849d637f17
SHA1 a1ba20d2e545b178ec3ffb0016c1951cb8602b67
SHA256 b1b926d7e0de4017edadd0b77d77b48f7ca2b613265ef28d07623e0daecbd93e
SHA512 f18ceea24c53104e11faf16191fc1e66d2dcd2e038147409b685e8702fffde714d3c5ccdbdcea252f3cc496f8229d4633aef943fabb61a92edb80fbb5ce06969

memory/584-217-0x0000000000860000-0x0000000000D54000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bb98886c-0f40-469b-8598-5f198fbbb1ba.vbs

MD5 5d81c0ca40fbd3cb775563017b3d840e
SHA1 0d27105e398b9689d4eca51731d1c5138154f8bb
SHA256 d3f6c9a49d6495edd9209b5af6893732f1a7af440d6666148ff5d82b20d2b314
SHA512 84f4d4c83162298c1d2e633b9d98ca1ddb7e5a4afddb54fbec3d6022ef94cd4fd2ee0ef2b253c030f07c2e7e3744c184320d429ae9f68811ba307b03246a9d73

memory/2072-232-0x0000000000D60000-0x0000000001254000-memory.dmp

memory/2072-233-0x0000000000D50000-0x0000000000D62000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\79aa90de-535e-4739-bc49-6cb57280ab6b.vbs

MD5 5a5e29a796eef79a77ff0627cccfd970
SHA1 5e8cf0219136a93363fb779dc8f014199bac0e47
SHA256 3a4508cccf47c7047637043b063238e17d28e7aefe2f3ec422d25a4eafad58cb
SHA512 78a9e0728f3f0c77b4c4801ef8fa208087acc96950704f93c8028f7dbfc6f6db76cc33faa01b985869aa6fb9d1aa143b8b73235003887b6ba02a817f56c5066b

memory/1532-248-0x00000000004A0000-0x00000000004B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3aedb908-3fcb-4d37-b17b-87bc5e61c5ec.vbs

MD5 cda3590aa04cc77bfc3ea27570e158b5
SHA1 d0e0e36a19f7d5f8bde43b945c4fec54d429ee5a
SHA256 93fe64ce3c2808898cd9f79f0546e0000e742d412ff3d0331a043ba6d5e961e9
SHA512 eedbd731f005507970262f7256dbabbafd51e0544e93744be60e59b796f484762e639052d002d7364f9ff5ae18e89c6786530740ebe46342f6ac49773b82784c

memory/276-263-0x00000000003E0000-0x00000000008D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2acd06d1-0803-4ea1-9faf-1af6f518eb7b.vbs

MD5 88a62b421a0241f10d11bc1919c30c08
SHA1 019aa1f23476fd004d10b98f5db23d4e7950654d
SHA256 9d26aa5fa8d87a84fb2bf058222ab3a380a64fba4bfc494cfe395676ace16f78
SHA512 10276351df83f56f5c5b49c0481caa4722d6d8ee5a7e6b94c3d5a6f65f6bfba72222a32605b1a875204c060e3ee9d861931ef54f9bf9407afe36870367939f02

memory/2028-278-0x0000000000EF0000-0x00000000013E4000-memory.dmp

memory/2028-279-0x0000000000590000-0x00000000005A2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4aaac55d-0543-470f-8b89-10899346a9e8.vbs

MD5 08fb6bb8f526f69fdbcbac3601e8938e
SHA1 75f3ad2c36cd515d7f35091a47aa9178a754ae81
SHA256 ac5846e29c2e23ae0bcb758038e468f9ba95006c30eaaeb89e5ca2ebe0d8f61d
SHA512 2f69d760aabab9d59c7c2aa2fb894742993e4becbd1ded6e960c2bbcc48924542aa4dd46f47f10bcdf622bf2f5f18e3f7af362bde1036f9dbc3499f6673f8d28

memory/2412-294-0x00000000002B0000-0x00000000007A4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\459b1409-981d-4638-a236-6f2b189b8de4.vbs

MD5 d6cbc7c50aeecf5324d3e61beac64946
SHA1 a0f934be918e81a28ea3376cd6e10ef74717d3e2
SHA256 81bf5c9203d07b18af50d4aa710d24837bc01cf4b49754b39fa7a448c9549ebb
SHA512 8be8b852647b11a0f39917751802193c4f055db23c21fb610512805b75ef7ff84555de7a9c9a242e73c9f17edf3c82fd994e0ed08d7796a8c8f2655f9679acd5

C:\Users\Admin\AppData\Local\Temp\0e5b2fa84a2497a5b430844da60a911465139fb2.exe

MD5 2dd05b0e37103a6c7c09b857b60f21a7
SHA1 ac9372c4596caf9e72b67ac975aa47f91ce57c95
SHA256 110d4bfc1ed71e48ea11facccfa0194e88780573770dc33e3dce3d5156926d70
SHA512 2ae5a6ae7c71e66f7a6ac9a96da4a07785e02a57d9075b8ac7fc7063a416b99d3093fcaddae9432073296ab170abf0fafb7473513a4fa8ba0a801e75aee603e5

memory/2672-309-0x0000000001100000-0x00000000015F4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\679c7be1-efd8-4af2-8dd4-6ce052b846da.vbs

MD5 8ef81070ad8e2fa0fe1a50d334d0627e
SHA1 35cb5d3d73b01732b877f0ed8493295e13497e45
SHA256 15426962333a1d4fedd4491f43a6e3ee563b50468804d3bb5df074cba5facfc1
SHA512 a127f3ad28351958902574779bb6a5a20e80def77e58b83cb50a338cb316c0e24e16621cf46e18a72707faf4acf849a373dd67f8db592cb450e0004642dee57b

memory/2944-324-0x0000000000030000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ce46bdb0-7c9e-4a63-af1f-c4c8c119ab99.vbs

MD5 42578989c5e70f7e10cd819fab9c69e0
SHA1 6c66826e133fded4dc6f1013397721f34bc2a622
SHA256 4596a91f4d11de960f7af05e3f55f69a57d26b8219b42c39d354ba8b883f7a5a
SHA512 6720c7c394a8d4296b24f06b12424db337c3ebe5ce5e89d68d61f6c88953ab1dd2932437ca12139f65fb30ca1726693edf2bf4e47c6bf19be836d9cb82915529

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-14 15:23

Reported

2024-10-14 15:26

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe"

Signatures

Colibri Loader

loader colibri

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpF954.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpF954.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp89EC.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp89EC.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp142A.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp142A.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp2F73.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp2F73.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp6826.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp6826.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp98DB.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp98DB.tmp.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpB646.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpB646.tmp.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3056 set thread context of 1956 N/A C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 1816 set thread context of 4192 N/A C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 1460 set thread context of 2180 N/A C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe
PID 1424 set thread context of 1752 N/A C:\Users\Admin\AppData\Local\Temp\tmpF954.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpF954.tmp.exe
PID 1720 set thread context of 3284 N/A C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp.exe
PID 4288 set thread context of 3064 N/A C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp.exe
PID 2972 set thread context of 2648 N/A C:\Users\Admin\AppData\Local\Temp\tmp89EC.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp89EC.tmp.exe
PID 4716 set thread context of 1372 N/A C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe
PID 3400 set thread context of 2984 N/A C:\Users\Admin\AppData\Local\Temp\tmp142A.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp142A.tmp.exe
PID 4936 set thread context of 3080 N/A C:\Users\Admin\AppData\Local\Temp\tmp2F73.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp2F73.tmp.exe
PID 2280 set thread context of 4856 N/A C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe
PID 232 set thread context of 1632 N/A C:\Users\Admin\AppData\Local\Temp\tmp6826.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp6826.tmp.exe
PID 824 set thread context of 1540 N/A C:\Users\Admin\AppData\Local\Temp\tmp98DB.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp98DB.tmp.exe
PID 740 set thread context of 2372 N/A C:\Users\Admin\AppData\Local\Temp\tmpB646.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpB646.tmp.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows NT\TableTextService\smss.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\69ddcba757bf72 C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\RCX8A37.tmp C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files\MSBuild\Microsoft\dwm.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\e1ef82546f0b02 C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX860E.tmp C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\smss.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files\MSBuild\Microsoft\dwm.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Program Files\MSBuild\Microsoft\6cb0b6c459d5d3 C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Program Files\MSBuild\Microsoft\RCX7D9D.tmp C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Globalization\ICU\RCX8823.tmp C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File opened for modification C:\Windows\Globalization\ICU\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Windows\Globalization\ICU\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
File created C:\Windows\Globalization\ICU\9e8d7a4ca61bd9 C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp89EC.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp142A.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp98DB.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpF954.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp2F73.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmp6826.tmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\tmpB646.tmp.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1892 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 1892 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 1892 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 3056 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 3056 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 3056 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 3056 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 3056 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 3056 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 3056 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe
PID 1892 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1892 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Recovery\WindowsRE\fontdrvhost.exe
PID 1892 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe C:\Recovery\WindowsRE\fontdrvhost.exe
PID 2156 wrote to memory of 1564 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 2156 wrote to memory of 1564 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 2156 wrote to memory of 2360 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 2156 wrote to memory of 2360 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 2156 wrote to memory of 1816 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 2156 wrote to memory of 1816 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 2156 wrote to memory of 1816 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 1816 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 1816 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 1816 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 1816 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 1816 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 1816 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 1816 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe
PID 1564 wrote to memory of 2348 N/A C:\Windows\System32\WScript.exe C:\Recovery\WindowsRE\fontdrvhost.exe
PID 1564 wrote to memory of 2348 N/A C:\Windows\System32\WScript.exe C:\Recovery\WindowsRE\fontdrvhost.exe
PID 2348 wrote to memory of 3628 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 2348 wrote to memory of 3628 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 2348 wrote to memory of 3716 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 2348 wrote to memory of 3716 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 2348 wrote to memory of 1460 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe
PID 2348 wrote to memory of 1460 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe
PID 2348 wrote to memory of 1460 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe
PID 1460 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe
PID 1460 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe
PID 1460 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe
PID 1460 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe
PID 1460 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe
PID 1460 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe
PID 1460 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe

"C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Users\Public\sysmon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Public\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Users\Public\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Globalization\ICU\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Globalization\ICU\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Globalization\ICU\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN5" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN5" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Recovery\WindowsRE\fontdrvhost.exe

"C:\Recovery\WindowsRE\fontdrvhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d0d4bec-758f-45d4-b574-de1263882bdb.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81002226-7e33-419f-bbe5-1e43a589a7bc.vbs"

C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpA19F.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e0ef1669-fd73-4f08-96f3-200edaa2af43.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\603873d1-40ec-4028-ba56-80c9d8436a67.vbs"

C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2665315d-df32-4222-881d-fca580790746.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ca2760e-2556-4d0f-a5e2-9e0f71c1280a.vbs"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1035971a-98e9-400a-9f41-506061fe99db.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\893fbd56-db49-4171-8b0a-0c4e15acf430.vbs"

C:\Users\Admin\AppData\Local\Temp\tmpF954.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpF954.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmpF954.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpF954.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3efeea0-2ba1-476f-bf5b-23c36a5e6740.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7899b6a-fb82-4b29-b1b8-d5fe7bf62642.vbs"

C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp290F.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2972947f-bb71-48f1-94f0-a42476201b31.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17a3a682-9a33-4475-b938-46c3bb9562bc.vbs"

C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9bab671-577e-4cba-be8a-9d1d3aef479e.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7bbf5787-68e4-4c00-9ce3-41ba73e1fbda.vbs"

C:\Users\Admin\AppData\Local\Temp\tmp89EC.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp89EC.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmp89EC.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp89EC.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a2bf8b6-bf31-4e0f-b147-75e84c7d3510.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d35b4bb-680a-4efe-b1ff-956b63c34fc1.vbs"

C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpE347.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce3ee472-be87-4bfb-ac04-6fce115df4c9.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b79819a-7c9c-42cf-bda3-f10223bbbf1c.vbs"

C:\Users\Admin\AppData\Local\Temp\tmp142A.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp142A.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmp142A.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp142A.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02633907-a268-46e6-93af-883d2e0dc9ba.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\624b2df2-d2fa-460d-94b9-b52b1b66b888.vbs"

C:\Users\Admin\AppData\Local\Temp\tmp2F73.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp2F73.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmp2F73.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp2F73.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68daac25-a672-431c-b636-07c5c50bc3a9.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef2aec91-7992-4ff3-b715-b3dc37458ecb.vbs"

C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5ea50ba-3434-4d8c-b839-f3e359fdc28e.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\122ef2b5-324c-4247-8929-7ac9b3551eaa.vbs"

C:\Users\Admin\AppData\Local\Temp\tmp6826.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp6826.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmp6826.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp6826.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e74aead3-fac3-4955-8817-c20f49b4bb00.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43e426ab-f438-44e4-9498-22b41e094d54.vbs"

C:\Users\Admin\AppData\Local\Temp\tmp98DB.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp98DB.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmp98DB.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp98DB.tmp.exe"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7cc94019-0377-41fc-85ea-5e13fc19645e.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36b6d892-927d-4b34-b4b2-cfaa0d307b6e.vbs"

C:\Users\Admin\AppData\Local\Temp\tmpB646.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpB646.tmp.exe"

C:\Users\Admin\AppData\Local\Temp\tmpB646.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmpB646.tmp.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 8.8.8.8:53 81888.cllt.nyashteam.ru udp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 8.2.21.104.in-addr.arpa udp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 104.21.2.8:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 8.8.8.8:53 81888.cllt.nyashteam.ru udp
US 172.67.186.200:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 200.186.67.172.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 172.67.186.200:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 172.67.186.200:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 172.67.186.200:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 172.67.186.200:80 81888.cllt.nyashteam.ru tcp
US 172.67.186.200:80 81888.cllt.nyashteam.ru tcp
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
US 8.8.8.8:53 yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx udp
US 172.67.186.200:80 tcp

Files

memory/1892-0-0x00007FFE3D2D3000-0x00007FFE3D2D5000-memory.dmp

memory/1892-1-0x0000000000C50000-0x0000000001144000-memory.dmp

memory/1892-2-0x00007FFE3D2D0000-0x00007FFE3DD91000-memory.dmp

memory/1892-3-0x000000001BF20000-0x000000001C04E000-memory.dmp

memory/1892-4-0x0000000003460000-0x000000000347C000-memory.dmp

memory/1892-7-0x000000001BEA0000-0x000000001BEB0000-memory.dmp

memory/1892-6-0x000000001BE90000-0x000000001BE98000-memory.dmp

memory/1892-9-0x000000001BED0000-0x000000001BEE0000-memory.dmp

memory/1892-8-0x000000001BEB0000-0x000000001BEC6000-memory.dmp

memory/1892-5-0x000000001C690000-0x000000001C6E0000-memory.dmp

memory/1892-10-0x000000001BEE0000-0x000000001BEEA000-memory.dmp

memory/1892-11-0x000000001BEF0000-0x000000001BF02000-memory.dmp

memory/1892-12-0x000000001CC10000-0x000000001D138000-memory.dmp

memory/1892-13-0x000000001BF00000-0x000000001BF0A000-memory.dmp

memory/1892-15-0x000000001C060000-0x000000001C06E000-memory.dmp

memory/1892-14-0x000000001C050000-0x000000001C05E000-memory.dmp

memory/1892-18-0x000000001C7F0000-0x000000001C7FC000-memory.dmp

memory/1892-17-0x000000001C6E0000-0x000000001C6E8000-memory.dmp

memory/1892-16-0x000000001C070000-0x000000001C078000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe

MD5 4cb19f29a50b590b4e049659105ec340
SHA1 80bc53b20a62cf2d790376f121ec32ef2b1dc905
SHA256 5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4f
SHA512 53f74cb5cb83953316d0801c003e29c090acf4bb3d28f924ce70c188475dc052844abe7fd06825e068453496a5106f23d81e574c405b8887fa6445a71ed9ddd9

C:\Users\Admin\AppData\Local\Temp\tmp8292.tmp.exe

MD5 e0a68b98992c1699876f818a22b5b907
SHA1 d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA256 2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512 856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

memory/1956-70-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xxdxo4ad.4ez.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4364-177-0x0000020159E20000-0x0000020159E42000-memory.dmp

memory/1892-264-0x00007FFE3D2D0000-0x00007FFE3DD91000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

C:\Users\Admin\AppData\Local\Temp\5d0d4bec-758f-45d4-b574-de1263882bdb.vbs

MD5 f62c7ff304332b440945b11fb23e8c9c
SHA1 1206a6e03c16464b1799c88d2788cb3a9509e6dc
SHA256 d2ff64914ed4e33970dd12038b085269b54533552d20beccc4c26767b9f67346
SHA512 7656e9b7d1b0122c12f7a8347fc5021ee2da32ae6552c7120fe4f0805d0109f0ad538ffe12227cc09f65e7c0e8568aa1984f1fe0f575734eedf2a072b772cb7b

C:\Users\Admin\AppData\Local\Temp\81002226-7e33-419f-bbe5-1e43a589a7bc.vbs

MD5 55efe8e582bb7ccb668f8d178edd4df1
SHA1 9df40932171eb010961be2da83b0f3cbe998d4f1
SHA256 da3bda6eb717d79367476a2370beafed87152fd1d798a3172284a7c51d3b4581
SHA512 8a36e58f66c04c0c5a2fba38688c6bf4d53219b6868de1d81a2d6be974bf6f098c25af566549039f61f47006632367afee0dc5264242f88782f804bf89d6894e

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

C:\Users\Admin\AppData\Local\Temp\e0ef1669-fd73-4f08-96f3-200edaa2af43.vbs

MD5 80ff2d671de0eaffc7e57f66b861021e
SHA1 3979c916090f6627c77469c60b1b3f7c824c8685
SHA256 5e62a3e6040b067728ba9bfbe38a390df30b5ce90c530776cc4534bf280a2e4c
SHA512 63aec3bce62f294db64c480bc3939f9896497182b6ae913fa2e761761b4cb4618516b1e2fc01bc018f432a31175027fc68c05d0f9d62e66806bbd5e9dc8e1f51

C:\Users\Admin\AppData\Local\Temp\2665315d-df32-4222-881d-fca580790746.vbs

MD5 cf8aedef7056670888e66e59d3cc82a4
SHA1 3bc31249a9ea27487f94c7daefe447d56cd0f87e
SHA256 5944bc0c8afaa27a30bdca87d33bcd44ebbf20f14cb28c4f875cdfb16603033b
SHA512 c5d53a59788b14c056a6140ca43a182e635c48dd9e1ee19e6f434c2b592f2be85eb21489df982a2e16d5059b8e7d8eaa2f13190a59134e31e4ffd016c6817b72

C:\Users\Admin\AppData\Local\Temp\1035971a-98e9-400a-9f41-506061fe99db.vbs

MD5 7f31d1ec7f6f41d986d909bcdb1d5fbf
SHA1 e634af0932d76ecc57195f041deacad4c88c52ce
SHA256 f3a37fb4031703e03693f2e73a3dd2e27655fef587f5c907e8864d97cc6cad61
SHA512 9885108cf54058dd47e9ea74e6fc768725a55572ec03ba4a2bfc7a768630284685f6ba585c2870502cbd4fa6d0ae0e5abf2128e65dc492c8795603e39a19d2a9

C:\Users\Admin\AppData\Local\Temp\f3efeea0-2ba1-476f-bf5b-23c36a5e6740.vbs

MD5 8400f7c4123f1584bf5de0bd979aeccd
SHA1 13407108f964f8a18609eb324b6ba9f0650b5e5b
SHA256 8590541866726549860f7b9140f954f22533903e8a18c3e45c91d7bc0fb7f7c4
SHA512 15fd359ac1c57a4c29838ff589bd34ba7b546c722d44bb6ac48efb31f1ffc0127503b3bb6b1cc0b10765188829530c05d622a6ecea3473e04d4109484e83c89a

C:\Users\Admin\AppData\Local\Temp\2972947f-bb71-48f1-94f0-a42476201b31.vbs

MD5 76fba432569d1dd56046b514c974fafe
SHA1 2f098695dcc0c8ca44de9f7108ed035f3b50b49a
SHA256 df6fc1f5415cceff0e01223cbf18a50e6e141cb884a4be09bc1bcbfafb116600
SHA512 37439403e8c0acda0e6d9b95d6682a08e9b9db7a22daff258c87f648d7b98f62bc63cd024201b6a4ec9cbbc79e5b0a1be6993bbc75c810722b5fac5439860a1f

C:\Users\Admin\AppData\Local\Temp\f9bab671-577e-4cba-be8a-9d1d3aef479e.vbs

MD5 0e79f94fa2ff71baa6eac8b75051bf1e
SHA1 4736882d752711281307e11654ce88a88e017137
SHA256 4e246c9f131fb338e0ac8ed4cee908869f661a4729d0e6e4e2a782066edfbd79
SHA512 56ec1961ec8f698a15cb397be6075af309c0b06444874e2923145ab35673501b185a250876c71fb4a1d5dd9bf0ca0e7452bd514ab6d27efaa2fa060ccfead588

C:\Users\Admin\AppData\Local\Temp\2a2bf8b6-bf31-4e0f-b147-75e84c7d3510.vbs

MD5 80f4d196671dd067260d2262e6cede50
SHA1 b819c0b2faed32b04c3a75d7c459e4a7a3db5bc1
SHA256 d256a889e51a304d5bd3c504391ee6a59659b41f3fe2b8f9973ffd8310ba49df
SHA512 a82f6f66c7705a75701bf2ffa63cf7d653c5e61bf4913139ee45a0c9f361a4334a9d9c063288429410cc2afea0402729e9aca32d16df37bb9d42e34c18a38101