dcrat | e3b4620b85709a793de2b777da764d094f9a6dc19ead0a7fcad953c1fb3e8550

Analysis

max time kernel
1438s
max time network
1424s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2024 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XBinderOutput(1).exe
Size

607KB
MD5

19d31479381cfda2c9878b427f51a0c2
SHA1

5b8774c60b71dd32e7325d0fbceb3434975ca7cc
SHA256

e3b4620b85709a793de2b777da764d094f9a6dc19ead0a7fcad953c1fb3e8550
SHA512

14ce10c974af40f5ab3e93f3bb3ff5ada22a8c2245bf45f40be0a59a75bcd9bfb2bf2288416744a2cebb93b3eb487ba070670d553ea87ca8c0e566c727bf28a2
SSDEEP

12288:DikJ/Wmo/J594F3o472LiJgSifSdq/UByol53uFb/V4YUWpcZm83:TJ/+z4F3osuiKoqsyol54bWYUK

Score

10^/10

dcrat credential_access defense_evasion discovery infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	fontdrvhost.exe

Process spawned unexpected child process 61 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	4052	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4712	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	4712	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	4712	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	4712	schtasks.exe	199

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000f000000023b20-7.dat	dcrat
behavioral2/files/0x0007000000023c69-22.dat	dcrat
behavioral2/memory/392-25-0x0000000000740000-0x0000000000816000-memory.dmp	dcrat

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\appid.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\scfilter.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\fvevol.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\bam.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\umpass.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\usbprint.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pacer.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\cnghwassist.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\hidir.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\ksecdd.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\nwifi.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\srvnet.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ndisuio.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\hvcrash.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\nsiproxy.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\msiscsi.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\rasacd.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\storvsc.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\tunnel.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\CEA.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\null.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\storahci.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\volmgr.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\EhStorTcgDrv.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\dxgmms1.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\WppRecorder.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\CAD.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\parport.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\wudfpf.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\hidscanner.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\mssmbios.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\volume.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\bthport.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\scsiport.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\sdstor.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\msgpiowin32.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\UcmCx.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mouclass.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\kbdhid.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\rfxvmt.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\SpbCx.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\wfplwfs.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\netbios.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\pcmcia.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\smbdirect.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\IndirectKmd.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\intelpep.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\msfs.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\dfsc.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\HdAudio.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\UsbccidDriver.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\errdev.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\gpuenergydrv.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\partmgr.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\buttonconverter.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\WUDFRd.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\xboxgip.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mountmgr.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\rassstp.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\vmgid.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\en-US\rdpdr.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\atapi.sys	fontdrvhost.exe
File opened for modification	C:\Windows\System32\drivers\bridge.sys	fontdrvhost.exe

Manipulates Digital Signatures 4 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\wintrust.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll	fontdrvhost.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File opened for modification	C:\Windows\System32\spool\prtprocs\x64\winprint.dll	fontdrvhost.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	kendalcp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	reviewDll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	XBinderOutput(1).exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
4984	fontdrvhost.exe

Executes dropped EXE 3 IoCs

pid	Process
4916	kendalcp.exe
392	reviewDll.exe
4984	fontdrvhost.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Security.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBClient%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Security.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Application.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Driver Watchdog.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Key Management Service.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Internet Explorer.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Audit.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\OAlerts.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Diagnostic.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx	fontdrvhost.exe

Loads dropped DLL 4 IoCs

pid	Process
3504	Process not Found
3504	Process not Found
3504	Process not Found
3504	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.19041.1_none_4b0e6b545bf0f4e7\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.19041.1_none_36436b821c9e7209\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.19041.1_none_b2014b56ea660ec9\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.19041.1_none_a208296858c76413\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-publiclibraries_31bf3856ad364e35_10.0.19041.1_none_cbd9ad4986c925d5\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonprograms_31bf3856ad364e35_10.0.19041.1_none_047fa97bc9873117\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.19041.1_none_a81a33274fb1b624\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.19041.1_none_0b090bb5ae01dd1a\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-programfiles_31bf3856ad364e35_10.0.19041.1_none_cb8c8caad1a2ad44\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.19041.1_none_2108f0881e5a7a03\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.19041.1_none_3870d3554f39ac78\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.19041.1_none_d9f53b39b3834744\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.19041.1_none_39d6d106c6f70bec\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.19041.1_none_905c6a851ca62951\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme2_31bf3856ad364e35_10.0.19041.1_none_8ccaf9c8444b9274\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.1_none_5476a60692fad199\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.19041.1_none_923716ddadd939c8\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.19041.1_none_be359f0533764571\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme1_31bf3856ad364e35_10.0.19041.1_none_8ccb1090444b78d3\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_10.0.19041.1_none_345e4e1d2701732b\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.19041.1_none_04c252e5678f305a\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.423_none_7c917c97525f1487\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.19041.1_none_148b41803c849a3c\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.19041.1_none_2f07a4cad3dec315\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.19041.1_none_f6eee8789c1c6fdd\desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.19041.1_none_19358785a81a86d6\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-maintenanceuser_31bf3856ad364e35_10.0.19041.1_none_bbf8ad8ff53c9b5b\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.19041.1_none_d69cbb4282e4fe2c\Desktop.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.19041.1_none_0cf1a65e91dfb2be\desktop.ini	fontdrvhost.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_10.0.19041.1_none_3802d0d85b60df4c\autorun.inf	fontdrvhost.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	fontdrvhost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ja-jp\hdwwiz.exe.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\ja-jp\twinui.appcore.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\es-ES\RunAsHelper.strings.psd1	fontdrvhost.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\c_fsundelete.inf_loc	fontdrvhost.exe
File opened for modification	C:\Windows\System32\de-DE\microsoft-windows-storage-tiering-events.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\WinBioPlugIns\NUIVoiceWBSAdapters.dll	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\Dism.Types.ps1xml	fontdrvhost.exe
File opened for modification	C:\Windows\System32\winipcfile.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\fr-FR\socialapis.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\it-IT\iasacct.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\it-IT\windows.internal.shell.broker.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\ja-jp\Licenses\_Default\Professional\license.rtf	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\tapi3.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\msclmd.inf_loc	fontdrvhost.exe
File opened for modification	C:\Windows\System32\xwizard.exe	fontdrvhost.exe
File opened for modification	C:\Windows\System32\it-IT\lodctr.exe.mui	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\connect.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\dpnhupnp.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\es-ES\licensingdiag.exe.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\ialpssi_gpio.INF_loc	fontdrvhost.exe
File opened for modification	C:\Windows\System32\chartv.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\IME\SHARED\IMELM.DLL	fontdrvhost.exe
File opened for modification	C:\Windows\System32\jscript.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\SettingsHandlers_Mouse.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\de-DE\AppInstallerPrompt.Desktop.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\ja-jp\cmdkey.exe.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\ja-jp\DFDWiz.exe.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\uk-UA\dsprop.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\uk-UA\fsquirt.exe.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\DXP.dll	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\CoreMmRes.dll	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\SettingSync.dll	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\ivfsrc.ax.mui	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\en-US\qdvd.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\MSFT_NetEventNetworkAdapter.format.ps1xml	fontdrvhost.exe
File opened for modification	C:\Windows\System32\ja-jp\dot3mm.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\fr-FR\CBDHSvc.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\en-US\DevicePairingFolder.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\de-DE\certreq.exe.mui	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\msinfo32.exe	fontdrvhost.exe
File opened for modification	C:\Windows\System32\ar-SA\WWAHost.exe.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\mwlu97w8x64.inf_loc	fontdrvhost.exe
File opened for modification	C:\Windows\System32\en-US\cryptuiwizard.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\en-US\icsvc.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\es-ES\mimofcodec.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\setup\tssysprep.dll	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\dsrole.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\KBDAZEL.DLL	fontdrvhost.exe
File opened for modification	C:\Windows\System32\fr-FR\SettingsHandlers_OneCore_PowerAndSleep.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\ja-jp\msaudite.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\it-IT\MSFT_ScriptResourceStrings.psd1	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\KBDINGUJ.DLL	fontdrvhost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\acxhdaudiop.inf_amd64_78faaf2062860ce8\acxhdaudiop.inf	fontdrvhost.exe
File opened for modification	C:\Windows\System32\ETWESEProviderResources.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\TpmInit.exe	fontdrvhost.exe
File opened for modification	C:\Windows\System32\de-DE\drprov.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\chargearbitration.inf_amd64_a0097842bcc7e487\ChargeArbitration.inf	fontdrvhost.exe
File opened for modification	C:\Windows\System32\ja-jp\wsqmcons.exe.mui	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\msrle32.dll	fontdrvhost.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\PSModuleDiscoveryProvider.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\certprop.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\ntmarta.dll	fontdrvhost.exe
File opened for modification	C:\Windows\System32\es-ES\cofiredm.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\System32\es-ES\sberes.dll.mui	fontdrvhost.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	fontdrvhost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-100.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_SM.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\FeedbackThumbnail.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-150.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-16_altform-unplated.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-100.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100_contrast-white.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-100_contrast-white.png	fontdrvhost.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleSmallTile.scale-100.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosSmallTile.scale-200.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\SmallTile.scale-200_contrast-white.png	fontdrvhost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\tifffilt.dll	fontdrvhost.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msado27.tlb	fontdrvhost.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\wmpnscfg.exe.mui	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-64_altform-lightunplated.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7739_36x36x32.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png	fontdrvhost.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll	fontdrvhost.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1	fontdrvhost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsyml.ttf	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\SmallTile.scale-100.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-256_contrast-white.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlCone.png	fontdrvhost.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdadc.dll	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AdaptiveCards.Rendering.Uwp.dll	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-256_altform-lightunplated.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1851_24x24x32.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-100.png	fontdrvhost.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll	fontdrvhost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui	fontdrvhost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\StartMenuExperienceHost.exe	reviewDll.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-125.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\ThreeWayBlendPage.xbf	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-24.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-250.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxLargeTile.scale-100.png	fontdrvhost.exe
File created	C:\Program Files\Windows Multimedia Platform\088424020bedd6	reviewDll.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui	fontdrvhost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-white_scale-125.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7734_20x20x32.png	fontdrvhost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Pyramid.Medium.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ImagePlaceholderWhite.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-unplated_contrast-white.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg7.jpg	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_WideTile.scale-200.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\iheart-radio.scale-100.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png	fontdrvhost.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarWideTile.scale-400.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp3.scale-100.png	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\offlineStrings.js	fontdrvhost.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-100_contrast-white.png	fontdrvhost.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-i..l-keyboard-00010408_31bf3856ad364e35_10.0.19041.1_none_436c2819f4277cef.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\x86_microsoft-windows-d..providers.resources_31bf3856ad364e35_10.0.19041.1_en-us_cad5342c4f8bdd6f.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\servicing\InboxFodMetadataCache\metadata\Language.Basic~ro-ro~1.0.mum	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-k..container.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5096991808a8a617\microsoft-windows-kernel-processor-power-events.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-w..ctnow-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_ebd7cdb6ad4d0536\WindowsConnectNow.adml	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\648b238707856e4044a41fb6ba3dca3c04d4241f2c2e47ec53fdbd0b74bd8eaf.cat	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_system.runtime.serialization.xml_b03f5f7f11d50a3a_4.0.15805.0_none_a26895e970c47599\System.Runtime.Serialization.Xml.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\a4c169a82ef86510dcc0999ef65a68bffa7a8fa63eea2a1ace2b8dde4fa62810.cat	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-taskschedulerv2_31bf3856ad364e35_10.0.19041.1_none_d889b422abd631cf.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_netax88179_178a.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_a8afbb726a40cdf7.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-d..t-lookup-powershell_31bf3856ad364e35_10.0.19041.1_none_2b90387e98ff6682\DnsCmdlets.Format.ps1xml	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-devicecenter.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_bcadf0a3c72cbb87\DeviceCenter.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.1_none_996ba223b673811b\dsdbutil.exe	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\f\notepad.exe.mun	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-storageservice_31bf3856ad364e35_10.0.19041.207_none_8d7dd94cc8f502c3\StorageUsage.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$_media_calligraphy_7b7c7a996fa5cd3c.cdf-ms	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-r..ne-editor.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_985df6f65bf7b435.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-xbox-game...appxmain.resources_31bf3856ad364e35_10.0.19041.1_es-es_83c3855939e3c09b\resources.es-ES.pri	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_windows-staterepository_31bf3856ad364e35_10.0.19041.844_none_daa7a21027e8dc48\f\Windows.StateRepository.dll	fontdrvhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.CompilerServices.VisualC.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_xinputhid.inf_31bf3856ad364e35_10.0.19041.1_none_ef1748024b16737e\xinputhid.sys	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\messageThrottle.js	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-installers-onecore_31bf3856ad364e35_10.0.19041.1_none_a1ad7e1744c3f0bf\cmifw.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$_syswow64_migration_bdcfa47e8790e0c4.cdf-ms	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-sf-capi2_31bf3856ad364e35_10.0.19041.1_none_6ead3e0d52d674eb.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\smiengine.dll	fontdrvhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.RegularExpressions.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..st-common.resources_31bf3856ad364e35_10.0.19041.1_it-it_ad2d7d484526c9e3\NetPeerDistCim.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-r..t-v2-core.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_19e948cd39491881\winmsipc.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wininethelperclass_31bf3856ad364e35_10.0.19041.746_none_0329353d97fc76a1\r\winethc.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-msmq-installer_31bf3856ad364e35_10.0.19041.746_none_590aefff5f03d876\mqad.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wcn-config-registrar_31bf3856ad364e35_10.0.19041.746_none_0b15fe9d20b90b6a\wcncsvc.mof	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-30_altform-unplated.png	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-cryptowinrt-dll_31bf3856ad364e35_10.0.19041.746_none_350a7ac2ae852f14\f\CryptoWinRT.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$_boot_pcat_el-gr_da43f0fe296cebfd.cdf-ms	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\program_files_common_files_microsoft_shared_vgx_3c86fd9f0b3afd9b.cdf-ms	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_mgtdyn.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_41d51a79c884990a.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5b5a0fc040a75c4e.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\Microsoft.VisualBasic.Compatibility.resources.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_prnms011.inf_31bf3856ad364e35_10.0.19041.1_none_7aecd5910914aee5\Amd64\MSAppMon-manifest.ini	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..extension.resources_31bf3856ad364e35_10.0.19041.1_es-es_9ac8d9dfac7cecba\aadWamExtension.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..gement-ui.resources_31bf3856ad364e35_10.0.19041.1_es-es_dae15eaa6095ac21\wsecedit.dll.mui	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1_hr-hr_518d45e670368f11.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-n..tcapture-powershell_31bf3856ad364e35_10.0.19041.1_none_564dad239cbedf01\MSFT_NetEventPacketCaptureProvider.format.ps1xml	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-runtime-windows-media_31bf3856ad364e35_10.0.19041.1266_none_c683e9e9b80f663f\r\Windows.Media.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..ntmanifests-onecore_31bf3856ad364e35_10.0.19041.1_none_20fe015112848824\PerformanceCounterInfrastructureNonExecutable-Replacement.man	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-i..-shellcommon-broker_31bf3856ad364e35_10.0.19041.1_none_042bbdfdac0eb8e2.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-s..-csvlk-pack-license_31bf3856ad364e35_10.0.19041.1_none_c2f7145f0b942797\csvlk-pack-Volume-CSVLK-4-pl-rtm.xrm-ms	fontdrvhost.exe
File opened for modification	C:\Windows\PolicyDefinitions\StorageSense.admx	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-u..ry-client.resources_31bf3856ad364e35_10.0.19041.1_it-it_086c0f8cac01d281.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-p..minkernel.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_cc55d261a12052a9\perfhost.exe.mui	fontdrvhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.Debug.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\r\vmcompute.exe	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$_inf_smsvchost_4.0.0.0_0000_1bb3624f8498ff51.cdf-ms	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-authorizationmanagerui_31bf3856ad364e35_10.0.19041.1_none_d7cb04209f02ffb1.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-pcshell_31bf3856ad364e35_10.0.19041.1_none_ca8fc1d1562cc0bb\PeopleBarContainer.dll	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_stornvme.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_972dfc1d0a97f5cd\stornvme.inf_loc	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-i..oyment-languagepack_31bf3856ad364e35_11.0.19041.1_de-de_b7a88ed1e9c37f4a.manifest	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-0000042f_31bf3856ad364e35_10.0.19041.1_none_bf08ab1728da2535\KBDMAC.DLL	fontdrvhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Dynamic.dll	fontdrvhost.exe
File opened for modification	C:\Windows\Speech\Engines\Lexicon\de-DE\lsr1031.lxa	fontdrvhost.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppxBlockMap.xml	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-u..itefilter.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2644285870985bed\uwfrtl.sys.mui	fontdrvhost.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-ie-feeds-platform_31bf3856ad364e35_11.0.19041.1081_none_22d12e6b4d6a8f52\msfeeds.mof	fontdrvhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kendalcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	kendalcp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3588	schtasks.exe
3876	schtasks.exe
1280	schtasks.exe
852	schtasks.exe
860	schtasks.exe
1896	schtasks.exe
2756	schtasks.exe
1008	schtasks.exe
1224	schtasks.exe
3520	schtasks.exe
824	schtasks.exe
3516	schtasks.exe
2340	schtasks.exe
1340	schtasks.exe
3940	schtasks.exe
1536	schtasks.exe
4932	schtasks.exe
2896	schtasks.exe
4300	schtasks.exe
2432	schtasks.exe
4304	schtasks.exe
992	schtasks.exe
3292	schtasks.exe
676	schtasks.exe
3420	schtasks.exe
4488	schtasks.exe
2852	schtasks.exe
1044	schtasks.exe
1796	schtasks.exe
4744	schtasks.exe
4728	schtasks.exe
1604	schtasks.exe
1728	schtasks.exe
4964	schtasks.exe
5016	schtasks.exe
4600	schtasks.exe
3796	schtasks.exe
2676	schtasks.exe
4216	schtasks.exe
732	schtasks.exe
3200	schtasks.exe
1516	schtasks.exe
4900	schtasks.exe
932	schtasks.exe
4700	schtasks.exe
1936	schtasks.exe
3652	schtasks.exe
4712	schtasks.exe
4612	schtasks.exe
3332	schtasks.exe
4284	schtasks.exe
3356	schtasks.exe
4992	schtasks.exe
2800	schtasks.exe
3632	schtasks.exe
2272	schtasks.exe
2608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
392	reviewDll.exe
4984	fontdrvhost.exe
4984	fontdrvhost.exe
4984	fontdrvhost.exe
4984	fontdrvhost.exe
4984	fontdrvhost.exe
4984	fontdrvhost.exe
4984	fontdrvhost.exe
4984	fontdrvhost.exe
4984	fontdrvhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4984	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	392	reviewDll.exe
Token: SeDebugPrivilege	4984	fontdrvhost.exe
Token: SeManageVolumePrivilege	3452	svchost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 4916	2068	XBinderOutput(1).exe	88
PID 2068 wrote to memory of 4916	2068	XBinderOutput(1).exe	88
PID 2068 wrote to memory of 4916	2068	XBinderOutput(1).exe	88
PID 4916 wrote to memory of 1444	4916	kendalcp.exe	91
PID 4916 wrote to memory of 1444	4916	kendalcp.exe	91
PID 4916 wrote to memory of 1444	4916	kendalcp.exe	91
PID 1444 wrote to memory of 2960	1444	WScript.exe	101
PID 1444 wrote to memory of 2960	1444	WScript.exe	101
PID 1444 wrote to memory of 2960	1444	WScript.exe	101
PID 2960 wrote to memory of 392	2960	cmd.exe	103
PID 2960 wrote to memory of 392	2960	cmd.exe	103
PID 392 wrote to memory of 4984	392	reviewDll.exe	161
PID 392 wrote to memory of 4984	392	reviewDll.exe	161
PID 4984 wrote to memory of 3832	4984	fontdrvhost.exe	204
PID 4984 wrote to memory of 3832	4984	fontdrvhost.exe	204
PID 3832 wrote to memory of 2224	3832	cmd.exe	206
PID 3832 wrote to memory of 2224	3832	cmd.exe	206

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XBinderOutput(1).exe
"C:\Users\Admin\AppData\Local\Temp\XBinderOutput(1).exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\kendalcp.exe
  "C:\Users\Admin\AppData\Local\Temp\kendalcp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\blocksavesperfMonitorDll\reviewDll.exe
        
        "C:\blocksavesperfMonitorDll\reviewDll.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:392
      - C:\blocksavesperfMonitorDll\fontdrvhost.exe
        
        "C:\blocksavesperfMonitorDll\fontdrvhost.exe"
        6⤵
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Manipulates Digital Signatures
        Boot or Logon Autostart Execution: Print Processors
        Checks computer location settings
        Deletes itself
        Executes dropped EXE
        Indicator Removal: Clear Windows Event Logs
        Drops desktop.ini file(s)
        Drops autorun.inf file
        Drops file in System32 directory
        Modifies termsrv.dll
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\authman\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\authman\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\authman\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\blocksavesperfMonitorDll\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\blocksavesperfMonitorDll\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\blocksavesperfMonitorDll\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\blocksavesperfMonitorDll\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\blocksavesperfMonitorDll\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 8 /tr "'C:\blocksavesperfMonitorDll\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\blocksavesperfMonitorDll\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\blocksavesperfMonitorDll\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\blocksavesperfMonitorDll\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\SchCache\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\SchCache\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\SchCache\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\PrintHood\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\PrintHood\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
1⤵
PID:4012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:5016

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:1892

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
1⤵
PID:3284

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
1⤵
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "fontdrvhost" /f
1⤵
- Process spawned unexpected child process
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "fontdrvhostf" /f
1⤵
- Process spawned unexpected child process
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "fontdrvhost" /f
1⤵
- Process spawned unexpected child process
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "fontdrvhostf" /f
1⤵
- Process spawned unexpected child process
PID:4076

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:3604

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\5b884080fd4f94

Filesize
279B

MD5
17e8f07d4574e42685fbff68f05b3360

SHA1
af52b855b590f6319465d0eef4dad1787c751e80

SHA256
3b8ad2712b85dbf32979ca47252da0da24e0d87f38623e42f2e8d9c738ffd0bc

SHA512
eb5dfe811855ed9293f4519792c6f58ac53d8919b61fb5cac17bc90da6a307126d8adf3de58fad2c4df4d07d8a0d31a563f2e809a99fbaa4a667287eaaf2e4db

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\55b276f4edf653

Filesize
945B

MD5
bec8569f591b8d8b0628a716f54311eb

SHA1
4ebe22b85c903efdb62e60fb08d5256d527c0105

SHA256
5e27a565f484efe6c7e19f28f1a20e4c14d8ebf673cc6eafe15a6a94884406ac

SHA512
dde1957b61924c7629d760f90d1a47cbca153e6fb06bf8955c2c6ae776b6e6ef1a115c81632ba44d1a8902cbd961fddd4355e602cc712bc275016837e5a34da4

Download Submit
C:\Program Files (x86)\Windows Mail\c5b4cb5e9653cc

Filesize
317B

MD5
177ddf04c1fd17277eac2468935a6c1a

SHA1
6c1bbd5ef19290d73db99d304bded9d5dca44930

SHA256
eda46a120281667b651baf47f0ae6d4099231dee9f237ca10c63d4ad3729368a

SHA512
6f7cf11f9301cec29423cc2b3dc63c12bb080b49a7514d92d8114aa98279738471fab74ef2f61f7495c8dd035c4486766b0108a541a86303ffec9e0a7a057115

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\en-US\c5b4cb5e9653cc

Filesize
512B

MD5
574a98f0f0392ef35bcd75d7d9ff073e

SHA1
c46bdee3c1d421234608ca1b21a1879e2f0eddb4

SHA256
f5359352f91056ba5389199999801039df03a5078c01515701aa6e874158af34

SHA512
b3c1a8919aef08fc09a60958cabfe23afb72515b8a91f43cee416f86f6d752435a1c3ff6de9f3d82e7a6835fcfbef561bb58e03f4f18f70e61a404d23454e952

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\de-DE\22eafd247d37c3

Filesize
721B

MD5
c61a6a70279592ca8a97fc71fbaff08a

SHA1
70488af30099d0b102f8946dc59a3c32c5f27678

SHA256
1cf2afdf67f0fb0b4bcac3c40b6a49e2c3d91685f35b2112552473b1f38b6f01

SHA512
25050de528313f1e26e179ca472b3fce3de04de799d6e33737f1ae728eee59de1271fe02c2cc911de80486599cffcb98cfadbaa6ee335a129ab34e6a4ad974bb

Download Submit
C:\Program Files (x86)\Windows Portable Devices\ee2ad38f3d4382

Filesize
746B

MD5
816a25bef3d514be740af466993f84ab

SHA1
4080d998ea19ba1daaa7e24c5a311af467095e51

SHA256
bfbeb0f11a4457be96e420b870c0634dcc24d6c8482cd8affa854f3ba08a8c76

SHA512
d8585e4989d3bc44366062482f6b8759efba5d4bb9d972a31d671b4026d76cc9e953e5e040108500abfa5d9e8fc1d7f2cdfb8db83b93f8d3f9618c5c2a38c7d8

Download Submit
C:\Program Files\Google\Chrome\f3b6ecef712a24

Filesize
414B

MD5
da7280ff3f748d8be3eca088f546b1f8

SHA1
4303f7c2d75e162a2d8d78488607e54060c4b4d5

SHA256
fa1c234273013e99686da2cd2d8cf814edf1f6ef864d2faaa54864631474df08

SHA512
8fc5b71afb291d78dfc959d74beda5958ed616afec1c8009a19ba5a3f40de9d0dc68a9d689cfc4dc46215d2907cf669a47f3d918369fe2afae5c0d5f30d39c2b

Download Submit
C:\Program Files\Microsoft Office 15\ClientX64\ea9f0e6c9e2dcd

Filesize
581B

MD5
3dd2150e73886830cb74f97fefcccc42

SHA1
2318c56cdf7f0f4a5b09947324ed9e44c0727ed2

SHA256
98480b53cc1dfd5a9e15baa0105cf5686e80939d4fbb856e6cafae150906e818

SHA512
9a5dd78d8d2a7e18dc5619fd9d3f37fa458c971684655f54cf94d720ae5d5e1247b687c8288e26dbaa0f0843f7457e21751c6fb8a1758a3f362ee3596b491a7c

Download Submit
C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

Filesize
279KB

MD5
7efcf0111eb7a22aec8410d6a427b328

SHA1
d6828e7c4fb2789da55899e69c6197eaf4017b88

SHA256
7a83319f41c626818556e406b5b664aa4c102cb851269e9becbe3041bde4368a

SHA512
c1526e7bfe3c9f5d9ea9ab0f18d555e01f107ec56123ab83b8677ac24da57e206fb02a0148d2ae08ceba6ec4c10f42a46b0093e2324c0d723f09ec1fd4f43d97

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

Filesize
1.7MB

MD5
c606bd7c9c733dd27f74157c34e51742

SHA1
aab92689723449fbc3e123fb614dd536a74b74d4

SHA256
606390649012b31b5d83630f1186562e4b1ce4023d8870d8c29eb62e7e0769e0

SHA512
5f8fabe3d9753413d1aedcc76b9568c50dd25a5a6aeacd1ce88aecc28c0ba96dac80177679d380708213a0997946e49383bdaca7114c8c9526a24ed999194e38

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll

Filesize
613KB

MD5
c1b066f9e3e2f3a6785161a8c7e0346a

SHA1
8b3b943e79c40bc81fdac1e038a276d034bbe812

SHA256
99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

SHA512
36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll

Filesize
83KB

MD5
1453290db80241683288f33e6dd5e80e

SHA1
29fb9af50458df43ef40bfc8f0f516d0c0a106fd

SHA256
2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c

SHA512
4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91

Download Submit
C:\Program Files\Windows Multimedia Platform\088424020bedd6

Filesize
611B

MD5
0b9f77b417a0eab628b4bf5ca1197c1b

SHA1
d67b007c20018b658211f7c7d0cb8d39655bb473

SHA256
6ebea1dafbfaf1172422a8835b71cbc4cc6553550fd5d1d19630c5673a8423a9

SHA512
881b5b907b37c26f4892d0558c50eaafe20ba2956fb7fad5f95b628f0300e675d1a36b055715ea551b9ab12e07a865e80cc6d90bb1e071d5e85b9b2839edbc71

Download Submit
C:\Program Files\Windows Photo Viewer\es-ES\ea1d8f6d871115

Filesize
268B

MD5
25b2aa848f9fe20aab46634bc069aba3

SHA1
026ec0c9567ac59ff881ac342ef046ca6fb36ee8

SHA256
4f313c30125d5078153a6bdcadc90bd32636e39549769430b8d43392a7af6249

SHA512
438af989c5c4d29761c77285af56354fac657430fc0f0a2c1c700c7b8b216c64e77b955b04c3aa279e6593d46c76d64cec022b06b480c8cebb97082179c12365

Download Submit
C:\ProgramData\regid.1991-06.com.microsoft\121e5b5079f7c0

Filesize
841B

MD5
f90b9c796458f76a1a1db635c95676d4

SHA1
58ffeb3b3c9397907ecbdad4b81961eb386f6404

SHA256
4c387e1f3768f2f3a160cc127fd00a839d5ad1783984374c62fcefa8d7937bf9

SHA512
be3f178fe81811fa7efd301bd987b1a90e9e962b8203aad188f9887006bbb42a44002914a1f0c650dc39bc65efc41a13e05ffbe6c09d409076c108a8056b6a6b

Download Submit
C:\ProgramData\regid.1991-06.com.microsoft\5b884080fd4f94

Filesize
862B

MD5
00b9caa10b7e047d56bbf227f03132e7

SHA1
e8b78c82e64d53b40591b2eef1e77c1967bda7d2

SHA256
39f8d6fe63e658584041df5f99a405d7615afade413d174156b71a9b2ed2e5d9

SHA512
6ea746595b57722f0394b75a8016f09137b54bb12d67a4d5a4bacb32bf344907b9171909adfffbbbb046277d177eab239aea28b9ade9e224cd290b3de5ec3d26

Download Submit
C:\Recovery\WindowsRE\c82b8037eab33d

Filesize
316B

MD5
873a273df62b3cd53b809c84a34d47c6

SHA1
1d0f47e7663cb0ed3960678ce659d6372f7859fc

SHA256
f9d4ca07081daaed221f678b8f3445045219fe98420b8ac586fbd214f1f1876b

SHA512
a10103cb3ee1526d51b46a398bebb0a28c3e591fa161d3b11cbda1f59a2a5350c35d1e9fe0ffa3edc48f08dd4795d22b0837550a5c6a3c76680cbf74c9577f50

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jcp

Filesize
8KB

MD5
ad4407a0d4f76d7872969e3f57fedad3

SHA1
0902eff2590f9bc4dece99d21d47dbeaf569328c

SHA256
763b24328234b2126cb4e839994d2f518ab05ca8860e3742f065e8e723bb2e6b

SHA512
0902fb38b3b9a596b59515865784d27325dcadf3dc3f87b7453626e126c9d327825d783c36d822efbb6fe77a115b47c57e54da311566eefa136c42d1a6413479

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jtx

Filesize
3.0MB

MD5
7dd6bb452c8eabf3e8d5728a28eb4b82

SHA1
a51808eb883cfd203d461aecb5e3c6c654747c6b

SHA256
74a2aa07e69932f7ad78ec17b7b251d7f93aa76b9d32741912506f8f338724d5

SHA512
2664efb737533ef23d9bfefa3ee27c70942162ea730ade080760cd1bbfb4f1215bb1b95ec69fef903c4663db5c9c3d4baaedaa0416d13e84633390f11f748e47

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Filesize
3.0MB

MD5
d1dd210d6b1312cb342b56d02bd5e651

SHA1
1e5f8def40bb0cb0f7156b9c2bab9efb49cfb699

SHA256
bbd05cf6097ac9b1f89ea29d2542c1b7b67ee46848393895f5a9e43fa1f621e5

SHA512
37a33d86aa47380aa21b17b41dfc8d04f464de7e71820900397436d0916e91b353f184cefe0ad16ae7902f0128aae786d78f14b58beee0c46d583cf1bfd557b8

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
d393420dff425c49e000f24a5d685a71

SHA1
819cf0df436c1e4efcff66c84439ea598fdae045

SHA256
c0a8baaef95aaf72305eac162f5e1a6e4d4e6b6417411b62484820ff9dd38910

SHA512
755a784717a9bcc0f7154678237d3111f7befbe0faa40a40703acf61e29c59f32c38a64b79f91ad1e5e879b41dc7ce10692ed9242bf6a866dbddd6537e3e0e9c

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.vol

Filesize
6.0MB

MD5
4a14322dc9c3d3cdfd2da59670734a03

SHA1
49a0bbae079678ba24df02903229fc7118da906a

SHA256
252244087f38b9e416db9e3a6613b6ab451dfcaea017435fba1af16220634698

SHA512
0a0f5ede356bebe8f42e4c589adf5c140bbe50553bce4611da69d007b6f13fa5bac0f71a2e181f13101fdd941c4ccfb2f84f6443135839f3689956d7fc1c2060

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\tmp.edb

Filesize
192KB

MD5
ad3aa4183f24b8295a672f3436fd8b4c

SHA1
9308e0e87bfd053544169584c10a2f0661921dd1

SHA256
77ee4ba1173284d36bae4bbd254bb07974a506324670409e407f529c31033dc9

SHA512
273d1190eaee7fd9c7f48e60f723daab227ae8c3b40ba7b50f22a2f83c318ec0fb357003fbcd4cde75ec00473c5ffec38b04692aab0a64828f756d477f9c4d2a

Download Submit
C:\Users\Admin\AppData\Local\Comms\Unistore\data\AggregateCache.uca

Filesize
4B

MD5
f1d3ff8443297732862df21dc4e57262

SHA1
9069ca78e7450a285173431b3e52c5c25299e473

SHA256
df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119

SHA512
ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XBinderOutput(1).exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\reviewDll.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat

Filesize
271B

MD5
adeba13ac21cb9a7cbabf43482d6d6a6

SHA1
cbb3a36bce61e0d5ffa8cbca6574393ffabda0d6

SHA256
c5e0784dedac343e9952322654be9dab9d714232d8865848b3a18516dfa8d4c5

SHA512
b6fa1d21d5842ebe9d14108cacf4db3029e87e0af5e098b8fb8f275c60fbaca8590b48d06f95c7e404cefe63faff81fd2a9b8b451eb480af9e927ba74f3964b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\kendalcp.exe

Filesize
1.1MB

MD5
0d015cc111d53a019e680b0bed11fcad

SHA1
3b3fb6eeba0c2ba286a4db5e850697399ccb5e36

SHA256
2b7365d9634016b0483009225b959692c290a6b17fad133e42434dc89fdf4150

SHA512
c3a7ea551d0151033dde83a3dda1042e8fe26702c84da2b630ecffb739aecb654730bb5f7ec8914189f72ca7d0ecf1352f0ca7effa938bc1d6f0ae56c3358eab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\9e8d7a4ca61bd9

Filesize
871B

MD5
07db197f029c7a765f86c9ecd84b95ba

SHA1
382d75da2567a0cc4ccf059c3333df8faf05160f

SHA256
2c80a0be8061b7143a6239e697e04adfae0e2e44d914ff96d316434abf96d57a

SHA512
d354489d9b30bae25d6823d7081aa8f5476cdf0492c898a996d83a7e42226c2ec92576da3c19cf8a1f7f541cafd808abcdb1d3faeb46c84104c96ffd99ea300a

Download Submit
C:\Windows\Microsoft.NET\authman\c82b8037eab33d

Filesize
196B

MD5
7bcb76bc88341876c15b453c528e7c01

SHA1
9450b7d084746f6afc20cf0be0e97f4160599f66

SHA256
2d59bba32f53b3ac6363f042c252b3143e71123356753727ee3ff06e635f21d8

SHA512
0be59474950ae79c4e8c6ad32a0a2f6f30f7a79673d6162f86848f812797488b9cc688788923437079cf890ba65c641a62ed02274180eb5bb1bcf6c0bc8b4fdb

Download Submit
C:\Windows\SchCache\088424020bedd6

Filesize
491B

MD5
40866c14dcac96eb350e7c83bd1aeee3

SHA1
8b8f22977cbdf5d20dcd23fd3041ffea27f8678d

SHA256
9338038abdc6037be3bd45a642d6d87307f60fdd8b079e34b96680c2a9759a1c

SHA512
7308842d0d1e59b67dba805517e2325acdf6c1893f83132d41ef6d4cbdd159fb55740f8f73fdd5b405caa3b60a871d9a8779f8c3c3ea23046091de6e4383aa5f

Download Submit
C:\blocksavesperfMonitorDll\04c1e7795967e4

Filesize
339B

MD5
ec7d0bc582019dbba6a7f63bba44ec5f

SHA1
f3f81dbbcd70897ced59e2314817e1e755ab1c82

SHA256
ec86cd54cadcaa9f3aa79470a3d197a3f9a6287503be59c259a997ad7d500ac3

SHA512
c18f0005c4088e123e484cd3833fa3f6bb57533b80757a0c903009f150d5e72141ae71fb5ee6e9c088d9ae2ffaa8a18dcd72f6671d97e8c18b6fe995422d7102

Download Submit
C:\blocksavesperfMonitorDll\5b884080fd4f94

Filesize
896B

MD5
5872e9073f48891ccb1b0ac7bd651561

SHA1
302f26e1b3cb613fffb8b542f2be2da68577f771

SHA256
0ca12e07ce2ebfd5a3d398ae3488f0071b4f5211966158175c0e6a3c671f783e

SHA512
b259009fb89efe58d998fdd45d4195ff2229381d8d035e649b9ba5b06696c0c8707b5d18976850b8b47913af15bc4486c26b80f69666c5c0dc12ce26106975e1

Download Submit
C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe

Filesize
222B

MD5
a6f295a2e58c722b5935cc905e81fd8b

SHA1
a2a30408197320a639e3e2f18a57fc8578c97b58

SHA256
8bcebca170fc0768cb1afb63f1350d63c3a295b26ca04602e07ec43498b9691c

SHA512
839605d7eadcdc470dd4edd117cedd976cb9f36bf0a636d08afecc6378adadf0fccb80beb44de849b6dfec814845cef8ca83ca171b39c1f6d90d55485bd06635

Download Submit
C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat

Filesize
43B

MD5
7c582abd8874b9cc60df72d62bd86440

SHA1
564e7b01338d08f657f2c02fa8fc5b8dadb92331

SHA256
c5e95b783c6ec1b98a40edf8663370c678de43e9b657e09ca1f054618277b329

SHA512
444cf67666329ea359e221560a229990013af07d1ed074b2406e903c7ee04cf279953ad0726a96c2ca875216da68369dfdde00f905adf1de9ed93b8582bf8828

Download Submit
C:\blocksavesperfMonitorDll\eddb19405b7ce1

Filesize
452B

MD5
9464f40e95616df63c35f7ace5f535a2

SHA1
a3a433e23ee740138a2e6e2d85e42ff493cc3074

SHA256
09e91b59c4aeb04151e10f678a658660ab66e09acc5a951a152ea06a89843160

SHA512
b498f1d421851d61a2aeef227fe658971691af60e4b28aa4aead6720da2bb07c686784eb4c31e1434bb0047622c39fb4453ccaf825e1c40af843c4c6bdf8433c

Download Submit
C:\blocksavesperfMonitorDll\reviewDll.exe

Filesize
828KB

MD5
d9dac9e1d95e84e6aec084cf2ddb3f3a

SHA1
a231a41c7ad994879b15116dcea41fdc09bb5879

SHA256
0fbeb71fb1dfe793eace5ed167f035a8f4bcc6b56d0930b6b97481f2b222b1d5

SHA512
c4aa115de6f61c7311e8654d40537cd1ce08f0fb7efd0a225a42e06ad000ed420ba905e5cc26a19cb56af951ee1441aa257c073c47911a72fff733c0db1c2f9a

Download Submit
memory/392-25-0x0000000000740000-0x0000000000816000-memory.dmp

Filesize
856KB

Download
memory/2068-11-0x00007FF98BF20000-0x00007FF98C9E1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-1-0x0000000000D30000-0x0000000000DCE000-memory.dmp

Filesize
632KB

Download
memory/2068-0-0x00007FF98BF23000-0x00007FF98BF25000-memory.dmp

Filesize
8KB

Download
memory/2068-3-0x00007FF98BF20000-0x00007FF98C9E1000-memory.dmp

Filesize
10.8MB

Download
memory/3452-158-0x0000014F39DA0000-0x0000014F39DA1000-memory.dmp

Filesize
4KB

Download
memory/3452-160-0x0000014F39DA0000-0x0000014F39DA1000-memory.dmp

Filesize
4KB

Download
memory/3452-163-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-164-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-165-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-166-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-169-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-168-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-167-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-170-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-171-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-172-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-173-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-174-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-175-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-176-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-178-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-179-0x0000014F39DD0000-0x0000014F39DD1000-memory.dmp

Filesize
4KB

Download
memory/3452-177-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-181-0x0000014F39DE0000-0x0000014F39DE1000-memory.dmp

Filesize
4KB

Download
memory/3452-180-0x0000014F39DD0000-0x0000014F39DD1000-memory.dmp

Filesize
4KB

Download
memory/3452-183-0x0000014F3B630000-0x0000014F3B631000-memory.dmp

Filesize
4KB

Download
memory/3452-182-0x0000014F3B630000-0x0000014F3B631000-memory.dmp

Filesize
4KB

Download
memory/3452-162-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-161-0x0000014F39DC0000-0x0000014F39DC1000-memory.dmp

Filesize
4KB

Download
memory/3452-153-0x0000014F39C50000-0x0000014F39C51000-memory.dmp

Filesize
4KB

Download
memory/3452-155-0x0000014F39D90000-0x0000014F39D91000-memory.dmp

Filesize
4KB

Download
memory/3452-157-0x0000014F39D90000-0x0000014F39D91000-memory.dmp

Filesize
4KB

Download
memory/3452-159-0x0000014F39DA0000-0x0000014F39DA1000-memory.dmp

Filesize
4KB

Download
memory/3452-119-0x0000014F31950000-0x0000014F31960000-memory.dmp

Filesize
64KB

Download
memory/3452-134-0x0000014F31A40000-0x0000014F31A50000-memory.dmp

Filesize
64KB

Download