dcrat | ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59e

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
Size

1.1MB
MD5

bf13fac7f8484064e0b61d4930e82580
SHA1

08495d92383b65f214c87a4aaed1103fe4cc7330
SHA256

ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59e
SHA512

cfba119bdbe539b7c64a5a9bf2581b21d6fa120154745f54bc36c1aac3ddfa555d4d01dd43c0626c2d95cd5eb0005c1c03387c853a18e8ef3d4d1c9d472ada87
SSDEEP

24576:ZxU376C0skFgqIyXFnbCDQgZ8e7FRsWC9ZRHInh4j1Cf6liXwkOmpd:EPkVXFGDQoP7FRCZRonh4hfewhmpd

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	4184	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	4184	schtasks.exe	90

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3940-12-0x0000000000400000-0x000000000052E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3792	powershell.exe
1420	powershell.exe
1616	powershell.exe
748	powershell.exe
3828	powershell.exe
4576	powershell.exe
2032	powershell.exe
1584	powershell.exe
4496	powershell.exe
2240	powershell.exe
4388	powershell.exe
4700	powershell.exe
2040	powershell.exe
2444	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 9 IoCs

pid	Process
2532	dllhost.exe
5940	dllhost.exe
5948	dllhost.exe
5960	dllhost.exe
5508	dllhost.exe
5552	dllhost.exe
5744	dllhost.exe
2572	dllhost.exe
4948	dllhost.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4204 set thread context of 3940	4204	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	99
PID 2532 set thread context of 5960	2532	dllhost.exe	173
PID 5508 set thread context of 5552	5508	dllhost.exe	180
PID 5744 set thread context of 2572	5744	dllhost.exe	187

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\cc11b995f2a76d	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\29c1c3cc0f7685	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX85C.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCXD04.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\9e8d7a4ca61bd9	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\SearchApp.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCXF2AF.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCXF2B0.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RuntimeBroker.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\services.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCXFB52.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCXFBC0.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX8CA.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\services.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCXD05.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RuntimeBroker.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\38384e6a620884	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\c5b4cb5e9653cc	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\RCXF93D.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\RCXF93E.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\SearchApp.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Panther\sihost.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Windows\Panther\sihost.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Windows\ShellComponents\RuntimeBroker.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Windows\Panther\66fc9ff0ee96c2	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Windows\ShellComponents\9e8d7a4ca61bd9	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Windows\ja-JP\RCX347.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Windows\ShellComponents\RCX5CA.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Windows\ShellComponents\RCX638.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Windows\ja-JP\e1ef82546f0b02	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Windows\Panther\RCXF4B5.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Windows\ja-JP\RCX348.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Windows\ja-JP\SppExtComObj.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Windows\ja-JP\SppExtComObj.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File created	C:\Windows\ShellComponents\RuntimeBroker.exe	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
File opened for modification	C:\Windows\Panther\RCXF4B4.tmp	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4484	schtasks.exe
732	schtasks.exe
4372	schtasks.exe
4332	schtasks.exe
1328	schtasks.exe
3500	schtasks.exe
4520	schtasks.exe
5000	schtasks.exe
4680	schtasks.exe
4708	schtasks.exe
752	schtasks.exe
540	schtasks.exe
3640	schtasks.exe
1832	schtasks.exe
2052	schtasks.exe
4388	schtasks.exe
4260	schtasks.exe
2688	schtasks.exe
4384	schtasks.exe
4876	schtasks.exe
3168	schtasks.exe
1780	schtasks.exe
4344	schtasks.exe
1068	schtasks.exe
1848	schtasks.exe
3620	schtasks.exe
3248	schtasks.exe
1392	schtasks.exe
4660	schtasks.exe
2680	schtasks.exe
4980	schtasks.exe
4700	schtasks.exe
2584	schtasks.exe
624	schtasks.exe
4044	schtasks.exe
2436	schtasks.exe
4772	schtasks.exe
3792	schtasks.exe
4652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
4700	powershell.exe
4700	powershell.exe
1616	powershell.exe
1616	powershell.exe
2032	powershell.exe
2032	powershell.exe
2040	powershell.exe
2040	powershell.exe
1420	powershell.exe
1420	powershell.exe
1584	powershell.exe
748	powershell.exe
1584	powershell.exe
748	powershell.exe
3792	powershell.exe
3792	powershell.exe
4388	powershell.exe
4388	powershell.exe
2444	powershell.exe
2444	powershell.exe
4496	powershell.exe
4496	powershell.exe
4576	powershell.exe
4576	powershell.exe
3828	powershell.exe
3828	powershell.exe
2240	powershell.exe
2240	powershell.exe
4700	powershell.exe
1616	powershell.exe
748	powershell.exe
2040	powershell.exe
2032	powershell.exe
1420	powershell.exe
4388	powershell.exe
4496	powershell.exe
4576	powershell.exe
1584	powershell.exe
3792	powershell.exe
3828	powershell.exe
2240	powershell.exe
2444	powershell.exe
2532	dllhost.exe
2532	dllhost.exe
2532	dllhost.exe
2532	dllhost.exe
5960	dllhost.exe
5552	dllhost.exe
2572	dllhost.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	2532	dllhost.exe
Token: SeDebugPrivilege	5960	dllhost.exe
Token: SeDebugPrivilege	5552	dllhost.exe
Token: SeDebugPrivilege	2572	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 3940	4204	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	99
PID 4204 wrote to memory of 3940	4204	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	99
PID 4204 wrote to memory of 3940	4204	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	99
PID 4204 wrote to memory of 3940	4204	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	99
PID 4204 wrote to memory of 3940	4204	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	99
PID 4204 wrote to memory of 3940	4204	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	99
PID 4204 wrote to memory of 3940	4204	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	99
PID 4204 wrote to memory of 3940	4204	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	99
PID 3940 wrote to memory of 2032	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	142
PID 3940 wrote to memory of 2032	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	142
PID 3940 wrote to memory of 2032	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	142
PID 3940 wrote to memory of 1616	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	143
PID 3940 wrote to memory of 1616	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	143
PID 3940 wrote to memory of 1616	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	143
PID 3940 wrote to memory of 2444	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	145
PID 3940 wrote to memory of 2444	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	145
PID 3940 wrote to memory of 2444	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	145
PID 3940 wrote to memory of 2040	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	146
PID 3940 wrote to memory of 2040	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	146
PID 3940 wrote to memory of 2040	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	146
PID 3940 wrote to memory of 4496	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	147
PID 3940 wrote to memory of 4496	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	147
PID 3940 wrote to memory of 4496	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	147
PID 3940 wrote to memory of 4576	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	149
PID 3940 wrote to memory of 4576	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	149
PID 3940 wrote to memory of 4576	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	149
PID 3940 wrote to memory of 4700	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	150
PID 3940 wrote to memory of 4700	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	150
PID 3940 wrote to memory of 4700	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	150
PID 3940 wrote to memory of 1420	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	151
PID 3940 wrote to memory of 1420	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	151
PID 3940 wrote to memory of 1420	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	151
PID 3940 wrote to memory of 3828	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	152
PID 3940 wrote to memory of 3828	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	152
PID 3940 wrote to memory of 3828	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	152
PID 3940 wrote to memory of 1584	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	153
PID 3940 wrote to memory of 1584	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	153
PID 3940 wrote to memory of 1584	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	153
PID 3940 wrote to memory of 4388	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	154
PID 3940 wrote to memory of 4388	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	154
PID 3940 wrote to memory of 4388	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	154
PID 3940 wrote to memory of 748	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	155
PID 3940 wrote to memory of 748	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	155
PID 3940 wrote to memory of 748	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	155
PID 3940 wrote to memory of 3792	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	156
PID 3940 wrote to memory of 3792	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	156
PID 3940 wrote to memory of 3792	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	156
PID 3940 wrote to memory of 2240	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	157
PID 3940 wrote to memory of 2240	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	157
PID 3940 wrote to memory of 2240	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	157
PID 3940 wrote to memory of 2532	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	170
PID 3940 wrote to memory of 2532	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	170
PID 3940 wrote to memory of 2532	3940	ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe	170
PID 2532 wrote to memory of 5940	2532	dllhost.exe	171
PID 2532 wrote to memory of 5940	2532	dllhost.exe	171
PID 2532 wrote to memory of 5940	2532	dllhost.exe	171
PID 2532 wrote to memory of 5948	2532	dllhost.exe	172
PID 2532 wrote to memory of 5948	2532	dllhost.exe	172
PID 2532 wrote to memory of 5948	2532	dllhost.exe	172
PID 2532 wrote to memory of 5960	2532	dllhost.exe	173
PID 2532 wrote to memory of 5960	2532	dllhost.exe	173
PID 2532 wrote to memory of 5960	2532	dllhost.exe	173
PID 2532 wrote to memory of 5960	2532	dllhost.exe	173
PID 2532 wrote to memory of 5960	2532	dllhost.exe	173

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
"C:\Users\Admin\AppData\Local\Temp\ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\sihost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\host\fxr\7.0.16\SearchApp.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\services.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\dllhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\unsecapp.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1420
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\SppExtComObj.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellComponents\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1584
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3792
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\StartMenuExperienceHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- - C:\Users\All Users\Adobe\dllhost.exe
    "C:\Users\All Users\Adobe\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Users\All Users\Adobe\dllhost.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:5940
  - - C:\Users\All Users\Adobe\dllhost.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:5948
  - - C:\Users\All Users\Adobe\dllhost.exe
      "{path}"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5960
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04162043-84c5-43d0-8278-1b445425c6e7.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
      - C:\Users\All Users\Adobe\dllhost.exe
        
        "C:\Users\All Users\Adobe\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5508
        
        C:\Users\All Users\Adobe\dllhost.exe
        
        "{path}"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5552
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1ea5200-5d1a-436d-8dce-f55c7006e6dd.vbs"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:64
        
        C:\Users\All Users\Adobe\dllhost.exe
        
        "C:\Users\All Users\Adobe\dllhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Users\All Users\Adobe\dllhost.exe
        
        "{path}"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0998a2f6-23a9-418d-b120-1dc36df7acfe.vbs"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1392
        
        C:\Users\All Users\Adobe\dllhost.exe
        
        "C:\Users\All Users\Adobe\dllhost.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4948
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04879219-97db-466a-8cf0-e79c758eedab.vbs"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\edf66433-91a2-481e-9d2e-10351ca49c67.vbs"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd1b0fb7-6853-4607-9e64-15f9e742301a.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Panther\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Adobe\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Windows\ja-JP\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\ja-JP\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\ja-JP\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ShellComponents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellComponents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default\Downloads\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Downloads\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe

Filesize
1.1MB

MD5
cc650ec67105ee376ded23817a5da533

SHA1
4caa3008cff5d9f94f11ad16230c38e1b33df0d2

SHA256
481b043dbfde8603b97b33fe3fae5d31d0eb10317842d7a6807a03930afbe4aa

SHA512
46c4884d60ec28fc2dee3c3d18a456017ed5c05a959c95a287f0a824a32430fe47691e07cf4fa923cce669415ab9dc71f56ed925ec85ea5fd3c766225a4e73ae

Download Submit
C:\Program Files\Reference Assemblies\Microsoft\services.exe

Filesize
1.1MB

MD5
bf13fac7f8484064e0b61d4930e82580

SHA1
08495d92383b65f214c87a4aaed1103fe4cc7330

SHA256
ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59e

SHA512
cfba119bdbe539b7c64a5a9bf2581b21d6fa120154745f54bc36c1aac3ddfa555d4d01dd43c0626c2d95cd5eb0005c1c03387c853a18e8ef3d4d1c9d472ada87

Download Submit
C:\Program Files\Reference Assemblies\Microsoft\services.exe

Filesize
1.1MB

MD5
6acdd94648e790256b3aaafd141a64e1

SHA1
b2b13a3e1190e4cbcb9d7fc8c486bbd9fbd64b92

SHA256
4d43a3fc6b369711b031f821dc4cc236886966702ce992e9100894892d32edf8

SHA512
caf7de04bac87ab58b8115855e99902822ee0efe3dd0b8883f53b5ef3ac8f056bcbf688d08f83dab6816e05666cf34c80b1321629ee422eb605b768e43720a75

Download Submit
C:\ProgramData\Adobe\dllhost.exe

Filesize
1.1MB

MD5
73162ebb055188ef4d631e2f0fb1cb0d

SHA1
a0dea015fc72f8cce98fe5b1d0a62c1b40e646e3

SHA256
fa2c6ca9084bdde9489a837a57cf28daef0c658286a4f9c62183d6402b60c8cc

SHA512
95487ebf45447a1af0c5317b3ca9d478d976a8e169147fcd200aba85a8e1025fdfb0d61603e116ed3fe077768c0210dc93988a4658066c26263977591be79d49

Download Submit
C:\Recovery\WindowsRE\explorer.exe

Filesize
1.1MB

MD5
03b081f378b77a91610db30d3c9fe11f

SHA1
34cc2a2361e14e3dc24736e3b70221c98847bf0c

SHA256
3ce285a4a7e0ab4e825b9fdbbf2d40decc70080461f58bdda1aa054c435ad3d2

SHA512
c0f0500d782fca71dc61b958e08f666619519673216951866bd5dce49b41c7ec841696b825e04fab91a793da31fcc842a823ae11df666c80df7a462bc33d31fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ce76b43210ba07925ad47c4c9953044670a94e638eafff7e1d172891b51ea59eN.exe.log

Filesize
1KB

MD5
84e77a587d94307c0ac1357eb4d3d46f

SHA1
83cc900f9401f43d181207d64c5adba7a85edc1e

SHA256
e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

SHA512
aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
942c91700e31c23e71b375d27eb3ed99

SHA1
7ea71517f9660a4a626712d723e0a3011bdc1f40

SHA256
011d13d38350db4d25541387c213b185004d057fe13e18b86f6df0563ba8d1c8

SHA512
911896cb83734c5bb95d652282a9d1e1c8cd8401813fbf2f59dc46feef0b83e2f06ccf83dba9632e3988e92ab142c88ccfd82df1319254a08b958b1fd306ae8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
19d07686f000b9d405a985bb22b43fea

SHA1
e4420210998f13230a1336c0196a4b785fbe056b

SHA256
9af84c2bbc3c842ecade29f10e66f957ac545d823e2d15729a71aa4df4657461

SHA512
bf002ae787878df7f6c5147ecdc7b058c8fd24b950fd71a1f6c4e76e7217940a4ac171fab4a201e111050f124744d2b000f59b7182c54868142b03c6d725a27e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
30b033e66f9b7bd2390d872a9c97879e

SHA1
e3d855c9c4b5c9b3742a03b2dfb38b440306e847

SHA256
0829670da4fe4df22afb82ded63e5d5a602e3ad9bf9963c7ed215092836fb68a

SHA512
c347b20b688bd3dc70b32833e80b65be31e65775e5df940bbe561aa30e8dba54abf684a3160dcc363ef8de2f6c04b8e3778ee61f0e825cdacbae7bf873e9ff33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
db7b52446a77ecd8fd124fc9c4df74d4

SHA1
a0ae1eb5dc1e612b1a2d5f27b7fe2d2aba957ac8

SHA256
69293a730009a8503d6acf9676be12cc1ad6d4afe7deca642818ee7da6333dad

SHA512
8f1db8d7917af3ad8b88db7efbc7a9522a0f280344f65fbf7179fde0ee975d77b6d294c1d262e4c5c644dc3566ef793a0d742f2416c81a05ba9a61d494e78565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
a31d5d8c16b101fed904d78718fbe66e

SHA1
35b50386de9c46b843c72bb4adc9cb0e801fc2e0

SHA256
3991d7fecbf955bdb634fa7692a356a6364b615f0403bd28f452e6123a5c851b

SHA512
1c03833c425f9fa7f5b6e3478e45e4ab6e7734965d871844914254d143fa8c4e582a4ca6b6316f62a4ec09b9ec4928b13678832f32419295ddf461df8830009b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
ddd6d930aa5e9175f1522a39f2b67c50

SHA1
e9caad635df197fed1aefcc7db39194eab52114a

SHA256
a3057fe8b0bac9edd4cf09c01dac53e0636b667f8fdf180f7e0c49d64712af74

SHA512
d8d7a165be1a466d2384995f65c1c71e73c13c9ed9ecfe6816e19a409082d7d9d530f679141d634857f715c49ebcf26669adb45138034fd0a4f3e34b09a0acf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
f0b9cede1be6012cac5d732f317ed841

SHA1
944f69443e55d1ba62f037a1d0dae746bc327235

SHA256
a35741adc6c3ed60e1835f79100fb0dfad09c4da8a9e3a9e8ba210a38614731e

SHA512
7a0086f89df20642cfb4bbefdc2a8be2a9f3e75dcbc2317d020897427324bcf6e761ea46fc26242e9d5897400feae0ae3dc1773f9126e9a389662dfed8cdf2ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
fc087fd910430bc86f5b5f9fc6f9ac7b

SHA1
08a0caa144911dbcf8ecff648f3139e28008266d

SHA256
0fce9a5921c651d1c8d4ef8d8491a97606655f8d52602db0ad680b8246a5f855

SHA512
bc14d123fc67553f6810e2aaaf9440bf6e5195183e3509e66f70d3995af74baa9b6528711c76ae02cc398560946e509bc18f52c7a415d76c5201f26ff25240c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
6dd3c51b5b43e141d91dc9e8822cbf7f

SHA1
55cae4be7ea0b9bf056d10be49e70b81cf18fe66

SHA256
d56a73019c1f99a4319be29ac6ce7a41b5399e6db8604f12991ffa810ea597dc

SHA512
818109a734b6df2b2241e07cdf80fa88935d01f309a17eb346cda2185acbb5a98961124d20a0d5106224113e3fea7457dd51f947d16526c63f019dade92b1335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
9cdefdb081dad48057da927517d3d7bb

SHA1
e8d87e5ba1ccbd9dd6a43eb9a93b04f3740a2c50

SHA256
af120c5776507fb46e8d99bd8460671739e2d8ec815c2c250083b2b0d8a2cab0

SHA512
a0eb2ae236c72ade016451a07f896caf4ba12c320418e1af2804aec2f83fb15680040db677a36e6d84b6ea383337070fbabb381732f6a740f3a2760e09c1b3be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b1c4e5ae3f33dd81f41909eab0c761bc

SHA1
e84d3cd369c6a74f5d91a6acfde598ad33e6633d

SHA256
6f2893457e72105b7ddf52a0763594254da4ae59b470dee5347553e75dac75f6

SHA512
36cb1f292ae8ef4c01b92789c8e99f4f0466ebdc99e215626db493261a20e1595e7d1b75e8f44921a4c0c62b3d216dc625923d5181cdb78eb8a14e84f9388ccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\04162043-84c5-43d0-8278-1b445425c6e7.vbs

Filesize
712B

MD5
9a7dff9b9b854adf24dc943f1ecefa4f

SHA1
245bf4fa322f73100a8faf10059ad8911ef32db0

SHA256
471a0a01c65e434b900236646f71b350e8c5e78a598dcb0510b209f655147666

SHA512
a6732427d5aea66fe700b432d23bb45b8dec53cba49d87b065a086f2f42d2b61944ce9ea0d92e69eb0515a55fb5bc66eef4eb081a5349b940e835f0b1b282e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\0998a2f6-23a9-418d-b120-1dc36df7acfe.vbs

Filesize
712B

MD5
01515f4fb2bd5f7bbdb587356b6023c2

SHA1
3568c3175bd3ddc9a01646a5af280fd996900c27

SHA256
4ae39edaf7922602ae3031b2884a9a260e38128dcabf392eb313c3b211f8fdd3

SHA512
c1003348e804f6fe79c2804ad8f0658a860743ca76cc153533ce366181be459d3942a8600773ff9d412093f2e6d46f1efb0c3f3a58a7e547ecddc5e6ba91252c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b1uwp4sr.bpg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1ea5200-5d1a-436d-8dce-f55c7006e6dd.vbs

Filesize
712B

MD5
c6f9457ccc575ec45d38b9946210f327

SHA1
372dec9a839c82bc27991a25265040f20aee9085

SHA256
346c0cecb589671bcb5b2d43c4b132925760786985e2bb2c1a4f6c53e32f455e

SHA512
87cb2f25760e0d2756e1937c61a4ce1aa4612345262349db79704dae1131be90df0ead82ad9be5ebc46631dcf348c7636b76f4831becd6c4e437827bcd44a0d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd1b0fb7-6853-4607-9e64-15f9e742301a.vbs

Filesize
488B

MD5
8e735bfca0bed491e3a50c8f1f344d54

SHA1
393ba7e4cc914322b16856be9c23d680fdd25030

SHA256
84b1d426c5d0a908d755ed65609b68f01cc1ecc62c3b2dd389948cfa45d85a9d

SHA512
040640d189b517db86b79225b51cafb418b4719d930205b621d064ff8fab58d61e2d2ca7a25df7caefa90a622eaf945a564f8cc8b303fe71fa03f2d2522690bf

Download Submit
C:\Windows\ShellComponents\RuntimeBroker.exe

Filesize
1.1MB

MD5
f540fabb3d1a6faf7e8929646f4e94bb

SHA1
9640dfeb69198ed5b1428d767c0641a96e890203

SHA256
5dd076e53e75415ba9ab1a2594c8e609fa4b1fc28544fa831f9f9b91e92f363d

SHA512
87aebcc2bf7c9242b6816080815e2be4b40368216f8a25c78d105161c02b92ac6387b6e0122229c1e36d138ffd01bdea5f0c5ca3c95ba7c029bbd8b785a53285

Download Submit
memory/748-429-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/1420-449-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/1584-481-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/1616-399-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/2032-439-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/2032-217-0x0000000005290000-0x00000000052C6000-memory.dmp

Filesize
216KB

Download
memory/2032-236-0x0000000005960000-0x0000000005F88000-memory.dmp

Filesize
6.2MB

Download
memory/2040-409-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/2240-491-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/2444-523-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/2532-378-0x0000000000040000-0x000000000016C000-memory.dmp

Filesize
1.2MB

Download
memory/3792-512-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/3828-461-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/3940-377-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/3940-24-0x0000000006270000-0x000000000627C000-memory.dmp

Filesize
48KB

Download
memory/3940-197-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/3940-20-0x0000000005400000-0x0000000005416000-memory.dmp

Filesize
88KB

Download
memory/3940-21-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/3940-18-0x0000000006180000-0x00000000061D0000-memory.dmp

Filesize
320KB

Download
memory/3940-32-0x0000000006C80000-0x0000000006CE6000-memory.dmp

Filesize
408KB

Download
memory/3940-26-0x00000000062A0000-0x00000000062AE000-memory.dmp

Filesize
56KB

Download
memory/3940-17-0x00000000053B0000-0x00000000053CC000-memory.dmp

Filesize
112KB

Download
memory/3940-27-0x00000000062C0000-0x00000000062CC000-memory.dmp

Filesize
48KB

Download
memory/3940-22-0x00000000061E0000-0x00000000061F2000-memory.dmp

Filesize
72KB

Download
memory/3940-209-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/3940-16-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/3940-23-0x0000000009640000-0x0000000009B6C000-memory.dmp

Filesize
5.2MB

Download
memory/3940-19-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download
memory/3940-25-0x0000000006280000-0x000000000628A000-memory.dmp

Filesize
40KB

Download
memory/3940-28-0x00000000062F0000-0x00000000062FA000-memory.dmp

Filesize
40KB

Download
memory/3940-29-0x0000000006310000-0x000000000631C000-memory.dmp

Filesize
48KB

Download
memory/3940-12-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/3940-14-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/4204-7-0x0000000005150000-0x0000000005162000-memory.dmp

Filesize
72KB

Download
memory/4204-0-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/4204-10-0x00000000073A0000-0x0000000007496000-memory.dmp

Filesize
984KB

Download
memory/4204-9-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/4204-1-0x0000000000290000-0x00000000003BC000-memory.dmp

Filesize
1.2MB

Download
memory/4204-8-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/4204-11-0x0000000009970000-0x0000000009A9E000-memory.dmp

Filesize
1.2MB

Download
memory/4204-5-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/4204-15-0x0000000074680000-0x0000000074E30000-memory.dmp

Filesize
7.7MB

Download
memory/4204-4-0x0000000004FA0000-0x000000000503C000-memory.dmp

Filesize
624KB

Download
memory/4204-6-0x0000000005060000-0x000000000506A000-memory.dmp

Filesize
40KB

Download
memory/4204-3-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Filesize
584KB

Download
memory/4204-2-0x00000000053A0000-0x0000000005944000-memory.dmp

Filesize
5.6MB

Download
memory/4388-501-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/4496-419-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/4576-471-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/4700-511-0x0000000007C90000-0x0000000007CAA000-memory.dmp

Filesize
104KB

Download
memory/4700-522-0x0000000007C70000-0x0000000007C78000-memory.dmp

Filesize
32KB

Download
memory/4700-460-0x0000000007B90000-0x0000000007BA4000-memory.dmp

Filesize
80KB

Download
memory/4700-459-0x0000000007B80000-0x0000000007B8E000-memory.dmp

Filesize
56KB

Download
memory/4700-398-0x0000000007B50000-0x0000000007B61000-memory.dmp

Filesize
68KB

Download
memory/4700-397-0x0000000007BD0000-0x0000000007C66000-memory.dmp

Filesize
600KB

Download
memory/4700-396-0x00000000079C0000-0x00000000079CA000-memory.dmp

Filesize
40KB

Download
memory/4700-395-0x0000000007950000-0x000000000796A000-memory.dmp

Filesize
104KB

Download
memory/4700-394-0x0000000007FA0000-0x000000000861A000-memory.dmp

Filesize
6.5MB

Download
memory/4700-392-0x0000000006C10000-0x0000000006C2E000-memory.dmp

Filesize
120KB

Download
memory/4700-393-0x0000000007830000-0x00000000078D3000-memory.dmp

Filesize
652KB

Download
memory/4700-381-0x00000000075F0000-0x0000000007622000-memory.dmp

Filesize
200KB

Download
memory/4700-382-0x0000000070440000-0x000000007048C000-memory.dmp

Filesize
304KB

Download
memory/4700-379-0x0000000006520000-0x000000000653E000-memory.dmp

Filesize
120KB

Download
memory/4700-380-0x0000000006B70000-0x0000000006BBC000-memory.dmp

Filesize
304KB

Download
memory/4700-248-0x0000000006170000-0x00000000064C4000-memory.dmp

Filesize
3.3MB

Download
memory/4700-247-0x0000000006090000-0x00000000060F6000-memory.dmp

Filesize
408KB

Download
memory/4700-246-0x0000000005FF0000-0x0000000006012000-memory.dmp

Filesize
136KB

Download
memory/4948-604-0x0000000005C60000-0x0000000005C72000-memory.dmp

Filesize
72KB

Download