cede0b15d88c20bc750b516858f8bf31ee472f6cbd01640840890736c4333cce

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Holzer.exe
Size 135KB
Sample241113-pttklavqcr
SHA256 cede0b15d88c20bc750b516858f8bf31ee472f6cbd01640840890736c4333cce
MD5 c971c68b4e58ccc82802b21ae8488bc7
SHA1 7305f3a0a0a0d489e0bcf664353289f61556de77
SHA512 ff199691c35f2748772410bf454e8b76dd67d892dd76fc87d20b3bbe6c145c6af1685344de636326692df792f55d0fba9a0025a7cf491d0b4e73ff45c3b039d7
SSDEEP 3072:2EYGNIaWY/0kTKxIJXtJ0YCHiQtSetFITTTTTHvvvvvNKB:HN5TKvr9PuKB
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

bootkit defense_evasion discovery evasion persistence privilege_escalation

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Holzer.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Holzer.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6732	icacls.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2424	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Holzer.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
968	runas.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9012	1724	WerFault.exe	406

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AtBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auditpol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundTaskHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Holzer.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
888	PATHPING.EXE
3820	PING.EXE
8892	RpcPing.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3672	ipconfig.exe
7308	NETSTAT.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3820	PING.EXE

Runs regedit.exe 2 IoCs

pid	Process
8604	regedit.exe
8792	regedit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1748	Holzer.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: 33	1308	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1308	AUDIODG.EXE
Token: SeSystemtimePrivilege	1748	Holzer.exe
Token: SeSystemtimePrivilege	1748	Holzer.exe
Token: SeSystemtimePrivilege	1748	Holzer.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeCreatePagefilePrivilege	868	svchost.exe
Token: SeSecurityPrivilege	5012	auditpol.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1192	1748	Holzer.exe	118
PID 1748 wrote to memory of 1192	1748	Holzer.exe	118
PID 1748 wrote to memory of 1192	1748	Holzer.exe	118
PID 1748 wrote to memory of 3516	1748	Holzer.exe	119
PID 1748 wrote to memory of 3516	1748	Holzer.exe	119
PID 1748 wrote to memory of 3516	1748	Holzer.exe	119
PID 1748 wrote to memory of 2548	1748	Holzer.exe	122
PID 1748 wrote to memory of 2548	1748	Holzer.exe	122
PID 1748 wrote to memory of 2548	1748	Holzer.exe	122
PID 1748 wrote to memory of 4864	1748	Holzer.exe	125
PID 1748 wrote to memory of 4864	1748	Holzer.exe	125
PID 1748 wrote to memory of 4864	1748	Holzer.exe	125
PID 1748 wrote to memory of 5100	1748	Holzer.exe	127
PID 1748 wrote to memory of 5100	1748	Holzer.exe	127
PID 1748 wrote to memory of 5100	1748	Holzer.exe	127
PID 1748 wrote to memory of 2800	1748	Holzer.exe	224
PID 1748 wrote to memory of 2800	1748	Holzer.exe	224
PID 1748 wrote to memory of 2800	1748	Holzer.exe	224
PID 1748 wrote to memory of 5012	1748	Holzer.exe	130
PID 1748 wrote to memory of 5012	1748	Holzer.exe	130
PID 1748 wrote to memory of 5012	1748	Holzer.exe	130
PID 1748 wrote to memory of 2324	1748	Holzer.exe	135
PID 1748 wrote to memory of 2324	1748	Holzer.exe	135
PID 1748 wrote to memory of 2324	1748	Holzer.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2800	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Holzer.exe
"C:\Users\Admin\AppData\Local\Temp\Holzer.exe"
1⤵
- Disables RegEdit via registry modification
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\agentactivationruntimestarter.exe
  "C:\Windows\System32\agentactivationruntimestarter.exe"
  2⤵
  PID:1192
- C:\Windows\SysWOW64\appidtel.exe
  "C:\Windows\System32\appidtel.exe"
  2⤵
  PID:3516
- C:\Windows\SysWOW64\ARP.EXE
  "C:\Windows\System32\ARP.EXE"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2548
- C:\Windows\SysWOW64\at.exe
  "C:\Windows\System32\at.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4864
- C:\Windows\SysWOW64\AtBroker.exe
  "C:\Windows\System32\AtBroker.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5100
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2800
- C:\Windows\SysWOW64\auditpol.exe
  "C:\Windows\System32\auditpol.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\System32\autochk.exe"
  2⤵
  PID:4192
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\System32\autoconv.exe"
  2⤵
  PID:212
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\System32\autofmt.exe"
  2⤵
  PID:3616
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\System32\backgroundTaskHost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Windows\SysWOW64\BackgroundTransferHost.exe
  "C:\Windows\System32\BackgroundTransferHost.exe"
  2⤵
  PID:4764
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe"
  2⤵
  PID:4960
- C:\Windows\SysWOW64\bootcfg.exe
  "C:\Windows\System32\bootcfg.exe"
  2⤵
  PID:4180
- C:\Windows\SysWOW64\bthudtask.exe
  "C:\Windows\System32\bthudtask.exe"
  2⤵
  PID:2056
- C:\Windows\SysWOW64\ByteCodeGenerator.exe
  "C:\Windows\System32\ByteCodeGenerator.exe"
  2⤵
  PID:3356
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe"
  2⤵
  PID:2544
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:4372
- C:\Windows\SysWOW64\CameraSettingsUIHost.exe
  "C:\Windows\System32\CameraSettingsUIHost.exe"
  2⤵
  PID:4204
- C:\Windows\SysWOW64\CertEnrollCtrl.exe
  "C:\Windows\System32\CertEnrollCtrl.exe"
  2⤵
  PID:2336
- C:\Windows\SysWOW64\certreq.exe
  "C:\Windows\System32\certreq.exe"
  2⤵
  PID:4228
- C:\Windows\SysWOW64\certutil.exe
  "C:\Windows\System32\certutil.exe"
  2⤵
  PID:1356
- C:\Windows\SysWOW64\charmap.exe
  "C:\Windows\System32\charmap.exe"
  2⤵
  PID:3612
- C:\Windows\SysWOW64\CheckNetIsolation.exe
  "C:\Windows\System32\CheckNetIsolation.exe"
  2⤵
  PID:4788
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\System32\chkdsk.exe"
  2⤵
  PID:3900
- C:\Windows\SysWOW64\chkntfs.exe
  "C:\Windows\System32\chkntfs.exe"
  2⤵
  PID:2488
- C:\Windows\SysWOW64\choice.exe
  "C:\Windows\System32\choice.exe"
  2⤵
  PID:1280
- C:\Windows\SysWOW64\cipher.exe
  "C:\Windows\System32\cipher.exe"
  2⤵
  PID:3336
- C:\Windows\SysWOW64\cleanmgr.exe
  "C:\Windows\System32\cleanmgr.exe"
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\cleanmgr.exe
    "C:\Windows\SysWOW64\cleanmgr.exe"
    3⤵
    PID:6016
  - - C:\Windows\SysWOW64\cleanmgr.exe
      "C:\Windows\SysWOW64\cleanmgr.exe"
      4⤵
      PID:6644
    - - C:\Windows\SysWOW64\cleanmgr.exe
        
        "C:\Windows\SysWOW64\cleanmgr.exe"
        5⤵
        
        PID:6268
      - C:\Windows\SysWOW64\cleanmgr.exe
        
        "C:\Windows\SysWOW64\cleanmgr.exe"
        6⤵
        
        PID:6804
- C:\Windows\SysWOW64\cliconfg.exe
  "C:\Windows\System32\cliconfg.exe"
  2⤵
  PID:2332
- C:\Windows\SysWOW64\clip.exe
  "C:\Windows\System32\clip.exe"
  2⤵
  PID:4952
- C:\Windows\SysWOW64\CloudNotifications.exe
  "C:\Windows\System32\CloudNotifications.exe"
  2⤵
  PID:2268
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4052
- C:\Windows\SysWOW64\cmdkey.exe
  "C:\Windows\System32\cmdkey.exe"
  2⤵
  PID:216
- C:\Windows\SysWOW64\cmdl32.exe
  "C:\Windows\System32\cmdl32.exe"
  2⤵
  PID:2208
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\System32\cmmon32.exe"
  2⤵
  PID:1724
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\System32\cmstp.exe"
  2⤵
  PID:1056
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\System32\colorcpl.exe"
  2⤵
  PID:1296
- C:\Windows\SysWOW64\comp.exe
  "C:\Windows\System32\comp.exe"
  2⤵
  PID:804
- C:\Windows\SysWOW64\compact.exe
  "C:\Windows\System32\compact.exe"
  2⤵
  PID:4820
- C:\Windows\SysWOW64\ComputerDefaults.exe
  "C:\Windows\System32\ComputerDefaults.exe"
  2⤵
  PID:3056
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  PID:2808
- C:\Windows\SysWOW64\convert.exe
  "C:\Windows\System32\convert.exe"
  2⤵
  PID:4084
- C:\Windows\SysWOW64\CredentialUIBroker.exe
  "C:\Windows\System32\CredentialUIBroker.exe"
  2⤵
  PID:448
- C:\Windows\SysWOW64\credwiz.exe
  "C:\Windows\System32\credwiz.exe"
  2⤵
  PID:1768
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\System32\cscript.exe"
  2⤵
  PID:2424
- C:\Windows\SysWOW64\ctfmon.exe
  "C:\Windows\System32\ctfmon.exe"
  2⤵
  PID:1192
- C:\Windows\SysWOW64\cttune.exe
  "C:\Windows\System32\cttune.exe"
  2⤵
  PID:1732
- C:\Windows\SysWOW64\cttunesvr.exe
  "C:\Windows\System32\cttunesvr.exe"
  2⤵
  PID:5204
- C:\Windows\SysWOW64\curl.exe
  "C:\Windows\System32\curl.exe"
  2⤵
  PID:5372
- C:\Windows\SysWOW64\dccw.exe
  "C:\Windows\System32\dccw.exe"
  2⤵
  PID:5476
- C:\Windows\SysWOW64\dcomcnfg.exe
  "C:\Windows\System32\dcomcnfg.exe"
  2⤵
  PID:5568
- - C:\Windows\system32\mmc.exe
    C:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc
    3⤵
    PID:5584
- C:\Windows\SysWOW64\ddodiag.exe
  "C:\Windows\System32\ddodiag.exe"
  2⤵
  PID:5656
- C:\Windows\SysWOW64\DevicePairingWizard.exe
  "C:\Windows\System32\DevicePairingWizard.exe"
  2⤵
  PID:5716
- C:\Windows\SysWOW64\dfrgui.exe
  "C:\Windows\System32\dfrgui.exe"
  2⤵
  PID:5816
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\System32\dialer.exe"
  2⤵
  PID:5984
- C:\Windows\SysWOW64\diskpart.exe
  "C:\Windows\System32\diskpart.exe"
  2⤵
  PID:4920
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2800
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\System32\diskperf.exe"
  2⤵
  PID:5508
- C:\Windows\SysWOW64\Dism.exe
  "C:\Windows\System32\Dism.exe"
  2⤵
  PID:404
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\System32\dllhost.exe"
  2⤵
  PID:6180
- C:\Windows\SysWOW64\dllhst3g.exe
  "C:\Windows\System32\dllhst3g.exe"
  2⤵
  PID:6436
- C:\Windows\SysWOW64\doskey.exe
  "C:\Windows\System32\doskey.exe"
  2⤵
  PID:6492
- C:\Windows\SysWOW64\dpapimig.exe
  "C:\Windows\System32\dpapimig.exe"
  2⤵
  PID:6624
- C:\Windows\SysWOW64\DpiScaling.exe
  "C:\Windows\System32\DpiScaling.exe"
  2⤵
  PID:6704
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" ms-settings:display
    3⤵
    PID:6740
- C:\Windows\SysWOW64\driverquery.exe
  "C:\Windows\System32\driverquery.exe"
  2⤵
  PID:7008
- C:\Windows\SysWOW64\dtdump.exe
  "C:\Windows\System32\dtdump.exe"
  2⤵
  PID:7080
- C:\Windows\SysWOW64\dvdplay.exe
  "C:\Windows\System32\dvdplay.exe"
  2⤵
  PID:7144
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    /device:dvd
    3⤵
    PID:7156
  - - C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      4⤵
      PID:6296
    - - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        5⤵
        
        PID:6352
- C:\Windows\SysWOW64\DWWIN.EXE
  "C:\Windows\System32\DWWIN.EXE"
  2⤵
  PID:6308
- C:\Windows\SysWOW64\dxdiag.exe
  "C:\Windows\System32\dxdiag.exe"
  2⤵
  PID:5548
- C:\Windows\SysWOW64\EaseOfAccessDialog.exe
  "C:\Windows\System32\EaseOfAccessDialog.exe"
  2⤵
  PID:6660
- C:\Windows\SysWOW64\edpnotify.exe
  "C:\Windows\System32\edpnotify.exe"
  2⤵
  PID:6880
- C:\Windows\SysWOW64\efsui.exe
  "C:\Windows\System32\efsui.exe"
  2⤵
  PID:6920
- C:\Windows\SysWOW64\EhStorAuthn.exe
  "C:\Windows\System32\EhStorAuthn.exe"
  2⤵
  PID:6944
- C:\Windows\SysWOW64\esentutl.exe
  "C:\Windows\System32\esentutl.exe"
  2⤵
  PID:6964
- C:\Windows\SysWOW64\eudcedit.exe
  "C:\Windows\System32\eudcedit.exe"
  2⤵
  PID:6136
- C:\Windows\SysWOW64\eventcreate.exe
  "C:\Windows\System32\eventcreate.exe"
  2⤵
  PID:7152
- C:\Windows\SysWOW64\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:6700
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:6320
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\eventvwr.msc" "C:\Windows\system32\eventvwr.msc"
      4⤵
      PID:6652
- C:\Windows\SysWOW64\expand.exe
  "C:\Windows\System32\expand.exe"
  2⤵
  PID:6720
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:6148
- C:\Windows\SysWOW64\extrac32.exe
  "C:\Windows\System32\extrac32.exe"
  2⤵
  PID:6864
- C:\Windows\SysWOW64\fc.exe
  "C:\Windows\System32\fc.exe"
  2⤵
  PID:6832
- C:\Windows\SysWOW64\find.exe
  "C:\Windows\System32\find.exe"
  2⤵
  PID:6920
- C:\Windows\SysWOW64\findstr.exe
  "C:\Windows\System32\findstr.exe"
  2⤵
  PID:4944
- C:\Windows\SysWOW64\finger.exe
  "C:\Windows\System32\finger.exe"
  2⤵
  PID:7156
- C:\Windows\SysWOW64\fixmapi.exe
  "C:\Windows\System32\fixmapi.exe"
  2⤵
  PID:6236
- C:\Windows\SysWOW64\fltMC.exe
  "C:\Windows\System32\fltMC.exe"
  2⤵
  PID:6768
- C:\Windows\SysWOW64\Fondue.exe
  "C:\Windows\System32\Fondue.exe"
  2⤵
  PID:1720
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  PID:7016
- C:\Windows\SysWOW64\fontview.exe
  "C:\Windows\System32\fontview.exe"
  2⤵
  PID:6852
- C:\Windows\SysWOW64\forfiles.exe
  "C:\Windows\System32\forfiles.exe"
  2⤵
  PID:6640
- - C:\Windows\SysWOW64\cmd.exe
    /c echo "409382946"
    3⤵
    PID:6688
- C:\Windows\SysWOW64\fsquirt.exe
  "C:\Windows\System32\fsquirt.exe"
  2⤵
  PID:6864
- C:\Windows\SysWOW64\fsutil.exe
  "C:\Windows\System32\fsutil.exe"
  2⤵
  PID:6332
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\System32\ftp.exe"
  2⤵
  PID:6800
- C:\Windows\SysWOW64\GameBarPresenceWriter.exe
  "C:\Windows\System32\GameBarPresenceWriter.exe"
  2⤵
  PID:6292
- C:\Windows\SysWOW64\GamePanel.exe
  "C:\Windows\System32\GamePanel.exe"
  2⤵
  PID:6832
- C:\Windows\SysWOW64\getmac.exe
  "C:\Windows\System32\getmac.exe"
  2⤵
  PID:6948
- C:\Windows\SysWOW64\gpresult.exe
  "C:\Windows\System32\gpresult.exe"
  2⤵
  PID:6840
- C:\Windows\SysWOW64\gpscript.exe
  "C:\Windows\System32\gpscript.exe"
  2⤵
  PID:6324
- C:\Windows\SysWOW64\gpupdate.exe
  "C:\Windows\System32\gpupdate.exe"
  2⤵
  PID:3356
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\System32\grpconv.exe"
  2⤵
  PID:7016
- C:\Windows\SysWOW64\hdwwiz.exe
  "C:\Windows\System32\hdwwiz.exe"
  2⤵
  PID:6344
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\System32\help.exe"
  2⤵
  PID:6740
- C:\Windows\SysWOW64\hh.exe
  "C:\Windows\System32\hh.exe"
  2⤵
  PID:4116
- C:\Windows\SysWOW64\HOSTNAME.EXE
  "C:\Windows\System32\HOSTNAME.EXE"
  2⤵
  PID:5804
- C:\Windows\SysWOW64\icacls.exe
  "C:\Windows\System32\icacls.exe"
  2⤵
  - Modifies file permissions
  PID:6732
- C:\Windows\SysWOW64\icsunattend.exe
  "C:\Windows\System32\icsunattend.exe"
  2⤵
  PID:6592
- C:\Windows\SysWOW64\ieUnatt.exe
  "C:\Windows\System32\ieUnatt.exe"
  2⤵
  PID:5820
- C:\Windows\SysWOW64\iexpress.exe
  "C:\Windows\System32\iexpress.exe"
  2⤵
  PID:6708
- C:\Windows\SysWOW64\InfDefaultInstall.exe
  "C:\Windows\System32\InfDefaultInstall.exe"
  2⤵
  PID:5076
- C:\Windows\SysWOW64\InputSwitchToastHandler.exe
  "C:\Windows\System32\InputSwitchToastHandler.exe"
  2⤵
  PID:6536
- C:\Windows\SysWOW64\instnm.exe
  "C:\Windows\System32\instnm.exe"
  2⤵
  PID:3412
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe"
  2⤵
  - Gathers network information
  PID:3672
- C:\Windows\SysWOW64\iscsicli.exe
  "C:\Windows\System32\iscsicli.exe"
  2⤵
  PID:3548
- C:\Windows\SysWOW64\iscsicpl.exe
  "C:\Windows\System32\iscsicpl.exe"
  2⤵
  PID:7212
- - C:\Windows\system32\RunDll32.exe
    C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL iscsicpl.dll,,0
    3⤵
    PID:7232
- C:\Windows\SysWOW64\isoburn.exe
  "C:\Windows\System32\isoburn.exe"
  2⤵
  PID:7280
- C:\Windows\SysWOW64\ktmutil.exe
  "C:\Windows\System32\ktmutil.exe"
  2⤵
  PID:7304
- C:\Windows\SysWOW64\label.exe
  "C:\Windows\System32\label.exe"
  2⤵
  PID:7364
- C:\Windows\SysWOW64\LaunchTM.exe
  "C:\Windows\System32\LaunchTM.exe"
  2⤵
  PID:7408
- - C:\Windows\SysWOW64\Taskmgr.exe
    "C:\Windows\System32\Taskmgr.exe"
    3⤵
    PID:7452
- C:\Windows\SysWOW64\LaunchWinApp.exe
  "C:\Windows\System32\LaunchWinApp.exe"
  2⤵
  PID:7468
- C:\Windows\SysWOW64\lodctr.exe
  "C:\Windows\System32\lodctr.exe"
  2⤵
  PID:7496
- C:\Windows\SysWOW64\logagent.exe
  "C:\Windows\System32\logagent.exe"
  2⤵
  PID:7540
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\System32\logman.exe"
  2⤵
  PID:7572
- C:\Windows\SysWOW64\Magnify.exe
  "C:\Windows\System32\Magnify.exe"
  2⤵
  PID:7624
- C:\Windows\SysWOW64\makecab.exe
  "C:\Windows\System32\makecab.exe"
  2⤵
  PID:7712
- C:\Windows\SysWOW64\mavinject.exe
  "C:\Windows\System32\mavinject.exe"
  2⤵
  PID:7788
- C:\Windows\SysWOW64\mcbuilder.exe
  "C:\Windows\System32\mcbuilder.exe"
  2⤵
  PID:7824
- C:\Windows\SysWOW64\mfpmp.exe
  "C:\Windows\System32\mfpmp.exe"
  2⤵
  PID:7912
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\System32\mmc.exe"
  2⤵
  PID:8000
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe"
    3⤵
    PID:8020
- C:\Windows\SysWOW64\mmgaserver.exe
  "C:\Windows\System32\mmgaserver.exe"
  2⤵
  PID:6704
- C:\Windows\SysWOW64\mobsync.exe
  "C:\Windows\System32\mobsync.exe"
  2⤵
  PID:7324
- C:\Windows\SysWOW64\mountvol.exe
  "C:\Windows\System32\mountvol.exe"
  2⤵
  PID:5536
- C:\Windows\SysWOW64\MRINFO.EXE
  "C:\Windows\System32\MRINFO.EXE"
  2⤵
  PID:7112
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\System32\msdt.exe"
  2⤵
  PID:7592
- C:\Windows\SysWOW64\msfeedssync.exe
  "C:\Windows\System32\msfeedssync.exe"
  2⤵
  PID:7788
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe"
  2⤵
  PID:7820
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe"
  2⤵
  PID:7916
- C:\Windows\SysWOW64\msinfo32.exe
  "C:\Windows\System32\msinfo32.exe"
  2⤵
  PID:7936
- C:\Windows\SysWOW64\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:7956
- C:\Windows\SysWOW64\msra.exe
  "C:\Windows\System32\msra.exe"
  2⤵
  PID:6748
- - C:\Windows\system32\msra.exe
    "C:\Windows\system32\msra.exe"
    3⤵
    PID:8132
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\System32\mstsc.exe"
  2⤵
  PID:8152
- - C:\Windows\system32\mstsc.exe
    "C:\Windows\System32\mstsc.exe"
    3⤵
    PID:7172
- C:\Windows\SysWOW64\mtstocom.exe
  "C:\Windows\System32\mtstocom.exe"
  2⤵
  PID:1384
- C:\Windows\SysWOW64\MuiUnattend.exe
  "C:\Windows\System32\MuiUnattend.exe"
  2⤵
  PID:7848
- C:\Windows\SysWOW64\ndadmin.exe
  "C:\Windows\System32\ndadmin.exe"
  2⤵
  PID:6712
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe"
  2⤵
  PID:6352
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1
    3⤵
    PID:972
- C:\Windows\SysWOW64\net1.exe
  "C:\Windows\System32\net1.exe"
  2⤵
  PID:6336
- C:\Windows\SysWOW64\netbtugc.exe
  "C:\Windows\System32\netbtugc.exe"
  2⤵
  PID:7896
- C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe
  "C:\Windows\System32\NetCfgNotifyObjectHost.exe"
  2⤵
  PID:8080
- C:\Windows\SysWOW64\netiougc.exe
  "C:\Windows\System32\netiougc.exe"
  2⤵
  PID:8156
- C:\Windows\SysWOW64\Netplwiz.exe
  "C:\Windows\System32\Netplwiz.exe"
  2⤵
  PID:7028
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe"
  2⤵
  PID:7480
- C:\Windows\SysWOW64\NETSTAT.EXE
  "C:\Windows\System32\NETSTAT.EXE"
  2⤵
  - Gathers network information
  PID:7308
- C:\Windows\SysWOW64\newdev.exe
  "C:\Windows\System32\newdev.exe"
  2⤵
  PID:7964
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:7856
- C:\Windows\SysWOW64\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  PID:7596
- C:\Windows\SysWOW64\ntprint.exe
  "C:\Windows\System32\ntprint.exe"
  2⤵
  PID:6068
- C:\Windows\SysWOW64\odbcad32.exe
  "C:\Windows\System32\odbcad32.exe"
  2⤵
  PID:7524
- C:\Windows\SysWOW64\odbcconf.exe
  "C:\Windows\System32\odbcconf.exe"
  2⤵
  PID:2960
- C:\Windows\SysWOW64\OneDriveSetup.exe
  "C:\Windows\System32\OneDriveSetup.exe"
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1504
    3⤵
    - Program crash
    PID:9012
- C:\Windows\SysWOW64\openfiles.exe
  "C:\Windows\System32\openfiles.exe"
  2⤵
  PID:4216
- C:\Windows\SysWOW64\OpenWith.exe
  "C:\Windows\System32\OpenWith.exe"
  2⤵
  PID:3856
- C:\Windows\SysWOW64\OposHost.exe
  "C:\Windows\System32\OposHost.exe"
  2⤵
  PID:1132
- C:\Windows\SysWOW64\PackagedCWALauncher.exe
  "C:\Windows\System32\PackagedCWALauncher.exe"
  2⤵
  PID:4872
- C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe
  "C:\Windows\System32\PasswordOnWakeSettingFlyout.exe"
  2⤵
  PID:1036
- C:\Windows\SysWOW64\PATHPING.EXE
  "C:\Windows\System32\PATHPING.EXE"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:888
- C:\Windows\SysWOW64\pcaui.exe
  "C:\Windows\System32\pcaui.exe"
  2⤵
  PID:1780
- C:\Windows\SysWOW64\perfhost.exe
  "C:\Windows\System32\perfhost.exe"
  2⤵
  PID:4000
- C:\Windows\SysWOW64\perfmon.exe
  "C:\Windows\System32\perfmon.exe"
  2⤵
  PID:5276
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\perfmon.msc" /32
    3⤵
    PID:60
- C:\Windows\SysWOW64\PickerHost.exe
  "C:\Windows\System32\PickerHost.exe"
  2⤵
  PID:2052
- C:\Windows\SysWOW64\PING.EXE
  "C:\Windows\System32\PING.EXE"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3820
- C:\Windows\SysWOW64\PkgMgr.exe
  "C:\Windows\System32\PkgMgr.exe"
  2⤵
  PID:2536
- C:\Windows\SysWOW64\poqexec.exe
  "C:\Windows\System32\poqexec.exe"
  2⤵
  PID:5336
- C:\Windows\SysWOW64\powercfg.exe
  "C:\Windows\System32\powercfg.exe"
  2⤵
  - Power Settings
  PID:2424
- C:\Windows\SysWOW64\PresentationHost.exe
  "C:\Windows\System32\PresentationHost.exe"
  2⤵
  PID:8272
- C:\Windows\SysWOW64\prevhost.exe
  "C:\Windows\System32\prevhost.exe"
  2⤵
  PID:8316
- C:\Windows\SysWOW64\print.exe
  "C:\Windows\System32\print.exe"
  2⤵
  PID:8344
- C:\Windows\SysWOW64\printui.exe
  "C:\Windows\System32\printui.exe"
  2⤵
  PID:8492
- C:\Windows\SysWOW64\proquota.exe
  "C:\Windows\System32\proquota.exe"
  2⤵
  PID:8556
- C:\Windows\SysWOW64\provlaunch.exe
  "C:\Windows\System32\provlaunch.exe"
  2⤵
  PID:8596
- C:\Windows\SysWOW64\psr.exe
  "C:\Windows\System32\psr.exe"
  2⤵
  PID:8648
- - C:\Windows\system32\psr.exe
    "C:\Windows\system32\psr.exe"
    3⤵
    PID:8688
- C:\Windows\SysWOW64\quickassist.exe
  "C:\Windows\System32\quickassist.exe"
  2⤵
  PID:8728
- C:\Windows\SysWOW64\rasautou.exe
  "C:\Windows\System32\rasautou.exe"
  2⤵
  PID:8780
- C:\Windows\SysWOW64\rasdial.exe
  "C:\Windows\System32\rasdial.exe"
  2⤵
  PID:8860
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\System32\raserver.exe"
  2⤵
  PID:8996
- C:\Windows\SysWOW64\rasphone.exe
  "C:\Windows\System32\rasphone.exe"
  2⤵
  PID:9064
- C:\Windows\SysWOW64\RdpSa.exe
  "C:\Windows\System32\RdpSa.exe"
  2⤵
  PID:9132
- C:\Windows\SysWOW64\RdpSaProxy.exe
  "C:\Windows\System32\RdpSaProxy.exe"
  2⤵
  PID:9192
- - C:\Windows\SysWOW64\RdpSa.exe
    "C:\Windows\system32\RdpSa.exe"
    3⤵
    PID:3528
- C:\Windows\SysWOW64\RdpSaUacHelper.exe
  "C:\Windows\System32\RdpSaUacHelper.exe"
  2⤵
  PID:5892
- C:\Windows\SysWOW64\rdrleakdiag.exe
  "C:\Windows\System32\rdrleakdiag.exe"
  2⤵
  PID:3468
- C:\Windows\SysWOW64\ReAgentc.exe
  "C:\Windows\System32\ReAgentc.exe"
  2⤵
  PID:6876
- C:\Windows\SysWOW64\recover.exe
  "C:\Windows\System32\recover.exe"
  2⤵
  PID:3056
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe"
  2⤵
  PID:8352
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:8604
- C:\Windows\SysWOW64\regedt32.exe
  "C:\Windows\System32\regedt32.exe"
  2⤵
  PID:8660
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:8792
- C:\Windows\SysWOW64\regini.exe
  "C:\Windows\System32\regini.exe"
  2⤵
  PID:8844
- C:\Windows\SysWOW64\Register-CimProvider.exe
  "C:\Windows\System32\Register-CimProvider.exe"
  2⤵
  PID:8920
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe"
  2⤵
  PID:8976
- C:\Windows\SysWOW64\rekeywiz.exe
  "C:\Windows\System32\rekeywiz.exe"
  2⤵
  PID:9004
- C:\Windows\SysWOW64\relog.exe
  "C:\Windows\System32\relog.exe"
  2⤵
  PID:7720
- C:\Windows\SysWOW64\replace.exe
  "C:\Windows\System32\replace.exe"
  2⤵
  PID:6976
- C:\Windows\SysWOW64\resmon.exe
  "C:\Windows\System32\resmon.exe"
  2⤵
  PID:9036
- - C:\Windows\SysWOW64\perfmon.exe
    "C:\Windows\System32\perfmon.exe" /res
    3⤵
    PID:7620
  - - C:\Windows\system32\perfmon.exe
      "C:\Windows\Sysnative\perfmon.exe" /res
      4⤵
      PID:5128
- C:\Windows\SysWOW64\RMActivate.exe
  "C:\Windows\System32\RMActivate.exe"
  2⤵
  PID:8840
- C:\Windows\SysWOW64\RMActivate_isv.exe
  "C:\Windows\System32\RMActivate_isv.exe"
  2⤵
  PID:5796
- C:\Windows\SysWOW64\RMActivate_ssp.exe
  "C:\Windows\System32\RMActivate_ssp.exe"
  2⤵
  PID:7892
- C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
  "C:\Windows\System32\RMActivate_ssp_isv.exe"
  2⤵
  PID:6056
- C:\Windows\SysWOW64\RmClient.exe
  "C:\Windows\System32\RmClient.exe"
  2⤵
  PID:9128
- C:\Windows\SysWOW64\Robocopy.exe
  "C:\Windows\System32\Robocopy.exe"
  2⤵
  PID:1132
- C:\Windows\SysWOW64\ROUTE.EXE
  "C:\Windows\System32\ROUTE.EXE"
  2⤵
  PID:8348
- C:\Windows\SysWOW64\RpcPing.exe
  "C:\Windows\System32\RpcPing.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8892
- C:\Windows\SysWOW64\rrinstaller.exe
  "C:\Windows\System32\rrinstaller.exe"
  2⤵
  PID:7796
- C:\Windows\SysWOW64\runas.exe
  "C:\Windows\System32\runas.exe"
  2⤵
  - Access Token Manipulation: Create Process with Token
  PID:968

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ac 0x440
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv R6YbRByPsES5MebRtwFESg.0
1⤵
PID:2624

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv mzxkHKqnMEiKC9bJUdlcqw.0
1⤵
PID:4376

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv /jpapkp6iUaeAS01fIbBEg.0
1⤵
PID:100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4344

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1184

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:4780

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5788
- C:\Windows\system32\dashost.exe
  dashost.exe {371b7bca-c548-43ba-8ae5750cd9150ddc}
  2⤵
  PID:5852
- C:\Windows\system32\dashost.exe
  dashost.exe {0c7c455b-37ba-46e5-80bbc65278d1e748}
  2⤵
  PID:6032
- C:\Windows\system32\dashost.exe
  dashost.exe {d34a8018-04ce-4dac-85dc769b43c3674a}
  2⤵
  PID:1600

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:6060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3408

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5380

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv SpYU9T0KCUGP6qCDJiIVJQ.0
1⤵
PID:5768

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:548

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:6408

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:6240

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:7536

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv ZwRvKIE930uLAeQ5x9KN2A.0
1⤵
PID:7032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1724 -ip 1724
1⤵
PID:8952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eaee8e44ae9065f875f34878d8b8ccb4_896de533-e5fb-4eb9-8f2b-d363f3584dc5

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\eaee8e44ae9065f875f34878d8b8ccb4_896de533-e5fb-4eb9-8f2b-d363f3584dc5
Size 107B
SHA256 ab38882cf3b1595c957f8d6d2f7ac38d03640bd0553920a4c2dd1221ee6d0011
MD5 19b2e8fead1659857f5277add8b846c6
SHA1 58a9a32848f491c8f661e7ee58172ac8bdda230b
SHA512 8f3d810a5b4ca938ccad76c00e522ba972d791ba5b181d8a351e4e9e375bdaa7df51a9ceeb7d3d328f7df06e9b82459fce405cd912b58e4cbee7ae147fcfadb6
MD5 SHA1 SHA512

Submit Download

eaee8e44ae9065f875f34878d8b8ccb4_896de533-e5fb-4eb9-8f2b-d363f3584dc5

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\eaee8e44ae9065f875f34878d8b8ccb4_896de533-e5fb-4eb9-8f2b-d363f3584dc5
Size 2KB
SHA256 870300aa2fd43fe7e2d8c61a8441e906a3b9904daaaca61c863cb3658d8b425a
MD5 3e0e53a0f747a285c62fbd710f9acc39
SHA1 69c6dcb0583acb656871bb2beaa8074d8a69644c
SHA512 68ed65f720c7ad1e2a603eeb23156d1ba87c2d608ed3d38cf470d86ea7b82dadbec6d5a9eda0573054846ff06109b288cb01e46e478e32c27798d88944bb01e7
MD5 SHA1 SHA512

Submit Download

CERT-Machine-2048.drm

Path C:\ProgramData\Microsoft\DRM\Server\S-1-5-21-2045521122-590294423-3465680274-1000\CERT-Machine-2048.drm
Size 28KB
SHA256 c5d5e554fd3a4e7474d316de08d84565f2f361b35bcdd91707a35e5a909ba425
MD5 9100d4adc0a41757e4febe4acd9d5b43
SHA1 cb088fc88d822a9352c32dbe14b45acc2426e4d5
SHA512 81777460069dbca8357e28063d226ec1fc003f83f965de92a7c3bb2bc103f5573d8f00d7bd70236f20c8aa58630acb421296e3b50f932510ad2b7756521d4466
SSDEEP 384:qsoF15PRUOxGRZ5oF7XCKb95GR1K801fKFSXX3OTKk:mJoIpXhBU1K8ufKFSXX3OTKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CERT-Machine.drm

Path C:\ProgramData\Microsoft\DRM\Server\S-1-5-21-2045521122-590294423-3465680274-1000\CERT-Machine.drm
Size 25KB
SHA256 11e53790c53f12d8b74aa1e8ddd0bbce91e8c9191fbb4f4762cf073dd48e30d2
MD5 016dc4ad6d060417afa99b906b33bbde
SHA1 ed940effbfe58e30dec3368af9cb2d822e03dc3b
SHA512 527d3c0cf1be12dfe728423289a4dabf456ed6d9bee80e9742e8481944d51acc25f4eb80dfeb6f703699fa457f97f4465bff7bf54cd93c0515fa461e486f9098
SSDEEP 384:qAW9a5PRzPRO+1W9tft0AODyKx0SKl73qPKoLt:9tPil0gKx0SKl73qPKEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 338B
SHA256 4ad3f034d715c903ef40bdfbedf88a91f05318b57ebd34929b6ddd7a6f12ac72
MD5 4009be4e5991a096aad0644129484bec
SHA1 56b2429905a004c7dd1c8083b76c54166e4d6bb1
SHA512 8464b9ed21ab29342e1ab12deef6a0c315d0681ed17f8d22e8c5cac601b3f610db950e785567cdd5bddaed7f5a39a1aadca241245fdb8ed7ef7315fcebe42c23
MD5 SHA1 SHA512

Submit Download

CERT-Machine-2048.drm

Path C:\Users\Admin\AppData\Local\Microsoft\DRM\CERT-Machine-2048.drm
Size 28KB
SHA256 c4f7ed9bd98478abdd2eb8c4b0c8e1fb6539ffff0a888bbc687898d5d355600f
MD5 8ece2ce1d6a3ba065d1e3b3a5c92acd3
SHA1 a3b1eecf5615b3280e4534e472fba4a8ff86b29e
SHA512 b1a70e6170e65093fa56cc817011af1176cf2fec8a7851b2bdc2d21e285c148c706b03574fb1147240705abb9f199717f9a5cdbc77b4db1d48dadff9063ade4f
SSDEEP 384:dAOz8dd8tHeaJcSAOLiMtHeaJcgK3E2ZpeZKIqTFX3OTKk:mCJcWhJcgK3rZOKIqTFX3OTKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CERT-Machine.drm

Path C:\Users\Admin\AppData\Local\Microsoft\DRM\CERT-Machine.drm
Size 25KB
SHA256 fff7cd9823657a84c0e30e5934a9cf406d9b955ddd5a59ca63ea4a530d53fae6
MD5 e463b74e2d59ca7ff4d40e8e2174f8c4
SHA1 3234a6d88431bb5c3dc66c8018b32926c1eb79ab
SHA512 f3dce4805d942a30c8dcff425b63043a94e6c23b252388f412e5c4b04de124e60efecbdb969c325a64d29a5d3eb5405e183b511233d8a137ade63cd0e27feee1
SSDEEP 384:d13F/wh8dSMrrN3QQT13F/wRX1rN3QQyKQWWKxf73qPKoLt:/amhQQxaxTQQyKQWWKJ73qPKEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 f80fa9ea17c9dd16e654cea9eb9643775c6260b3a826619e869e36c1d92e6498
MD5 719916ff087358f276bfe41eb35f5ad9
SHA1 117911a6816176f8a00c230b96a206b89f46d398
SHA512 6d48ff697f32d614e2b389f52ca528759b908e6453ab2b86ecaee9b0e447b01b1e1ff54222817417d93e2b60e361f3a782a54730e08fa3f7170336ae50b97565
SSDEEP 768:k0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:KZP2tFPuNnY4UmqEMioTaBacg
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resmon.ResmonCfg

Path C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
Size 17B
SHA256 568269850dbb3f5f52e0e38e3c0b29be06c70c58fe425b39746f5ccefdd668a4
MD5 407aab8c27cf7081eece071c90a65b83
SHA1 d9ec9f9d3768fb1c3646284d77f519f74ee6b8cc
SHA512 88a35933e87dbdd298577bdb33afb1f878dc68f43e7916c4102e893fe04812a9522ed66755df03105fd199fdc3c6bd197051c22b2ea2765d0adba5c375ddd35c
MD5 SHA1 SHA512

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 1b93848396046d5fbcb5b84fe7b22078ab4ff783d220ea1a0337478558a09585
MD5 6100a5ee8deef0026df7303bfcd7ea9d
SHA1 ffd983cc1ed6756bdadc997b28b144f6e2b6757e
SHA512 3c1764681f10b36f730b900d2c16f85be4bf40fd999fa3524d4b02b3d98f94dff50cf681355f46c45e479efc6b26af79099035017061d0db3338ffe6208a0be2
MD5 SHA1 SHA512

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 2.1MB
SHA256 7576e7116b4dd4a2f84bb8b6b804dc1412a117f50198a96b77822c58853e42ac
MD5 d57b6bc0a5c6bd1717f28e149dcce5cf
SHA1 0f04b1ae7e9c8625d1b24a13d0fced0a86024b1d
SHA512 70c753d4a38b2f3b94f5fc8e12fccd1d6d4e5cbfdb4da87d800e3c5de6b0d4d836dd81d3b43d05e5c26d834013dd08b2b5986c714121c180e0d9c82f98171bdc
SSDEEP 1536:ecaQQnORcYUTRdtMvi5JVPacLE1kiIxvrDlTUFmanEYjBTXq1Go1Ck4FnUhIJQhi:7anZRdtMvj0EsiFCzRV0VPhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 47cd1f247ff98db13522945638b7ae24efbc60ba96decd5c316ea261108cf313
MD5 b0ccd2375701b722d674a364c8c3a862
SHA1 df924da9708b388e3262719d2e03811c0b927120
SHA512 6584d654b8392bc4f5fdc84253fe1fbe70c698e5bd0b1cc41180e9fd8d99dfcbfee98e3fa1c300da7653ae673a298280f9a56102a44080bfeaf0c601d46ad1f9
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHUhHMwiGdgbnB:53gbq3gbq3gbY3gbq3gbHUB3gbHVRqM
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 14KB
SHA256 7fae219c1cb17a58a975e2e7b9504d3b75e1427dff016aa24bb8c1520007d039
MD5 2808c4703dcf9a470e6188e714ead8d6
SHA1 a55cb2fb6f90de055b6ccdc187a042de910706f8
SHA512 8cf43af2939117ce65cd921e0923c5c3f32fc88360526eeedadb42bc1a8cd4018ef27c092e9c72d3944a489472ccbf524dbe96e532cc2628fc6e5af888dc7a91
SSDEEP 192:53gbq3gbq3gbY3gbq3gbHUB3gbHVRq93gbHZOEm:53Iq3Iq3IY3Iq3I0B3I03I5Ol
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 16KB
SHA256 5579851616652a57b14de93d5109bc87db0265f925c3f7a92275f6e657084ec9
MD5 c844d70b4cc313c02e15177522019126
SHA1 9d677772e6f3e13f6758c686944fe744d7bfc94c
SHA512 17c5463a4fc2c50f85399c08e1d9fb03570e441e1278eb9684e2ff03b5cb68b0fdb4e322ae2ce966f4e51f8865a37bd3296d1d9ce6cfe17efc651835de1ff971
SSDEEP 192:53gbq3gbq3gbY3gbq3gbHUB3gbHVRq93gbHZOED3gbHXj:53Iq3Iq3IY3Iq3I0B3I03I5OQ3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 12KB
SHA256 19349a5a878ad95eb00409888b24b4f9c14d683affcd47f427b9684d01538272
MD5 ded45d63f399f3f7dffc60aae626cb09
SHA1 1b158b886077d407f2976543204dc135d806b2fa
SHA512 b1df9715a483cd6ce6acc068c6ebf09fbcf28d0a43336b58838cdc8431721a334ebb85c4160b531d089ed20aba6d1364ae50215b4749e248e4ca11001710e17b
SSDEEP 96:5MwiGdgbneLHMwiGdgbnEjgCcZVjkj9jH+HMwiGdgbnYMwiGdgbneLHMwiGdgbnD:53gbq3gbE7cTYZI3gbY3gbq3gbq3gbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 14KB
SHA256 1be75719914242634fcb594d9ea84e675ee281d0920d029ab3ba620a094d0462
MD5 c8075a1b922e727127a0f129e161ae2f
SHA1 0771e12675bb75550dcb5a12bc3583295b50223f
SHA512 ef8ead4877a4bee90d8f8f517f576cc88f6c12c0ee841db8f9cf88769a62cd6904b11e315f815e8d543546f87466bde0d19ebf7c4bec430d6efcb64040ba9369
SSDEEP 192:53gbq3gbE7cTYZI3gbY3gbq3gbq3gbq3gbD:53Iq3IScX3IY3Iq3Iq3Iq3ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 16KB
SHA256 5b7be941152a7074eb73572f9adf59c24a537ff51c5cd371043459f0b3f8466f
MD5 2cbb29df1c51b8599823c42265a2235d
SHA1 19ee3fdcf467d294f41d9ea96b63d9fa1c60a6c2
SHA512 e5e56e27db7e06d7721e7fd4b8b2fc6381e537487636b90518926af512a792bbe74fd4bfe7d5f59531c35786d4f987b4d0b6bbb45165f0a36178996de60562e0
SSDEEP 192:53gbq3gbE7cTYZI3gbY3gbq3gbq3gbq3gbq3gbD:53Iq3IScX3IY3Iq3Iq3Iq3Iq3ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\Panther\UnattendGC\setupact.log
Size 43KB
SHA256 8824590a47aabde2f9410fe93d7a13bbd3e6a6fc56ec772ad8a9da86e7a638bf
MD5 e4a17c6705d4e9f220af3ce796e9d581
SHA1 b05167dc9088663570696740622948c6aa66bdf2
SHA512 a74f26eeb3163d57bc029880700787f6f68a6930cfcf031941a19b12abd04f2dec4fca9bb731b27794823513340f945b503888f1044aa1eb40b808e688245b7b
SSDEEP 768:XnO3Wf8qsBP87AcDAYFsGn3ekxtcvsXyFJ2ThADm/ZhA37B9iyXeak837LtV:e3Wf8qsBk7AcDAYFsGn3ekxqvsXyFJ2i
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\Panther\UnattendGC\setupact.log
Size 43KB
SHA256 b1b5e151951ce43806af2dee6e92ce363185e6c2bfe87e9e287bb9f93a0cdac3
MD5 c6f5096788f8871f4fd488e767f6c623
SHA1 31d22e89d2e0d490a1182083c06f6031b5e71f96
SHA512 5cc55173ab1b5a428e89e773968d3c5d369416e03f8a18ed5ed4f545b9d5218ce42716a3a0aacd80edde565406ec7b9201da0949ec04076a1c47d5f773844abe
SSDEEP 768:XnO3Wf8qsBP87AcDAYFsGn3ekxtcvsXyFJ2ThADm/ZhA37B9iyXeak837Ltv:e3Wf8qsBk7AcDAYFsGn3ekxqvsXyFJ2k
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\Panther\UnattendGC\setupact.log
Size 43KB
SHA256 35f401dc57ed8da5cef09e17947a41e69bac9fbdfa73e7e2f214941140afdac1
MD5 c689de103bb1a4d1a36c7d2599c5a26c
SHA1 5e86f81e00a46eda013aee8570badd06fe7513a4
SHA512 f97da00c652382a35f1791ee8249f8d13617c6520be569de0c46e0d97fae6896bef31ed7e9eb4a86cfffec4a9dfe44da58ab02b068c23fef43a4f23782f21b43
SSDEEP 768:XnO3Wf8qsBP87AcDAYFsGn3ekxtcvsXyFJ2ThADm/ZhA37B9iyXeak837LtI:e3Wf8qsBk7AcDAYFsGn3ekxqvsXyFJ2H
MD5 SHA1 SHA512 SSDEEP

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 305B
SHA256 3da734626711894ed0509f262e52ee42599ffe3e96f69c8f38ce4a70522eebc9
MD5 8d61e6ec1e0b3926a7c5e8c59f737180
SHA1 6d8a69721885eacc1c69c86915540883c1bdc2fb
SHA512 5d30ffb8a9e6c88af7791a84e7cac6c0066b3908e4188e2cdde99d421115410fa314c1ec672da3b72418aa1ae0f128018b008ef0c1ced4b75f76c4b6d4d36456
MD5 SHA1 SHA512

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 585B
SHA256 8eecbafd1927e848db8b5bf226b2a70e070db85e25ade12da5b1f48aec6c2572
MD5 8127858acf8bdafaff356ff01e2d13c0
SHA1 3c525978dd8e68639652bb22c6ba871560826e71
SHA512 d6821e738a76b41fa4ca4ed6d2769fcd2ec6e1c4e942e4b94e1e711ee92bdccd98a6fdf689fccfdd5663e1e1aa4520b09a13d72f2fdead7e9b3027197892e822
MD5 SHA1 SHA512

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 811B
SHA256 e419c61278d7cd2530d81303f886c8e7e7f1103d90fdab921b3abf325199064b
MD5 3fefc43b1283ba65a045b6fd21335e9e
SHA1 b95ac604922ad24e14eaee2801ffbbc28fca9860
SHA512 24702ac3760a1dee4ab3b8d4298a8dc412137eca165e94b2dcd5d7abd9a6ec2fcf43298660e92168ba57b39b38c31f14a51574733e7b2d77d8104972830858e3
MD5 SHA1 SHA512

Submit Download

diagerr.xml

Path C:\Windows\System32\LogFiles\setupcln\diagerr.xml
Size 11KB
SHA256 99d8f8ff63c292f86d44c768027dff8be35c2e14907ba30b2492c79b5210b646
MD5 fe2c70e86eca232620bf73ceaaa25723
SHA1 60ba80019ba806b363b4c29dda11bb2a2c58ea9c
SHA512 5b43f0d49efaa3321d3d53903d0942945b3592ab80b4fefca13c92d18ddbe37cf23931aa22f0eed0ded5ddafe16862c1bd9c5bb4e6a69c00fb85698fe33a45b2
SSDEEP 192:53gbq3gbHEKz3gbHGa6aEVz3gbH7aEyaSz3gbD:53Iq3Il3IE3IS3ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\System32\LogFiles\setupcln\diagwrn.xml
Size 9KB
SHA256 a378a154cfbf27b8471462c657f28a11fee70fd33593ac09ee216c642b26b3aa
MD5 692ca5ebc9e0cef0a8d0be4df7400cee
SHA1 f63dada2e5f7a1d786c93bc3d757642d93b24b59
SHA512 429b2eba8b421f3bae504ebe94da0ea9e662e5256d16301f46a4590f915b381cbc67b86c2beba391600b5f512412f1dcd9bdefc363b4c63dc7136022fa0f45bb
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbneLHMwiGdgbneLHMwiGdgbneLy:53gbq3gbq3gbq3gbq3gbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\System32\LogFiles\setupcln\setupact.log
Size 10KB
SHA256 4bd60dd8f9f8688b61e7346789decdcba5255ae6beff840fff8d7db69e7c7f30
MD5 9eaeebbc1e44e9a48c70c04f2ff0f16b
SHA1 5a8e42fab508c0cb6edddd475e38e2450083b573
SHA512 897446147e303695c322b8c645cc22e03a19a0f3bb585f14f60ebc1b6e94a84ee8e9c406bfdc710936ccdc0baca34f129b75c3558fef3667c3533bc5b7055266
SSDEEP 192:EQ77DswpO3nzyKRFgebvWYkKSVKI3KAFleb+ZyfKZiKJFYKwXebgvwYw2RD:3pMm1VV535DgiiQapXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

setuperr.log

Path C:\Windows\System32\LogFiles\setupcln\setuperr.log
Size 2KB
SHA256 93cd1265573dfc2797c810ec1c929cdba32a5954144cf40558469c089eda7eb8
MD5 00f25fe179d59d6c3af74bf9ac6fb075
SHA1 2adc14b55151352eee2b6c5af8ffcc1b69257d49
SHA512 03b7ac1e0e591ddfe97005f2d10ec0ab542793ce7432e0b1f9f17a244718d73de826cc23b7afd42ce246fdfa35daf2d771e1dba8751f3f899c38359f1d2eb2f9
MD5 SHA1 SHA512

Submit Download

setuperr.log

Path C:\Windows\System32\LogFiles\setupcln\setuperr.log
Size 3KB
SHA256 b17853be6b2d4c604ba08428d0abfdc9d9114d26c327d8d788e7efa6b5abb253
MD5 feda8f60a05039765a7a12839477a309
SHA1 168861163d4794377d2c1951b1ad43811b9836e4
SHA512 30a96b25eb55f6cf518730a697f7efb600af79f4f46b8a35813f34e629e9ae0ef66447f281e36722876b9f1d20c58ad2821867c1f8c1760c334f6b80dfb047a4
MD5 SHA1 SHA512

Submit Download

setuperr.log

Path C:\Windows\System32\LogFiles\setupcln\setuperr.log
Size 1KB
SHA256 3c4d74c88b7f3b701c1c44d86030e43bc48778e004b710a5a01bd4e0f8fe11e1
MD5 f729ad1316ba5eab11917c1dc071ae91
SHA1 c59776cddba7ad5cff1ff15c10298311e70535c6
SHA512 177d5c68835e3095afe6b5511e1e6e8aa87060c2a88d69b977617dd9040d7412c16c68999e93513a998240ba623f2034133f4fef8716b09ad912f932778d8e24
MD5 SHA1 SHA512

Submit Download

diagerr.xml

Path C:\Windows\system32\LogFiles\setupcln\diagerr.xml
Size 45KB
SHA256 748ce33fd6204dbeb7f800971769ed129d255524e054e330445d255458efab7c
MD5 6c16d136c14c1531e32c75e004f00623
SHA1 69da2ba31951042d0fe6d19d5c57bd5f4d2e9dee
SHA512 ef2cff8b352588f048f5552b998932991b6237f74e5c81c026833224bfa082e5f0bc6bef1ca93ab61d5bc81ad01bb7d763ad9d45685585d540843f2f9498698b
SSDEEP 384:53Iq3Il3IE3IS3Iq3Iq3IF3Io3Ia3Iq3Iq3It3Ic3IS3Iq3Iq3IE3Ix3In3ID:5lWFvll65XllWx7llHQyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\system32\LogFiles\setupcln\diagerr.xml
Size 22KB
SHA256 fc69be708a1ffda91f606de7c908a38c9026acad290398c64acd79c3664b0a0a
MD5 e847250a8c718b4df54bcb853def64cf
SHA1 67e4be0cb6dcdf63c3b70681c71be62832b91735
SHA512 59d39365b2a380d37338aff8d9eb4cdc6131e96c0be54d86e870a3f07b6f7881dd00f1985d063b798a4d5a8e7f1a534094c6282120f569016d585a687f9cb1aa
SSDEEP 192:53gbq3gbHEKz3gbHGa6aEVz3gbH7aEyaSz3gbq3gbq3gbHEPY3gbH7Z/ZEkY3gbz:53Iq3Il3IE3IS3Iq3Iq3IF3Io3Ia3ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\system32\LogFiles\setupcln\diagerr.xml
Size 34KB
SHA256 e326e119c4846b4a480447d1765bea20b4d0d1316b52dede1306f7982e439f0f
MD5 d9ccbe81936efabb32025f64adaa9e04
SHA1 4b0b56cc6815365a989ba171391b289b573cfdb9
SHA512 a917c682ba9b69d8920d9a8557cf2817515e5b13395f517085742afde8013666c16936c6d96eaf24d12e3f496b5337354f0754c27316494e651608af17b953e9
SSDEEP 384:53Iq3Il3IE3IS3Iq3Iq3IF3Io3Ia3Iq3Iq3It3Ic3IS3ID:5lWFvll65XllWx7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\system32\LogFiles\setupcln\diagwrn.xml
Size 37KB
SHA256 6faeb5d821ee0669057d2cc40c72a669df30131e08f844807323067a49b636f9
MD5 02f6222bb4739bee9ac27ec5de273f89
SHA1 691ce825e47dadcd5221b643f497c7a3f5136a4a
SHA512 954cd633f1ff1c0d3cc0f4ebaed110943ea751739564ff7327902145d9c248e811df519bbf780b361f6a7d1ca2cbd88d725a17237541859ce036c14b631896c3
SSDEEP 384:53Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3ID:5lllllllllllllllllllU
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\system32\LogFiles\setupcln\diagwrn.xml
Size 16KB
SHA256 b3ce91c96356a2c63fe4a659592e33ddc2092d4877a94308ae146482467f27aa
MD5 165eb24f51291aa5d0eb1ba9d28648d2
SHA1 3ee15d95efc7c79c9f4c420a024a0dbea16664b5
SHA512 5081c2f610ac4ee7de9e627aa3a2ebc306fcfc295f70d2a95617f8246a8e2caec3e50610a194544ffe30549f6d4da9b1176e8e68bc0d047d17f65c06e2fdce99
SSDEEP 192:53gbq3gbq3gbq3gbq3gbq3gbq3gbq3gbq3gbD:53Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\system32\LogFiles\setupcln\diagwrn.xml
Size 27KB
SHA256 a2195074417410cb808f95842f43531fc1b9b770b874fa10310840c8dd783fca
MD5 9b2c4a2b498f91d769ad53fab4794d1a
SHA1 53b0dfa34b5bc87c52caa7ff5292ddc0b7d6e3e4
SHA512 3a75868e058fd2c8336fffbdb1f097853e64101ed91ca17530f8f200ce1cd7b9b0bc56c6996bb40c015e1785c2e6490c27a1c410db500543bc5a068b5c128da3
SSDEEP 384:53Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3ID:5llllllllllllllU
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\system32\LogFiles\setupcln\setupact.log
Size 43KB
SHA256 30b628dc054ef7b950e66f3036f43ed18c57f5585532ae44aa5c7c2509d049fe
MD5 7fcf829a6685d593c4b14266dc48a839
SHA1 2f742ad6089067b4d705f6411b631a6e0b3337b7
SHA512 46ee54125d1e962afed933a1078e0e351b1c808681a8895572d5c6a00e8497c4e9639c84db24dd363d035b9142a0b1e0fbe58eb76d252461845640f447554d11
SSDEEP 384:3pMm1VV535DgiiQapXku9vtYo0S0mxTDJrkyDHWkVPjjFjx2sgqITlEHKMxnXbBc:Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\system32\LogFiles\setupcln\setupact.log
Size 21KB
SHA256 bb99edb25bd2ac7b26c1bb4352a4cadb5b072bd4f282d6c8699a699c5ee28618
MD5 2e537a98e238260b68e478648424734a
SHA1 fa629a4255a29842193efe88aef070fbd20b7fe9
SHA512 2499e2cda1d118e40bd9f2be03f37ae70efb6c13fc279fe24f8c6cdc6ac6d257e351224205ad77198d7869aa7a87d534e289747a356f0818e54ff36374f39392
SSDEEP 384:3pMm1VV535DgiiQapXku9vtYo0S0mxTDJrkyo:5
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\system32\LogFiles\setupcln\setupact.log
Size 32KB
SHA256 c2bc72751da94324391c6c56b92fca9cb7cf260c49115bc91312c96abe73dc5f
MD5 57f4f0c39203d955a0439ea8e578d001
SHA1 fd3cb78ccb67bb558fe4231b01f6a26c9c960497
SHA512 9170b7b139af0c7031f1d20784489c9272298056edbec087eb0142ac2e62d69015e5c4dce47318536bd8e558a772db913b9d1cb78f749156a452031aa04f011f
SSDEEP 384:3pMm1VV535DgiiQapXku9vtYo0S0mxTDJrkyDHWkVPjjFjx2sgqITlZ:x
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5548-218-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/5548-215-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/5548-219-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/5548-208-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/5548-207-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/5548-213-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/5548-217-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/5548-216-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/5548-209-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/5548-214-0x00000000040A0000-0x00000000040A1000-memory.dmp

Download

memory/5796-412-0x00000000004D0000-0x00000000004E0000-memory.dmp

Download

memory/5796-434-0x00000000004D0000-0x00000000004E0000-memory.dmp

Download

memory/5796-413-0x00000000004D0000-0x00000000004E0000-memory.dmp

Download

memory/5796-429-0x00000000004D0000-0x00000000004E0000-memory.dmp

Download

memory/5796-414-0x00000000004D0000-0x00000000004E0000-memory.dmp

Download

memory/5796-435-0x00000000004D0000-0x00000000004E0000-memory.dmp

Download

memory/6056-449-0x0000000000C50000-0x0000000000C60000-memory.dmp

Download

memory/6056-428-0x0000000000C50000-0x0000000000C60000-memory.dmp

Download

memory/6056-444-0x0000000000C50000-0x0000000000C60000-memory.dmp

Download

memory/6056-426-0x0000000000C50000-0x0000000000C60000-memory.dmp

Download

memory/6056-425-0x0000000000C50000-0x0000000000C60000-memory.dmp

Download

memory/6964-153-0x00000000011C0000-0x00000000011D0000-memory.dmp

Download

memory/7892-441-0x0000000001230000-0x0000000001240000-memory.dmp

Download

memory/7892-438-0x0000000001230000-0x0000000001240000-memory.dmp

Download

memory/7892-419-0x0000000001230000-0x0000000001240000-memory.dmp

Download

memory/8272-369-0x0000000035680000-0x0000000035690000-memory.dmp

Download

memory/8840-424-0x0000000000F40000-0x0000000000F50000-memory.dmp

Download

memory/8840-415-0x0000000000F40000-0x0000000000F50000-memory.dmp

Download

memory/8840-409-0x0000000000F40000-0x0000000000F50000-memory.dmp

Download

memory/8840-410-0x0000000000F40000-0x0000000000F50000-memory.dmp

Download

memory/8840-411-0x0000000000F40000-0x0000000000F50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads