colibri | 8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Size

4.9MB
MD5

5cc4d6abb8d7be81eb9e88cd2817782d
SHA1

68d23b88f276fd956d0863067595c1f8d485df63
SHA256

8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f
SHA512

f4b7625e040a4fe325d3c417bb571767a28c737804f959b1326534b4a1fae014afb2e563680b48cecd1172c5d878c0dcd364d640653d7e24a380b31df50d611c
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

colibri dcrat build1 discovery evasion execution infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

rc4.plain

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
Colibri family
colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	720	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2772	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2772	schtasks.exe	86

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4028-2-0x000000001B780000-0x000000001B8AE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
684	powershell.exe
1300	powershell.exe
1112	powershell.exe
3068	powershell.exe
3604	powershell.exe
4116	powershell.exe
1608	powershell.exe
3320	powershell.exe
3352	powershell.exe
344	powershell.exe
4128	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 42 IoCs

pid	Process
4996	tmp9F7D.tmp.exe
2468	tmp9F7D.tmp.exe
64	dllhost.exe
1376	tmpF0C8.tmp.exe
900	tmpF0C8.tmp.exe
5084	tmpF0C8.tmp.exe
4748	dllhost.exe
4468	tmp123B.tmp.exe
3916	tmp123B.tmp.exe
2800	dllhost.exe
2160	tmp4522.tmp.exe
1456	tmp4522.tmp.exe
4148	dllhost.exe
936	tmp6695.tmp.exe
4288	tmp6695.tmp.exe
3936	dllhost.exe
4068	tmp9CA8.tmp.exe
1548	tmp9CA8.tmp.exe
1968	dllhost.exe
4480	tmpD339.tmp.exe
4028	tmpD339.tmp.exe
3160	tmpD339.tmp.exe
4444	tmpD339.tmp.exe
2268	dllhost.exe
2152	tmpF42F.tmp.exe
808	tmpF42F.tmp.exe
4196	dllhost.exe
1208	tmp2CF2.tmp.exe
3260	tmp2CF2.tmp.exe
1280	dllhost.exe
3672	tmp4B76.tmp.exe
2636	tmp4B76.tmp.exe
3980	dllhost.exe
380	tmp6920.tmp.exe
900	tmp6920.tmp.exe
3472	dllhost.exe
3916	tmp9D01.tmp.exe
1548	tmp9D01.tmp.exe
4812	dllhost.exe
4068	tmpBDB8.tmp.exe
3800	tmpBDB8.tmp.exe
4528	dllhost.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 4996 set thread context of 2468	4996	tmp9F7D.tmp.exe	148
PID 900 set thread context of 5084	900	tmpF0C8.tmp.exe	184
PID 4468 set thread context of 3916	4468	tmp123B.tmp.exe	191
PID 2160 set thread context of 1456	2160	tmp4522.tmp.exe	198
PID 936 set thread context of 4288	936	tmp6695.tmp.exe	204
PID 4068 set thread context of 1548	4068	tmp9CA8.tmp.exe	210
PID 3160 set thread context of 4444	3160	tmpD339.tmp.exe	218
PID 2152 set thread context of 808	2152	tmpF42F.tmp.exe	224
PID 1208 set thread context of 3260	1208	tmp2CF2.tmp.exe	230
PID 3672 set thread context of 2636	3672	tmp4B76.tmp.exe	236
PID 380 set thread context of 900	380	tmp6920.tmp.exe	242
PID 3916 set thread context of 1548	3916	tmp9D01.tmp.exe	248
PID 4068 set thread context of 3800	4068	tmpBDB8.tmp.exe	254

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\de-DE\RCXB224.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files\Internet Explorer\en-US\5940a34987c991	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\9e8d7a4ca61bd9	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files\Windows Media Player\de-DE\services.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files (x86)\Adobe\RCXC257.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RCXC46B.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files\Internet Explorer\images\RCXC894.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\RuntimeBroker.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\RuntimeBroker.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files\VideoLAN\RCXA7AF.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\5940a34987c991	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\RCXA377.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\RCXABD7.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXC043.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\dllhost.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files\Internet Explorer\images\RuntimeBroker.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files\Internet Explorer\images\9e8d7a4ca61bd9	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files\Internet Explorer\images\RuntimeBroker.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files (x86)\Adobe\9e8d7a4ca61bd9	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\dllhost.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\6ccacd8608530f	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files\VideoLAN\winlogon.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files\VideoLAN\winlogon.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files\Internet Explorer\en-US\dllhost.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files\Windows Media Player\de-DE\c5b4cb5e9653cc	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files (x86)\Adobe\RuntimeBroker.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\services.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Program Files\VideoLAN\cc11b995f2a76d	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files (x86)\Adobe\RuntimeBroker.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\dllhost.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\twain_32\RCXB860.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\twain_32\Registry.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\Offline Web Pages\RCXBCF6.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\winlogon.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\Tasks\SearchApp.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\Offline Web Pages\wininit.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\Offline Web Pages\56085415360792	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\LanguageOverlayCache\RuntimeBroker.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\GameBarPresenceWriter\RCXB447.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\uk-UA\SearchApp.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\GameBarPresenceWriter\sysmon.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\twain_32\ee2ad38f3d4382	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\Tasks\RCXB00F.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\GameBarPresenceWriter\sysmon.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\Offline Web Pages\wininit.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\uk-UA\SearchApp.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\cc11b995f2a76d	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\RCXA59A.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\twain_32\Registry.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\uk-UA\RCXA162.tmp	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\winlogon.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File opened for modification	C:\Windows\Tasks\SearchApp.exe	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\uk-UA\38384e6a620884	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\Tasks\38384e6a620884	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
File created	C:\Windows\GameBarPresenceWriter\121e5b5079f7c0	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4522.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD339.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD339.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF42F.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4B76.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9D01.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9F7D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp123B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2CF2.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9CA8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBDB8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF0C8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6695.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6920.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF0C8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpD339.tmp.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1376	schtasks.exe
4524	schtasks.exe
4300	schtasks.exe
1984	schtasks.exe
3888	schtasks.exe
516	schtasks.exe
2792	schtasks.exe
4712	schtasks.exe
4124	schtasks.exe
2580	schtasks.exe
1080	schtasks.exe
4896	schtasks.exe
4020	schtasks.exe
804	schtasks.exe
1304	schtasks.exe
3640	schtasks.exe
4932	schtasks.exe
1588	schtasks.exe
2752	schtasks.exe
2016	schtasks.exe
4796	schtasks.exe
776	schtasks.exe
1852	schtasks.exe
3936	schtasks.exe
2116	schtasks.exe
736	schtasks.exe
2720	schtasks.exe
2512	schtasks.exe
2220	schtasks.exe
2744	schtasks.exe
1840	schtasks.exe
1236	schtasks.exe
2384	schtasks.exe
2976	schtasks.exe
4964	schtasks.exe
2584	schtasks.exe
740	schtasks.exe
2632	schtasks.exe
2956	schtasks.exe
3340	schtasks.exe
720	schtasks.exe
2496	schtasks.exe
1104	schtasks.exe
3216	schtasks.exe
4564	schtasks.exe
760	schtasks.exe
2676	schtasks.exe
2160	schtasks.exe
5096	schtasks.exe
1584	schtasks.exe
684	schtasks.exe
1208	schtasks.exe
4512	schtasks.exe
3648	schtasks.exe
4608	schtasks.exe
1312	schtasks.exe
2284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
4116	powershell.exe
4116	powershell.exe
3352	powershell.exe
3352	powershell.exe
3320	powershell.exe
3320	powershell.exe
344	powershell.exe
344	powershell.exe
684	powershell.exe
684	powershell.exe
3604	powershell.exe
3604	powershell.exe
1608	powershell.exe
1608	powershell.exe
1112	powershell.exe
1112	powershell.exe
4128	powershell.exe
4128	powershell.exe
1300	powershell.exe
1300	powershell.exe
1608	powershell.exe
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe
4116	powershell.exe
3320	powershell.exe
344	powershell.exe
3352	powershell.exe
1300	powershell.exe
684	powershell.exe
3604	powershell.exe
4128	powershell.exe
1112	powershell.exe
64	dllhost.exe
4748	dllhost.exe
2800	dllhost.exe
4148	dllhost.exe
3936	dllhost.exe
1968	dllhost.exe
2268	dllhost.exe
4196	dllhost.exe
1280	dllhost.exe
3980	dllhost.exe
3472	dllhost.exe
4812	dllhost.exe
4528	dllhost.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Token: SeDebugPrivilege	344	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	64	dllhost.exe
Token: SeDebugPrivilege	4748	dllhost.exe
Token: SeDebugPrivilege	2800	dllhost.exe
Token: SeDebugPrivilege	4148	dllhost.exe
Token: SeDebugPrivilege	3936	dllhost.exe
Token: SeDebugPrivilege	1968	dllhost.exe
Token: SeDebugPrivilege	2268	dllhost.exe
Token: SeDebugPrivilege	4196	dllhost.exe
Token: SeDebugPrivilege	1280	dllhost.exe
Token: SeDebugPrivilege	3980	dllhost.exe
Token: SeDebugPrivilege	3472	dllhost.exe
Token: SeDebugPrivilege	4812	dllhost.exe
Token: SeDebugPrivilege	4528	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4996	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	144
PID 4028 wrote to memory of 4996	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	144
PID 4028 wrote to memory of 4996	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	144
PID 4996 wrote to memory of 2468	4996	tmp9F7D.tmp.exe	148
PID 4996 wrote to memory of 2468	4996	tmp9F7D.tmp.exe	148
PID 4996 wrote to memory of 2468	4996	tmp9F7D.tmp.exe	148
PID 4996 wrote to memory of 2468	4996	tmp9F7D.tmp.exe	148
PID 4996 wrote to memory of 2468	4996	tmp9F7D.tmp.exe	148
PID 4996 wrote to memory of 2468	4996	tmp9F7D.tmp.exe	148
PID 4996 wrote to memory of 2468	4996	tmp9F7D.tmp.exe	148
PID 4028 wrote to memory of 3068	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	153
PID 4028 wrote to memory of 3068	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	153
PID 4028 wrote to memory of 3604	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	154
PID 4028 wrote to memory of 3604	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	154
PID 4028 wrote to memory of 3352	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	155
PID 4028 wrote to memory of 3352	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	155
PID 4028 wrote to memory of 4116	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	156
PID 4028 wrote to memory of 4116	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	156
PID 4028 wrote to memory of 344	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	157
PID 4028 wrote to memory of 344	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	157
PID 4028 wrote to memory of 4128	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	158
PID 4028 wrote to memory of 4128	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	158
PID 4028 wrote to memory of 1608	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	159
PID 4028 wrote to memory of 1608	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	159
PID 4028 wrote to memory of 3320	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	164
PID 4028 wrote to memory of 3320	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	164
PID 4028 wrote to memory of 684	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	167
PID 4028 wrote to memory of 684	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	167
PID 4028 wrote to memory of 1300	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	168
PID 4028 wrote to memory of 1300	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	168
PID 4028 wrote to memory of 1112	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	169
PID 4028 wrote to memory of 1112	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	169
PID 4028 wrote to memory of 4532	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	174
PID 4028 wrote to memory of 4532	4028	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe	174
PID 4532 wrote to memory of 2588	4532	cmd.exe	177
PID 4532 wrote to memory of 2588	4532	cmd.exe	177
PID 4532 wrote to memory of 64	4532	cmd.exe	178
PID 4532 wrote to memory of 64	4532	cmd.exe	178
PID 64 wrote to memory of 4716	64	dllhost.exe	179
PID 64 wrote to memory of 4716	64	dllhost.exe	179
PID 64 wrote to memory of 1056	64	dllhost.exe	180
PID 64 wrote to memory of 1056	64	dllhost.exe	180
PID 64 wrote to memory of 1376	64	dllhost.exe	181
PID 64 wrote to memory of 1376	64	dllhost.exe	181
PID 64 wrote to memory of 1376	64	dllhost.exe	181
PID 1376 wrote to memory of 900	1376	tmpF0C8.tmp.exe	183
PID 1376 wrote to memory of 900	1376	tmpF0C8.tmp.exe	183
PID 1376 wrote to memory of 900	1376	tmpF0C8.tmp.exe	183
PID 900 wrote to memory of 5084	900	tmpF0C8.tmp.exe	184
PID 900 wrote to memory of 5084	900	tmpF0C8.tmp.exe	184
PID 900 wrote to memory of 5084	900	tmpF0C8.tmp.exe	184
PID 900 wrote to memory of 5084	900	tmpF0C8.tmp.exe	184
PID 900 wrote to memory of 5084	900	tmpF0C8.tmp.exe	184
PID 900 wrote to memory of 5084	900	tmpF0C8.tmp.exe	184
PID 900 wrote to memory of 5084	900	tmpF0C8.tmp.exe	184
PID 4716 wrote to memory of 4748	4716	WScript.exe	186
PID 4716 wrote to memory of 4748	4716	WScript.exe	186
PID 4748 wrote to memory of 4304	4748	dllhost.exe	187
PID 4748 wrote to memory of 4304	4748	dllhost.exe	187
PID 4748 wrote to memory of 912	4748	dllhost.exe	188
PID 4748 wrote to memory of 912	4748	dllhost.exe	188
PID 4748 wrote to memory of 4468	4748	dllhost.exe	189
PID 4748 wrote to memory of 4468	4748	dllhost.exe	189
PID 4748 wrote to memory of 4468	4748	dllhost.exe	189

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe
"C:\Users\Admin\AppData\Local\Temp\8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4028
- C:\Users\Admin\AppData\Local\Temp\tmp9F7D.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9F7D.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Users\Admin\AppData\Local\Temp\tmp9F7D.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp9F7D.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rXK8NX3R6F.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2588
- - C:\Program Files\Internet Explorer\en-US\dllhost.exe
    "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:64
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33880622-a103-4f8d-bdf0-098eb5997aec.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4716
    - - C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4748
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04e23378-84dc-4079-ad92-c27975bdca16.vbs"
        6⤵
        
        PID:4304
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca9304d7-6101-4e5b-a151-a4819691046f.vbs"
        8⤵
        
        PID:4212
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4148
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a402db6-f7cc-4a66-91b7-a8fe0a690fd2.vbs"
        10⤵
        
        PID:5084
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d7def90-3d4c-421b-88ef-e60259140319.vbs"
        12⤵
        
        PID:3976
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ecc926e-44dc-4430-ac58-ef5be3c0c6d8.vbs"
        14⤵
        
        PID:4540
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b1852fa-2bf2-43c3-a1f3-140610ec620b.vbs"
        16⤵
        
        PID:3188
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4196
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8008a5d1-5f14-412c-940f-4c32e020ff04.vbs"
        18⤵
        
        PID:3544
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1280
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47dc71cb-942e-4446-b326-b8acd79bff79.vbs"
        20⤵
        
        PID:776
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1316c03-23fd-436d-b2a2-523c2488f188.vbs"
        22⤵
        
        PID:4508
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3472
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58f6c5a5-e12c-4b70-83fe-8bc413576168.vbs"
        24⤵
        
        PID:3780
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34606f6c-9be6-4539-8b56-e891baab153a.vbs"
        26⤵
        
        PID:2744
        
        C:\Program Files\Internet Explorer\en-US\dllhost.exe
        
        "C:\Program Files\Internet Explorer\en-US\dllhost.exe"
        27⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9f09bdd-2223-43d2-b319-7377f61cf0d0.vbs"
        28⤵
        
        PID:1988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc354713-5e1c-40ee-9079-c89c6278bc5b.vbs"
        28⤵
        
        PID:1524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1afab18d-2f0b-4238-926c-415f6fa00081.vbs"
        26⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\tmpBDB8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBDB8.tmp.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\tmpBDB8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpBDB8.tmp.exe"
        27⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\761441a7-cae9-4615-9455-de816011c71d.vbs"
        24⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\tmp9D01.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9D01.tmp.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\tmp9D01.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9D01.tmp.exe"
        25⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efbdfa2e-c198-4b8b-8977-18c210868d90.vbs"
        22⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\tmp6920.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6920.tmp.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\tmp6920.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6920.tmp.exe"
        23⤵
        Executes dropped EXE
        
        PID:900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\522cec77-8c18-4224-ae01-f4a3cd7926ab.vbs"
        20⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4B76.tmp.exe"
        21⤵
        Executes dropped EXE
        
        PID:2636
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72e84a4e-7cc8-4495-a856-8d2cf0d4835f.vbs"
        18⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\tmp2CF2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2CF2.tmp.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\tmp2CF2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp2CF2.tmp.exe"
        19⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec01ebfc-c08b-419f-8a86-9ea64b1646ce.vbs"
        16⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\tmpF42F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF42F.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\tmpF42F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF42F.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\659447a1-09e0-4758-886a-49908aa2f088.vbs"
        14⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\tmpD339.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD339.tmp.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\tmpD339.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD339.tmp.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\tmpD339.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD339.tmp.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\tmpD339.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpD339.tmp.exe"
        17⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83b5c467-3ed5-4537-a164-00b5cee094a5.vbs"
        12⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\tmp9CA8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9CA8.tmp.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\tmp9CA8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp9CA8.tmp.exe"
        13⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2677a682-f3f4-4293-8616-cdbaf3e4e754.vbs"
        10⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\tmp6695.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6695.tmp.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\tmp6695.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp6695.tmp.exe"
        11⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b0ae77f-4084-41f7-b288-58ae4d905f35.vbs"
        8⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\tmp4522.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4522.tmp.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\tmp4522.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp4522.tmp.exe"
        9⤵
        Executes dropped EXE
        
        PID:1456
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6a5cf48-3c0c-4875-8d4f-92a530223903.vbs"
        6⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\tmp123B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp123B.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\tmp123B.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp123B.tmp.exe"
        7⤵
        Executes dropped EXE
        
        PID:3916
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46846152-d5cf-449f-bcf7-434faeb6a9f9.vbs"
      4⤵
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\tmpF0C8.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpF0C8.tmp.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\tmpF0C8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF0C8.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:900
      - C:\Users\Admin\AppData\Local\Temp\tmpF0C8.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF0C8.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Windows\uk-UA\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\uk-UA\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Windows\uk-UA\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\Public\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Public\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Users\Public\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Windows\Tasks\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\Tasks\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Windows\Tasks\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\de-DE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Windows\GameBarPresenceWriter\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Windows\GameBarPresenceWriter\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Recent\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\Recent\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Recent\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Windows\twain_32\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\Offline Web Pages\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\images\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\RCXC680.tmp

Filesize
4.9MB

MD5
c652c9a98e3e2e6bcc4419ab80de35e7

SHA1
cb4781c054108457130b86de08eaf1fb00735210

SHA256
7a341d427c93ba596b360a009fa65154beb78f247ba00e86d694c336d6bfa895

SHA512
07c5f7602579bda92b3944a79c669c6ef1f2da0b9d07c810b77aea014d2fd0497ff7cba997e18a5ddca46583478343813f59ad6bde1b05df0b9ee31b32a5aa95

Download Submit
C:\Recovery\WindowsRE\SppExtComObj.exe

Filesize
4.9MB

MD5
b0906f12bb8b29c6feb5b83bdaaf20f6

SHA1
62eea7412e5dd8ad1a613437f775483fa3c8ed2d

SHA256
6cbf619751141d6b8cab105ef3ba1393dd2a5dfa142e439fdf0177f428c9c463

SHA512
4f44c37819752cd014af50dabfe37e585d3b610e374e0fb26e5ae06736dcc76f238055106383d9874487e0817cbf72243890c5aab6ec2ebbf629ec320597576e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
28d4235aa2e6d782751f980ceb6e5021

SHA1
f5d82d56acd642b9fc4b963f684fd6b78f25a140

SHA256
8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

SHA512
dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\04e23378-84dc-4079-ad92-c27975bdca16.vbs

Filesize
728B

MD5
228c12a49759bff2039eef9f3ef71573

SHA1
79f191d87b8bcf9f009b35d46415994ed6713a59

SHA256
3aaccf51a75ca18d5c9a19df0fda8d3c2c1b60d21026181d0fc7f23d09cc88a0

SHA512
4ac7ff46d9d6a5047ccd8354eb3aacd38d0ec706fe58bcd6fcca9f7a28079084ebafd2b3b5da733e420cf4e060f9a29e3e91b1e1b8bd85c65afed2006924cb74

Download Submit
C:\Users\Admin\AppData\Local\Temp\2a402db6-f7cc-4a66-91b7-a8fe0a690fd2.vbs

Filesize
728B

MD5
023870761156ecbf8beab0ea5075249a

SHA1
ad318d55252300a78dece6a9fcb14030f928a021

SHA256
8251117b4d927f9c51957e3e5ae912910ca3ba81dbb972a5237f5273c5bdb0c9

SHA512
02b81fb00aa8d0f260113ff174de10c31060a3b8e8c52be4e6c84d9eb095d06f878ff381328725ef316a6e96cc9eaca062d756495d7df490c5d9904ed3a4106a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2b1852fa-2bf2-43c3-a1f3-140610ec620b.vbs

Filesize
728B

MD5
79d5343254f1f055157dc6bed63d4575

SHA1
2014de7be0a38fcd8ab83ae864aa4e2ebea0e648

SHA256
58b80035470ee0f9d2b1b333d087d6b69fe8d9e39b6195f9b1c76e5615110c57

SHA512
f23f4380755550a2afc2d50382792d9204e733b3de60efeaa615352f4d79cafa54d9dd85c2b60196a95596c2b3d70035911b9ca92c74fd940c739566ef1c094b

Download Submit
C:\Users\Admin\AppData\Local\Temp\33880622-a103-4f8d-bdf0-098eb5997aec.vbs

Filesize
726B

MD5
5aa728608e1b6bb039adf36f640a0163

SHA1
f136430989747dfab70fbecb49e58f2ef54ae623

SHA256
4fe4129bb340df4c2a774c47e40fec218061e8be359bf47a32843ec33965645a

SHA512
c2157e94ef95c586d85b759b6ddf5af6e0204662b1307c17e42bb222ef0da3a5351efe65edf281f2b8e3d4e07b933362803be29345c355bf95b38cac4d8b142d

Download Submit
C:\Users\Admin\AppData\Local\Temp\46846152-d5cf-449f-bcf7-434faeb6a9f9.vbs

Filesize
504B

MD5
47de29286a1c06f999cef8244824fc48

SHA1
3ca914604100c5c75738d18f447e99a652642306

SHA256
05eb03d08ef5046ec9f4a612d8c50999c89480b242474183275fae72472cdf59

SHA512
4b70be5be4ecbccf1cb3024ab6644a15dbff3b85c6775c368050e826f8b6fc9af61cd7309e97b4b95426447d2a18c56b67f881087d00678e77be60eb0484428f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4d7def90-3d4c-421b-88ef-e60259140319.vbs

Filesize
728B

MD5
ad7813138a0d83f66a2a3d0187ac4dc4

SHA1
29ea19219f86e1dee405e41a872cbb1def4fb18f

SHA256
4d4a1cdd4cf7c88622516a9ec76bb141e607c29e656916891ebc7af37a854bd8

SHA512
57a759094993aaccd7895f2f91ef64948aaae0c267fc68ea7ebd5d33e85484ca8884fb971b39b2e2239ad6d3de9c224c529215f1e283285063960e03c8b81212

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ecc926e-44dc-4430-ac58-ef5be3c0c6d8.vbs

Filesize
728B

MD5
2914c5ebb71095b3f7ad6a1d8952fcff

SHA1
2069c5c55192cf9e6e90ae4c0aa6d2fcc3314e92

SHA256
4736891e0628184d59269e1e476c45f2e39410d0acb5af6cfa5b159ebb332078

SHA512
f69dcb8eeefb36d80c1293439be0e9109f0414f3a90be908f0e31a22ca44da15cb2da03be6ebc9c0898de0797fb63000be5e5ce79defc24ad5f8bfdf0f4bc7cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aypt02hc.wvs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9304d7-6101-4e5b-a151-a4819691046f.vbs

Filesize
728B

MD5
7629714a9616606a70aa348d41d9ac2a

SHA1
7ae9ee8281be6eb2db50e716ff2a0e29f45e4254

SHA256
222196eaa8b8a2c4e9d3b90a74cf8b074e922b0993361280218f9e4caa234042

SHA512
cc094ee8a3ea1b18f178effa3604ef23920d095a37e7790585ba36968d4880bf86d34fcb38b668040c66cc90ab8a6338c519ebef104c437343cd314b4fbe0d53

Download Submit
C:\Users\Admin\AppData\Local\Temp\rXK8NX3R6F.bat

Filesize
217B

MD5
552b2ceab075f8bca9d8ca1285e3f9d9

SHA1
c8841b536ad1fcf025bae665b4ee1cbd0eecbb4f

SHA256
df12f5bd5a44fa4a26f77e302dc2f8b9ed6a8d1119940e4b0049b0d1feb835bb

SHA512
33ea43ef10b9a216b1a7a97a591da82aeafc0d52cae694a45f4d479992a51a5de212cf75045d54d9f9c9a1e0a308bf9a70f1bf41616b27c5367523cdf2738690

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9F7D.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Public\TextInputHost.exe

Filesize
4.9MB

MD5
5cc4d6abb8d7be81eb9e88cd2817782d

SHA1
68d23b88f276fd956d0863067595c1f8d485df63

SHA256
8a03f7f65c527f58e2c90fbee43ba1bead4580658cf99792a62654a879f4bd8f

SHA512
f4b7625e040a4fe325d3c417bb571767a28c737804f959b1326534b4a1fae014afb2e563680b48cecd1172c5d878c0dcd364d640653d7e24a380b31df50d611c

Download Submit
C:\Windows\Offline Web Pages\RCXBCF6.tmp

Filesize
4.9MB

MD5
456b0d599d05be1294f70f6ac6aa2eb1

SHA1
b8e7cab140f1085e8ea48586886b3a3d941ef67a

SHA256
0de5b8548c50a527c0e0ce7f255283bf6656dd575d8b1367768b195fd0f4ca79

SHA512
368c2e768aac1c9529b196679f58117e1a9c7268668081f608634a9a39a9a8c57478b79cc619b5dd5c384568afa1857049349d817ec841347ff940c0ff56091b

Download Submit
memory/344-212-0x000001F1FDC80000-0x000001F1FDCA2000-memory.dmp

Filesize
136KB

Download
memory/1968-458-0x0000000002CA0000-0x0000000002CB2000-memory.dmp

Filesize
72KB

Download
memory/2268-488-0x0000000003540000-0x0000000003552000-memory.dmp

Filesize
72KB

Download
memory/2468-72-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3472-556-0x00000000028E0000-0x00000000028F2000-memory.dmp

Filesize
72KB

Download
memory/3980-539-0x000000001B890000-0x000000001B8A2000-memory.dmp

Filesize
72KB

Download
memory/4028-6-0x0000000002AF0000-0x0000000002AF8000-memory.dmp

Filesize
32KB

Download
memory/4028-10-0x000000001B730000-0x000000001B73A000-memory.dmp

Filesize
40KB

Download
memory/4028-17-0x000000001BF20000-0x000000001BF28000-memory.dmp

Filesize
32KB

Download
memory/4028-15-0x000000001BF00000-0x000000001BF0E000-memory.dmp

Filesize
56KB

Download
memory/4028-14-0x000000001B760000-0x000000001B76E000-memory.dmp

Filesize
56KB

Download
memory/4028-13-0x000000001B750000-0x000000001B75A000-memory.dmp

Filesize
40KB

Download
memory/4028-12-0x000000001C430000-0x000000001C958000-memory.dmp

Filesize
5.2MB

Download
memory/4028-11-0x000000001B740000-0x000000001B752000-memory.dmp

Filesize
72KB

Download
memory/4028-162-0x00007FFCE6770000-0x00007FFCE7231000-memory.dmp

Filesize
10.8MB

Download
memory/4028-7-0x0000000002B00000-0x0000000002B10000-memory.dmp

Filesize
64KB

Download
memory/4028-8-0x000000001B710000-0x000000001B726000-memory.dmp

Filesize
88KB

Download
memory/4028-18-0x000000001BF30000-0x000000001BF3C000-memory.dmp

Filesize
48KB

Download
memory/4028-9-0x0000000002B20000-0x0000000002B30000-memory.dmp

Filesize
64KB

Download
memory/4028-5-0x000000001BEB0000-0x000000001BF00000-memory.dmp

Filesize
320KB

Download
memory/4028-4-0x0000000002AD0000-0x0000000002AEC000-memory.dmp

Filesize
112KB

Download
memory/4028-3-0x00007FFCE6770000-0x00007FFCE7231000-memory.dmp

Filesize
10.8MB

Download
memory/4028-16-0x000000001BF10000-0x000000001BF18000-memory.dmp

Filesize
32KB

Download
memory/4028-2-0x000000001B780000-0x000000001B8AE000-memory.dmp

Filesize
1.2MB

Download
memory/4028-211-0x00007FFCE6770000-0x00007FFCE7231000-memory.dmp

Filesize
10.8MB

Download
memory/4028-1-0x0000000000490000-0x0000000000984000-memory.dmp

Filesize
5.0MB

Download
memory/4028-148-0x00007FFCE6773000-0x00007FFCE6775000-memory.dmp

Filesize
8KB

Download
memory/4028-0-0x00007FFCE6773000-0x00007FFCE6775000-memory.dmp

Filesize
8KB

Download
memory/4812-573-0x0000000002D80000-0x0000000002D92000-memory.dmp

Filesize
72KB

Download