dcrat | 8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
Size

1.7MB
MD5

6c26f99f8cc5c28eedd98e866861d80d
SHA1

44d8cc809e4617152a9d8d2f0ff45991407d3ca4
SHA256

8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b
SHA512

d460bd742c0044711dd64d656977d924fc67e5580277a5649b931dd07d1de8951f408a711091037e8b08a81c391bccc1a8388745455180791af6c2b66c1a2359
SSDEEP

49152:z+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKv:eTHUxUoh1IF9gl2

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	3508	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	3508	schtasks.exe	83

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2064-1-0x0000000000360000-0x0000000000520000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b73-30.dat	dcrat
behavioral2/files/0x000f000000023bee-127.dat	dcrat
behavioral2/files/0x000d000000023b7b-173.dat	dcrat
behavioral2/files/0x0010000000023b7e-219.dat	dcrat
behavioral2/files/0x0009000000023ba9-244.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3276	powershell.exe
1996	powershell.exe
1512	powershell.exe
3916	powershell.exe
976	powershell.exe
4440	powershell.exe
2412	powershell.exe
3212	powershell.exe
2532	powershell.exe
4580	powershell.exe
2432	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe

Executes dropped EXE 8 IoCs

pid	Process
4736	OfficeClickToRun.exe
2588	OfficeClickToRun.exe
4264	OfficeClickToRun.exe
1600	OfficeClickToRun.exe
3784	OfficeClickToRun.exe
3880	OfficeClickToRun.exe
1672	OfficeClickToRun.exe
2828	OfficeClickToRun.exe

Drops file in Program Files directory 41 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files (x86)\Common Files\spoolsv.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files (x86)\Common Files\spoolsv.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\RCX9C71.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\dllhost.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\sihost.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files (x86)\Common Files\RCX9286.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files (x86)\Common Files\RCX9287.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\RCX975C.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\Uninstall Information\SppExtComObj.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\66fc9ff0ee96c2	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\5940a34987c991	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files\Common Files\DESIGNER\sppsvc.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXA147.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXA262.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files (x86)\Common Files\f3b6ecef712a24	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files\Uninstall Information\e1ef82546f0b02	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files\ModifiableWindowsApps\RuntimeBroker.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCX9051.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\RCX9C72.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\dllhost.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\RCXA891.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\RCXA90F.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\sppsvc.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\5b884080fd4f94	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files\Windows Portable Devices\RuntimeBroker.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\RCX976D.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files\Common Files\DESIGNER\0a1fd5f707cd16	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\WindowsPowerShell\RCX8A03.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCX8C27.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCX8C37.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCX9062.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files\WindowsPowerShell\e6c9b481da804f	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Program Files\Uninstall Information\SppExtComObj.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files\WindowsPowerShell\RCX8A02.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\SIGNUP\sihost.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\Help\SearchApp.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Windows\Prefetch\5b884080fd4f94	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\AppReadiness\RCX8E3D.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Media\Afternoon\RCX9519.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Help\RCXA67C.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Help\RCXA68C.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Help\SearchApp.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Windows\AppReadiness\ea9f0e6c9e2dcd	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Panther\setup.exe\RCXADB5.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Panther\setup.exe\csrss.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Prefetch\RCXAB13.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Windows\Media\Afternoon\OfficeClickToRun.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Windows\Media\Afternoon\e6c9b481da804f	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Windows\Panther\setup.exe\886983d96e3d3e	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\AppReadiness\RCX8E3C.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Media\Afternoon\RCX949B.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Media\Afternoon\OfficeClickToRun.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Prefetch\fontdrvhost.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Windows\AppReadiness\taskhostw.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Panther\setup.exe\RCXAE33.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\Prefetch\RCXAB34.tmp	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Windows\Prefetch\fontdrvhost.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Windows\Panther\setup.exe\csrss.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File opened for modification	C:\Windows\AppReadiness\taskhostw.exe	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
File created	C:\Windows\Help\38384e6a620884	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4820	schtasks.exe
1672	schtasks.exe
1968	schtasks.exe
2020	schtasks.exe
2320	schtasks.exe
264	schtasks.exe
1720	schtasks.exe
3356	schtasks.exe
816	schtasks.exe
1124	schtasks.exe
1788	schtasks.exe
2372	schtasks.exe
3252	schtasks.exe
4544	schtasks.exe
2072	schtasks.exe
840	schtasks.exe
3584	schtasks.exe
4736	schtasks.exe
624	schtasks.exe
216	schtasks.exe
1816	schtasks.exe
2336	schtasks.exe
3928	schtasks.exe
3656	schtasks.exe
1256	schtasks.exe
3640	schtasks.exe
4272	schtasks.exe
1628	schtasks.exe
4232	schtasks.exe
1112	schtasks.exe
2056	schtasks.exe
4712	schtasks.exe
3376	schtasks.exe
2416	schtasks.exe
4460	schtasks.exe
2860	schtasks.exe
4776	schtasks.exe
4548	schtasks.exe
1912	schtasks.exe
4860	schtasks.exe
4432	schtasks.exe
1012	schtasks.exe
1460	schtasks.exe
1080	schtasks.exe
1772	schtasks.exe
960	schtasks.exe
3960	schtasks.exe
3588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
1512	powershell.exe
1512	powershell.exe
4440	powershell.exe
4440	powershell.exe
3276	powershell.exe
3276	powershell.exe
4580	powershell.exe
4580	powershell.exe
1996	powershell.exe
1996	powershell.exe
3212	powershell.exe
3212	powershell.exe
2432	powershell.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	4736	OfficeClickToRun.exe
Token: SeDebugPrivilege	2588	OfficeClickToRun.exe
Token: SeDebugPrivilege	4264	OfficeClickToRun.exe
Token: SeDebugPrivilege	1600	OfficeClickToRun.exe
Token: SeDebugPrivilege	3784	OfficeClickToRun.exe
Token: SeDebugPrivilege	3880	OfficeClickToRun.exe
Token: SeDebugPrivilege	1672	OfficeClickToRun.exe
Token: SeDebugPrivilege	2828	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4580	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	132
PID 2064 wrote to memory of 4580	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	132
PID 2064 wrote to memory of 2432	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	133
PID 2064 wrote to memory of 2432	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	133
PID 2064 wrote to memory of 1996	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	134
PID 2064 wrote to memory of 1996	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	134
PID 2064 wrote to memory of 3916	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	135
PID 2064 wrote to memory of 3916	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	135
PID 2064 wrote to memory of 976	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	136
PID 2064 wrote to memory of 976	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	136
PID 2064 wrote to memory of 4440	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	137
PID 2064 wrote to memory of 4440	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	137
PID 2064 wrote to memory of 2412	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	138
PID 2064 wrote to memory of 2412	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	138
PID 2064 wrote to memory of 3212	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	139
PID 2064 wrote to memory of 3212	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	139
PID 2064 wrote to memory of 1512	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	140
PID 2064 wrote to memory of 1512	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	140
PID 2064 wrote to memory of 3276	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	141
PID 2064 wrote to memory of 3276	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	141
PID 2064 wrote to memory of 2532	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	142
PID 2064 wrote to memory of 2532	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	142
PID 2064 wrote to memory of 4736	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	154
PID 2064 wrote to memory of 4736	2064	8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe	154
PID 4736 wrote to memory of 4012	4736	OfficeClickToRun.exe	158
PID 4736 wrote to memory of 4012	4736	OfficeClickToRun.exe	158
PID 4736 wrote to memory of 3752	4736	OfficeClickToRun.exe	159
PID 4736 wrote to memory of 3752	4736	OfficeClickToRun.exe	159
PID 4012 wrote to memory of 2588	4012	WScript.exe	169
PID 4012 wrote to memory of 2588	4012	WScript.exe	169
PID 2588 wrote to memory of 3376	2588	OfficeClickToRun.exe	172
PID 2588 wrote to memory of 3376	2588	OfficeClickToRun.exe	172
PID 2588 wrote to memory of 2580	2588	OfficeClickToRun.exe	173
PID 2588 wrote to memory of 2580	2588	OfficeClickToRun.exe	173
PID 3376 wrote to memory of 4264	3376	WScript.exe	175
PID 3376 wrote to memory of 4264	3376	WScript.exe	175
PID 4264 wrote to memory of 1736	4264	OfficeClickToRun.exe	177
PID 4264 wrote to memory of 1736	4264	OfficeClickToRun.exe	177
PID 4264 wrote to memory of 3016	4264	OfficeClickToRun.exe	178
PID 4264 wrote to memory of 3016	4264	OfficeClickToRun.exe	178
PID 1736 wrote to memory of 1600	1736	WScript.exe	179
PID 1736 wrote to memory of 1600	1736	WScript.exe	179
PID 1600 wrote to memory of 816	1600	OfficeClickToRun.exe	181
PID 1600 wrote to memory of 816	1600	OfficeClickToRun.exe	181
PID 1600 wrote to memory of 1924	1600	OfficeClickToRun.exe	182
PID 1600 wrote to memory of 1924	1600	OfficeClickToRun.exe	182
PID 816 wrote to memory of 3784	816	WScript.exe	183
PID 816 wrote to memory of 3784	816	WScript.exe	183
PID 3784 wrote to memory of 432	3784	OfficeClickToRun.exe	185
PID 3784 wrote to memory of 432	3784	OfficeClickToRun.exe	185
PID 3784 wrote to memory of 5112	3784	OfficeClickToRun.exe	186
PID 3784 wrote to memory of 5112	3784	OfficeClickToRun.exe	186
PID 432 wrote to memory of 3880	432	WScript.exe	187
PID 432 wrote to memory of 3880	432	WScript.exe	187
PID 3880 wrote to memory of 2532	3880	OfficeClickToRun.exe	189
PID 3880 wrote to memory of 2532	3880	OfficeClickToRun.exe	189
PID 3880 wrote to memory of 3036	3880	OfficeClickToRun.exe	190
PID 3880 wrote to memory of 3036	3880	OfficeClickToRun.exe	190
PID 2532 wrote to memory of 1672	2532	WScript.exe	191
PID 2532 wrote to memory of 1672	2532	WScript.exe	191
PID 1672 wrote to memory of 2980	1672	OfficeClickToRun.exe	193
PID 1672 wrote to memory of 2980	1672	OfficeClickToRun.exe	193
PID 1672 wrote to memory of 4740	1672	OfficeClickToRun.exe	194
PID 1672 wrote to memory of 4740	1672	OfficeClickToRun.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe
"C:\Users\Admin\AppData\Local\Temp\8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe
  "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9f1b750-16e4-4136-bfaf-b6410e0ee62e.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe
      "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13151a7f-ba89-4039-88bb-fb2090ad027b.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3376
      - C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe
        
        "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96b4eeb9-3ba2-4fc1-bc82-ed9fed5e8501.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe
        
        "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4c8d92f-d411-4660-8f9b-88a01918f219.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe
        
        "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\335b84c7-7b71-43a1-b39b-79482c7fa7bb.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe
        
        "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d35a49f0-6c68-43ba-a912-faca5d745c91.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe
        
        "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\902452c6-0025-4fa6-9856-87678f91aa45.vbs"
        15⤵
        
        PID:2980
        
        C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe
        
        "C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db67d17a-2299-44e0-bbd1-08f7db81614b.vbs"
        17⤵
        
        PID:1020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad7a354f-43c8-4de5-8c63-7fbc76e3eb82.vbs"
        17⤵
        
        PID:1612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\538c5da6-65d1-433b-95f5-a2e09aa4ba1b.vbs"
        15⤵
        
        PID:4740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\baaa96ec-1513-4386-b223-458469b5c1dc.vbs"
        13⤵
        
        PID:3036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de08a2be-e9ab-4c39-a19e-a9ee34886a2e.vbs"
        11⤵
        
        PID:5112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1cb00820-f55b-44ad-9287-cd6969980dc5.vbs"
        9⤵
        
        PID:1924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42dcc173-0a69-4fd1-8e46-ef434556ce3a.vbs"
        7⤵
        
        PID:3016
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cea9c297-1d89-44a9-bae0-8a4d9f27ee9f.vbs"
        5⤵
        
        PID:2580
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9eed3a40-2efb-4b0a-a23a-6affb6c7e8f1.vbs"
    3⤵
    PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Windows\AppReadiness\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\AppReadiness\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Windows\AppReadiness\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Windows\Media\Afternoon\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Media\Afternoon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Windows\Media\Afternoon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Downloads\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Downloads\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\lua\extensions\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\extensions\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\lua\extensions\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\Help\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\DESIGNER\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\DESIGNER\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\Prefetch\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Prefetch\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\Prefetch\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Panther\setup.exe\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Panther\setup.exe\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\spoolsv.exe

Filesize
1.7MB

MD5
6c26f99f8cc5c28eedd98e866861d80d

SHA1
44d8cc809e4617152a9d8d2f0ff45991407d3ca4

SHA256
8c2d4a055d7bae0f75dbbb218f47693d189eac67ab7b9958fc24e437b5a1965b

SHA512
d460bd742c0044711dd64d656977d924fc67e5580277a5649b931dd07d1de8951f408a711091037e8b08a81c391bccc1a8388745455180791af6c2b66c1a2359

Download Submit
C:\Program Files\Common Files\DESIGNER\sppsvc.exe

Filesize
1.7MB

MD5
afb5beccc234c44f7b5d8f79f9d07d27

SHA1
7dbaac2779b0c5b12c37776d35f49ead9e8650d0

SHA256
6e8a79ab653d427abba3c9b28ffa3c5f2ae32c1907c9540d493f5be37e6abf7a

SHA512
eeb1791182aa839b2c06e2417eadc24345c3ecbd8406f2f62b9eef89ea23dd3b16134322c6332099258332503b0c45c3364cc5acc069979b0c94d615c97e9ffd

Download Submit
C:\Recovery\WindowsRE\sysmon.exe

Filesize
1.7MB

MD5
c1c68b29b5cb81fe0e9600bc40200dc6

SHA1
f3f5d8825df21846b0b4dfb66fcc8efe73036146

SHA256
6b8705a1aedb3745995cae19cc71a0417408580e21d645b37449a23620da3dee

SHA512
1ee619d68dd6489cc6bb54d04994ae2eddd0667c5d1311759cd54bdff3bdd1219b1947a905e675f7f56f62b46e202f6994a75e4d05dd2e38cf8fcc2ea210c569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OfficeClickToRun.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\13151a7f-ba89-4039-88bb-fb2090ad027b.vbs

Filesize
731B

MD5
7a793aef6b36dcf5f86bf197a3f77912

SHA1
9676164562b9b7b055af5e14419904ec07ec9294

SHA256
ace9633d441a000d81a4c40abf3cad5b0449dbdef8f4cd22d7c6ba2677aee557

SHA512
321ac7a90347da8b792d0173c851179a34e4f3eecb017c277a353778370058a8c149fb0fccc3a10cfa8a571d0ce4d8d25d51e7bfe90341d2a3c5688cd75c34b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\335b84c7-7b71-43a1-b39b-79482c7fa7bb.vbs

Filesize
731B

MD5
77c1f1b579c4cc6514dbea325519f885

SHA1
0a2a88d614d06c83a54b4b87d4c65b2986d98567

SHA256
d4da5583dddf927f641fa7550b3aef0e9f8cea05d21a816d5c080c67eb764083

SHA512
0a2e4bbc50a4beddd4c961929e896c775f330cf8d0da2c48974a421a24105b44b5ecb4c18a5d3e33fb809704648bc9a8011ad8991d74bcda248cfc89f191e646

Download Submit
C:\Users\Admin\AppData\Local\Temp\902452c6-0025-4fa6-9856-87678f91aa45.vbs

Filesize
731B

MD5
d92b9491e48a29ce3bc6cc95753b9fc9

SHA1
59e48231f919c41e5d1deb451ac811e299210f8e

SHA256
7299a9cc6a217581d1c349bce8eb7a02096cc35b97f442242bee430236400b61

SHA512
a9e070a4906bbcd850c04a73fc972dac3474aaff804c09dab202668f05f78ae597fcd1f43d5195b6047dcbf24aff8ce5e5ded089760aa5be397111b958373f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\96b4eeb9-3ba2-4fc1-bc82-ed9fed5e8501.vbs

Filesize
731B

MD5
5fd91b92b65533c1b66fb2e6850ecc0c

SHA1
255d991f3a7a2a68d708b01f954bfb8dde7cc6c7

SHA256
18a6dc083bd3c0fdabfcf9e798f713f43ee2bac6d33468f9fa9ac13b91f251ab

SHA512
45d5d2ba1d998cc85a1d59f00141012aaed640b36d5aad5a84fc4126c4a4601f557def9edf3a848d9403defe94d5bda0e8617d282901ca616957c5c3854885c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\9eed3a40-2efb-4b0a-a23a-6affb6c7e8f1.vbs

Filesize
507B

MD5
9282b43b31599ff448d6c2ff885e2186

SHA1
287056da1ed9220d41a919fe14afb7e59aeecb1f

SHA256
09e368625f17ed57b8a3b642a6b327c63f4090df17d3e9b4071d0e8b44dc2acb

SHA512
ec8a2543e671ffc32dcd8aa2246130a39105459d4afaeff5568974740f7fe0163ca91ca46da254899ed0c528de0ea7ec6b59d481f2b9a182ac137e8818d8bd89

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_daseq4pp.u1s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d35a49f0-6c68-43ba-a912-faca5d745c91.vbs

Filesize
731B

MD5
fd7d2d24d66c8a499647dbd38c887e63

SHA1
208a64cbd80f46110c28f1df13b532f6d0f4d198

SHA256
39c57bf10bb21276b716a40625c7b6806e362c78ff94b52bbe19843a03433356

SHA512
2ba9248d30dc747c951b9b1bf3d61e44097bb0c7479ac0f66b03daba5d85d217f3ba9fc0a45536e153e07f4ff42a9d3de6294a23a0d909d9202ab7504609b90f

Download Submit
C:\Users\Admin\AppData\Local\Temp\db67d17a-2299-44e0-bbd1-08f7db81614b.vbs

Filesize
731B

MD5
c6dae730bc42c228d9608c626adbf1dd

SHA1
6c328eea4a466bec85b53f746afb54c6577267cf

SHA256
21932650bebe7c14f76c1c988c6070e05d49beae8ff848d58bf430fa0f13143b

SHA512
feadc91b09f67999a22ee65d269942ad7d370d105925b56d5770a63da3f1035de6e177e0b68107300c581154e8f607c567aee8f6016120d467ca5e363867dd8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\e9f1b750-16e4-4136-bfaf-b6410e0ee62e.vbs

Filesize
731B

MD5
5f7c876c0ed7c938ca1a602946fe4c15

SHA1
8f3e0706c5becc55eb5a5c84fbd5b3c87f189b23

SHA256
be41f419d3561024d98ce46023cacc2ad0186ccc0ed580bd00906d04d42554c3

SHA512
3487714c99ceb980afe78868baab05f28a4b847f68f7b853168b235b6c74d7bd05793463d3275df612af5c8cfa97ea4a64f8c56266c3bd081a743cb9592bb1e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\f4c8d92f-d411-4660-8f9b-88a01918f219.vbs

Filesize
731B

MD5
2b060f8f8f56bfe29ca92303f26ce541

SHA1
1dbd03886722ae62a91b3acbda9a91ed7df3d68f

SHA256
05fde25cdd0e0a1a99a83d48327d7294b1a9ecab0f6f5146319c5976be2a1d05

SHA512
73b53b1c574a844249767c06669377718a42d054147a4517b205b8b8f761a11ab1f20924ac8df52bebed504a032bc1b5f613464621c8b1aba2bbb5f1432b2dc2

Download Submit
C:\Windows\Media\Afternoon\OfficeClickToRun.exe

Filesize
1.7MB

MD5
69304dfb5d3b5e88ae796fae84223f2d

SHA1
d465a81717ab66b7b078a3a69f043d0796c40e56

SHA256
2adaa8b547102ef160403bdf0c158b759157df35cf1cff5a168a56dfd1db4d97

SHA512
d86c2f9d608d299d282a75865f54c6a3a6254a606fd7b3b2ab8f6abcfe4fe069161e39d2f3401ee3ef358690f9e62e1af7d953e984ea84299746aeb7fb1df28f

Download Submit
C:\Windows\Panther\setup.exe\csrss.exe

Filesize
1.7MB

MD5
2823236990701ea125ebc556cb8b77ac

SHA1
04da6b3c850f9cda70c2b6e24a9542b7130d8cfd

SHA256
c09f8de009b56dfe818203b2a3cb913ff8fbc85862d79aa6ffbc0e73364d9002

SHA512
b39b3fdde826c70c6dc84b31f631250130e88344e4519c42ce29df0ec8e17ea9496711b0a0331821af1d68bd8caf3b6253c7496fa470d1228babc3ba2d16946a

Download Submit
memory/2064-13-0x000000001BD70000-0x000000001C298000-memory.dmp

Filesize
5.2MB

Download
memory/2064-3-0x0000000000E90000-0x0000000000EAC000-memory.dmp

Filesize
112KB

Download
memory/2064-164-0x00007FFB10BC3000-0x00007FFB10BC5000-memory.dmp

Filesize
8KB

Download
memory/2064-22-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download
memory/2064-176-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download
memory/2064-19-0x000000001BA90000-0x000000001BA9C000-memory.dmp

Filesize
48KB

Download
memory/2064-224-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download
memory/2064-15-0x000000001B950000-0x000000001B95A000-memory.dmp

Filesize
40KB

Download
memory/2064-1-0x0000000000360000-0x0000000000520000-memory.dmp

Filesize
1.8MB

Download
memory/2064-17-0x000000001B970000-0x000000001B978000-memory.dmp

Filesize
32KB

Download
memory/2064-407-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download
memory/2064-2-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download
memory/2064-18-0x000000001BA80000-0x000000001BA8C000-memory.dmp

Filesize
48KB

Download
memory/2064-16-0x000000001B960000-0x000000001B96E000-memory.dmp

Filesize
56KB

Download
memory/2064-14-0x000000001B840000-0x000000001B84C000-memory.dmp

Filesize
48KB

Download
memory/2064-0-0x00007FFB10BC3000-0x00007FFB10BC5000-memory.dmp

Filesize
8KB

Download
memory/2064-12-0x000000001B7C0000-0x000000001B7D2000-memory.dmp

Filesize
72KB

Download
memory/2064-10-0x000000001B7B0000-0x000000001B7B8000-memory.dmp

Filesize
32KB

Download
memory/2064-9-0x000000001B7A0000-0x000000001B7AC000-memory.dmp

Filesize
48KB

Download
memory/2064-8-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/2064-6-0x0000000002780000-0x0000000002790000-memory.dmp

Filesize
64KB

Download
memory/2064-7-0x000000001B780000-0x000000001B796000-memory.dmp

Filesize
88KB

Download
memory/2064-23-0x00007FFB10BC0000-0x00007FFB11681000-memory.dmp

Filesize
10.8MB

Download
memory/2064-4-0x000000001B7D0000-0x000000001B820000-memory.dmp

Filesize
320KB

Download
memory/2064-5-0x0000000000EC0000-0x0000000000EC8000-memory.dmp

Filesize
32KB

Download
memory/2588-444-0x0000000002C10000-0x0000000002C22000-memory.dmp

Filesize
72KB

Download
memory/2828-511-0x000000001B170000-0x000000001B182000-memory.dmp

Filesize
72KB

Download
memory/3276-303-0x0000024D2BBA0000-0x0000024D2BBC2000-memory.dmp

Filesize
136KB

Download
memory/4736-408-0x000000001B900000-0x000000001B912000-memory.dmp

Filesize
72KB

Download