quasar | e47acb3d30adf4cb18e55c30443ab216a5d4315cdc02794746e4b6977ec624c3

Analysis

max time kernel
23s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2025 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

downloader.exe
Size

30.1MB
MD5

8899d3d18991b5e27efe1decbac510be
SHA1

c7cce46e9bda1a1d3493188979179fbf3bcc7d02
SHA256

e47acb3d30adf4cb18e55c30443ab216a5d4315cdc02794746e4b6977ec624c3
SHA512

b504dab38978feeb4622588a9e890c29d790110bda323c861a5a4326a46180b23abd589104b3d501805a57499d9705627cdb6f835d869ed91fca2007831ec260
SSDEEP

393216:R8oimu7izBxR3QRzhzvQ99Sq8lu0q5tDJKoWSxJGBL7aSmo+AJCcLKA5:R9w9wD5xUeSbJCcB

Score

10^/10

quasar xworm office04 execution persistence rat spyware trojan

Malware Config

Extracted

Family

xworm

Version

3.1

83.38.24.1:1603

Attributes

Install_directory
%Userprofile%
install_file
USB.exe

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

127.0.0.1:4782

Mutex

5d77ad29-ecbd-4889-b064-98ac5cd07b21

Attributes

encryption_key
14A7D36CBBFB811517C2A6A1D4EE850D361BB150
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Detect Xworm Payload 10 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b78-11.dat	family_xworm
behavioral2/files/0x000a000000023b79-29.dat	family_xworm
behavioral2/files/0x000a000000023b7a-33.dat	family_xworm
behavioral2/files/0x000a000000023b7c-57.dat	family_xworm
behavioral2/files/0x000a000000023b7b-55.dat	family_xworm
behavioral2/memory/692-65-0x0000000000FC0000-0x0000000000FE4000-memory.dmp	family_xworm
behavioral2/memory/1312-66-0x0000000000F70000-0x0000000000FB2000-memory.dmp	family_xworm
behavioral2/memory/2260-67-0x0000000000860000-0x0000000000884000-memory.dmp	family_xworm
behavioral2/memory/2192-42-0x0000000000E70000-0x0000000000EA0000-memory.dmp	family_xworm
behavioral2/memory/2984-38-0x0000000000EC0000-0x0000000000EEA000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b6c-71.dat	family_quasar
behavioral2/memory/1212-77-0x0000000000080000-0x00000000003A4000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3868	powershell.exe
2116	powershell.exe
3848	powershell.exe
4732	powershell.exe
3828	powershell.exe
4052	powershell.exe
1172	powershell.exe
408	powershell.exe
4476	powershell.exe
4824	powershell.exe
1800	powershell.exe
3040	powershell.exe
3440	powershell.exe
1480	powershell.exe
4408	powershell.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	notepad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	notepad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	SearchFilterHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	OneDrive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	SecurityHealthSystray.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	regedit.exe

Drops startup file 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	WmiPrvSE.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	WmiPrvSE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchFilterHost.lnk	SearchFilterHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchFilterHost.lnk	SearchFilterHost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	SecurityHealthSystray.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regedit.lnk	regedit.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regedit.lnk	regedit.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	SecurityHealthSystray.exe

Executes dropped EXE 14 IoCs

pid	Process
1884	notepad.exe
2192	OneDrive.exe
2984	SearchFilterHost.exe
1312	SecurityHealthSystray.exe
692	WmiPrvSE.exe
2260	regedit.exe
1212	client-built.exe
3360	notepad.exe
4796	OneDrive.exe
4248	SearchFilterHost.exe
4664	SecurityHealthSystray.exe
4032	WmiPrvSE.exe
1564	regedit.exe
1532	Client.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchFilterHost = "C:\\Users\\Admin\\SearchFilterHost.exe"	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\Users\\Admin\\OneDrive.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\ProgramData\\SecurityHealthSystray.exe"	SecurityHealthSystray.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit = "C:\\Users\\Public\\regedit.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\ProgramData\\WmiPrvSE.exe"	WmiPrvSE.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Runs regedit.exe 2 IoCs

pid	Process
2260	regedit.exe
1564	regedit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2876	schtasks.exe
2444	schtasks.exe
2688	schtasks.exe
2332	schtasks.exe
3312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
1172	powershell.exe
4824	powershell.exe
4052	powershell.exe
3848	powershell.exe
3848	powershell.exe
3868	powershell.exe
3868	powershell.exe
4824	powershell.exe
4824	powershell.exe
1172	powershell.exe
4052	powershell.exe
4052	powershell.exe
1172	powershell.exe
3848	powershell.exe
3868	powershell.exe
408	powershell.exe
408	powershell.exe
1800	powershell.exe
3040	powershell.exe
3040	powershell.exe
3440	powershell.exe
1480	powershell.exe
1800	powershell.exe
3440	powershell.exe
1480	powershell.exe
4732	powershell.exe
4476	powershell.exe
4408	powershell.exe
2116	powershell.exe
3828	powershell.exe
2116	powershell.exe
3828	powershell.exe
4732	powershell.exe
4476	powershell.exe
4408	powershell.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	SearchFilterHost.exe
Token: SeDebugPrivilege	2192	OneDrive.exe
Token: SeDebugPrivilege	692	WmiPrvSE.exe
Token: SeDebugPrivilege	1312	SecurityHealthSystray.exe
Token: SeDebugPrivilege	2260	regedit.exe
Token: SeDebugPrivilege	1212	client-built.exe
Token: SeDebugPrivilege	4248	SearchFilterHost.exe
Token: SeDebugPrivilege	4664	SecurityHealthSystray.exe
Token: SeDebugPrivilege	4796	OneDrive.exe
Token: SeDebugPrivilege	1564	regedit.exe
Token: SeDebugPrivilege	4032	WmiPrvSE.exe
Token: SeDebugPrivilege	1532	Client.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	692	WmiPrvSE.exe
Token: SeDebugPrivilege	2260	regedit.exe
Token: SeDebugPrivilege	2192	OneDrive.exe
Token: SeDebugPrivilege	2984	SearchFilterHost.exe
Token: SeDebugPrivilege	1312	SecurityHealthSystray.exe
Token: SeDebugPrivilege	516	taskmgr.exe
Token: SeSystemProfilePrivilege	516	taskmgr.exe
Token: SeCreateGlobalPrivilege	516	taskmgr.exe
Token: 33	516	taskmgr.exe
Token: SeIncBasePriorityPrivilege	516	taskmgr.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1532	Client.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
1532	Client.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe
516	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4916	1468	downloader.exe	83
PID 1468 wrote to memory of 4916	1468	downloader.exe	83
PID 4916 wrote to memory of 1884	4916	cmd.exe	84
PID 4916 wrote to memory of 1884	4916	cmd.exe	84
PID 1884 wrote to memory of 2192	1884	notepad.exe	85
PID 1884 wrote to memory of 2192	1884	notepad.exe	85
PID 1884 wrote to memory of 2984	1884	notepad.exe	86
PID 1884 wrote to memory of 2984	1884	notepad.exe	86
PID 1884 wrote to memory of 1312	1884	notepad.exe	87
PID 1884 wrote to memory of 1312	1884	notepad.exe	87
PID 1884 wrote to memory of 692	1884	notepad.exe	88
PID 1884 wrote to memory of 692	1884	notepad.exe	88
PID 1884 wrote to memory of 2260	1884	notepad.exe	89
PID 1884 wrote to memory of 2260	1884	notepad.exe	89
PID 1468 wrote to memory of 3396	1468	downloader.exe	90
PID 1468 wrote to memory of 3396	1468	downloader.exe	90
PID 1468 wrote to memory of 116	1468	downloader.exe	91
PID 1468 wrote to memory of 116	1468	downloader.exe	91
PID 3396 wrote to memory of 1212	3396	cmd.exe	92
PID 3396 wrote to memory of 1212	3396	cmd.exe	92
PID 116 wrote to memory of 3360	116	cmd.exe	93
PID 116 wrote to memory of 3360	116	cmd.exe	93
PID 3360 wrote to memory of 4796	3360	notepad.exe	94
PID 3360 wrote to memory of 4796	3360	notepad.exe	94
PID 3360 wrote to memory of 4248	3360	notepad.exe	95
PID 3360 wrote to memory of 4248	3360	notepad.exe	95
PID 3360 wrote to memory of 4664	3360	notepad.exe	96
PID 3360 wrote to memory of 4664	3360	notepad.exe	96
PID 3360 wrote to memory of 4032	3360	notepad.exe	97
PID 3360 wrote to memory of 4032	3360	notepad.exe	97
PID 3360 wrote to memory of 1564	3360	notepad.exe	98
PID 3360 wrote to memory of 1564	3360	notepad.exe	98
PID 1212 wrote to memory of 1532	1212	client-built.exe	99
PID 1212 wrote to memory of 1532	1212	client-built.exe	99
PID 2984 wrote to memory of 4824	2984	SearchFilterHost.exe	100
PID 2984 wrote to memory of 4824	2984	SearchFilterHost.exe	100
PID 2192 wrote to memory of 4052	2192	OneDrive.exe	101
PID 2192 wrote to memory of 4052	2192	OneDrive.exe	101
PID 1312 wrote to memory of 1172	1312	SecurityHealthSystray.exe	103
PID 1312 wrote to memory of 1172	1312	SecurityHealthSystray.exe	103
PID 692 wrote to memory of 3848	692	WmiPrvSE.exe	106
PID 692 wrote to memory of 3848	692	WmiPrvSE.exe	106
PID 2260 wrote to memory of 3868	2260	regedit.exe	108
PID 2260 wrote to memory of 3868	2260	regedit.exe	108
PID 2984 wrote to memory of 408	2984	SearchFilterHost.exe	110
PID 2984 wrote to memory of 408	2984	SearchFilterHost.exe	110
PID 1312 wrote to memory of 1800	1312	SecurityHealthSystray.exe	111
PID 1312 wrote to memory of 1800	1312	SecurityHealthSystray.exe	111
PID 2192 wrote to memory of 3040	2192	OneDrive.exe	114
PID 2192 wrote to memory of 3040	2192	OneDrive.exe	114
PID 692 wrote to memory of 3440	692	WmiPrvSE.exe	116
PID 692 wrote to memory of 3440	692	WmiPrvSE.exe	116
PID 2260 wrote to memory of 1480	2260	regedit.exe	118
PID 2260 wrote to memory of 1480	2260	regedit.exe	118
PID 2984 wrote to memory of 4476	2984	SearchFilterHost.exe	120
PID 2984 wrote to memory of 4476	2984	SearchFilterHost.exe	120
PID 2192 wrote to memory of 4732	2192	OneDrive.exe	122
PID 2192 wrote to memory of 4732	2192	OneDrive.exe	122
PID 1312 wrote to memory of 4408	1312	SecurityHealthSystray.exe	124
PID 1312 wrote to memory of 4408	1312	SecurityHealthSystray.exe	124
PID 2260 wrote to memory of 2116	2260	regedit.exe	126
PID 2260 wrote to memory of 2116	2260	regedit.exe	126
PID 692 wrote to memory of 3828	692	WmiPrvSE.exe	128
PID 692 wrote to memory of 3828	692	WmiPrvSE.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\downloader.exe
"C:\Users\Admin\AppData\Local\Temp\downloader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\notepad.exe
    "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
      "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDrive.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\OneDrive.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\OneDrive.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
      "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2984
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SearchFilterHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\SearchFilterHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4476
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SearchFilterHost" /tr "C:\Users\Admin\SearchFilterHost.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\SecurityHealthSystray.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\ProgramData\SecurityHealthSystray.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
      "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3828
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WmiPrvSE" /tr "C:\ProgramData\WmiPrvSE.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\regedit.exe
      "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Runs regedit.exe
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\regedit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'regedit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\regedit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "regedit" /tr "C:\Users\Public\regedit.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\client-built.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Users\Admin\AppData\Local\Temp\client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\client-built.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\notepad.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Users\Admin\AppData\Local\Temp\notepad.exe
    "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
      "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe
      "C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe
      "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe
      "C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\regedit.exe
      "C:\Users\Admin\AppData\Local\Temp\regedit.exe"
      4⤵
      Executes dropped EXE
      Runs regedit.exe
      Suspicious use of AdjustPrivilegeToken
      PID:1564

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\notepad.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
26d1fec9e388575d80909a1dca1ceba9

SHA1
28e327409057f4672fa33689842c1dfd3648ebed

SHA256
c89e1ff1a53f08364fcdea6aa526e0ba2dd8d2469bcd4dd335b01d96f5860dbd

SHA512
61b4c0204b8ded349f63e2352cf073f731730a78f6a7ab4a447d6481af69157b19f6797b99672220dcf0bfb7a40fd5f76b910a4e316482a767ef18e719e4b39e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9072d3c4faa83ef0f5ed5b299b75618d

SHA1
f2bb8ee12abae6da1406fc566810ce397f1d054b

SHA256
9f9196488c5ae1227d43941675252f2399ef20aebba80ed6a829822104c40475

SHA512
a7bb981438e7d0932291531f49c00ca2b57a5c44cedede2b81f5a6abeefb4f00434e0c2edb2d3ad33c21e61e88091042f9d783f9fd39b18cfd1306b450f1f6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
47605a4dda32c9dff09a9ca441417339

SHA1
4f68c895c35b0dc36257fc8251e70b968c560b62

SHA256
e6254c2bc9846a76a4567ab91b6eae76e937307ff9301b65d577ffe6e15fe40a

SHA512
b6823b6e794a2fe3e4c4ecfb3f0d61a54821de7feb4f9e3e7fd463e7fbb5e6848f59865b487dafebeac431e4f4db81ef56836d94cac67da39852c566ed34a885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e2efbfd23e33d8d07d019bdd9ca20649

SHA1
68d3b285c423d311bdf8dc53354f5f4000caf386

SHA256
f4386e3a103dafd6e85bebc2ad649069d168b4da8a0ded51b3ec96fa1408a828

SHA512
b7a961002557ff2efb785f756c9347e250392eab3dcb5168c67e89238e85368a41d0a5bdc94bfbbc192ba427c83e982234b3cf8824b166a69973f3f9df177443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
87710d90c6f6fd01fd6c58ed33b40b08

SHA1
16f74fba4891c24d5dde0c2911d39bbee5a059e3

SHA256
9da5fe088f7f3da66368c88020cd77b42dc817c97631c0dabce87a39d706eef6

SHA512
b0afd32e7eb777f16f27b15820d93ec811a095b8a67827c4ae4e81018cae5d5dca84f21b58bb0f79eeaa8d9fde3f6fe816aa2a92b6603ba2e66960b60943faef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5cfe303e798d1cc6c1dab341e7265c15

SHA1
cd2834e05191a24e28a100f3f8114d5a7708dc7c

SHA256
c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab

SHA512
ef151bbe0033a2caf2d40aff74855a3f42c8171e05a11c8ce93c7039d9430482c43fe93d9164ee94839aff253cad774dbf619dde9a8af38773ca66d59ac3400e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneDrive.exe

Filesize
163KB

MD5
abd4141118794cd94979dc12bcded7b7

SHA1
27b11caedb23ea8dab4f36f5865a96e6e7f55806

SHA256
be9f4292935c19f00dcf2a6e09bc63f50cf7caad0d8ea0a45ed7bf86fb14e904

SHA512
d4ddda6b8ac66683e78b78360326ee50edf5edc8278a2f82e414545d4dd2a3d5e4269fe1dd884926b2e6d7e52af030f0b66fcca50cad77b8a31837ff482c4809

Download Submit
C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe

Filesize
145KB

MD5
40324e8a46ec891bcb5300f51ddfc335

SHA1
bc5c53d890371bd472c707da8e84c3925bf077d5

SHA256
cc7bcd68ad32d8490fd2d5217b5bace0068a7ebf96831f0373d88e27e6a3ff2c

SHA512
5b2c618234a6b14ea377604f08dd3c6f193be4f593f18b38ff9a3b88f939d61934c3ec4efca91ff98791051eeb79a53315168bfa0fe8466b60249f3bde9b86de

Download Submit
C:\Users\Admin\AppData\Local\Temp\SecurityHealthSystray.exe

Filesize
243KB

MD5
f32ac010fcdbc8f8a5582c339ec9d9ea

SHA1
20c06c5a174504c4e28c9aa0b51a62ab8f5c70cb

SHA256
88835382ffaf3f7f0730a0a7edab3d3214cbbfdbc35e7269b80a6bd05b7edd18

SHA512
9798b196315a1e463105b811a0937f763ae21826fa9bd9f346059b5f0a573d48a6f4ed7174fb4551a4ae7ccd089c9cae90c30b38ef6e7c12e896138a0fcaa8f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\WmiPrvSE.exe

Filesize
124KB

MD5
16caf66537fe87d8d9b6a4eb34d9dbff

SHA1
4a399f4229ea5b27963d467223fd4ceb89e545f5

SHA256
64cc787990be5cdc1c25f5cdbfd2a0e93d4c68a888fefa0b7e2b0d12cea4de26

SHA512
a034dba721d36b5396dbe08a581d06c692c84edb0946e45073a8e3eb78a685ad42011b8ffa970190e673e94350dc1feef8d8f51908b53bc23a80536f75bba9d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_urmxatxj.bwu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\client-built.exe

Filesize
3.1MB

MD5
922dfa5768bf5f40fb68a2d3f5abf03a

SHA1
102aa0337ecd202b5104169dc63b8c52ef443d23

SHA256
9320ff49d07d2ebcaf26397c25baecd2430c8bdcc12cdec472f38033d59db79b

SHA512
64c2023e33b66f0adb0c096eba223f3546760c0a9e35bafe15495c9e003a19afc51982387afbc0efd44f54d43accc00734127511919d52bb3cd5cccc52ccde72

Download Submit
C:\Users\Admin\AppData\Local\Temp\notepad.exe

Filesize
909KB

MD5
74b16801ca2365d3b29e6194237c665a

SHA1
9d172c5a08c68e8134eaad60063071662afd5057

SHA256
8716b0aec344d67da46449589ef1d169b42e0f038ba28392825b10a611a0fb3f

SHA512
8201c89ce2e7eab9b5bfe3f8da956c73604261e83a3bf5d267be6a9b44790ec714e22a0ddfbc9fd009395893ef68864e5fac54172aceb568aec2270de6700567

Download Submit
C:\Users\Admin\AppData\Local\Temp\regedit.exe

Filesize
121KB

MD5
005b549e8fa8f966d1c0ce845cfaffce

SHA1
4dc69fa135bec170229863f4d7320b402698cef1

SHA256
8befb7faacdffeb7dd84b629ec7066ed1baf3947a6ed8c1ac8432335e3b2828b

SHA512
1169ec7a0628a03ecb8a924527fa03dd0d391f9d0bf2a537e9ee7022265bfeba57b85759507fbc4962f10a5f43f2ea86d8c18cbf00aa8f5b9a2323174a9663ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk

Filesize
783B

MD5
ea731b3c63011aa76aeb648e7a371bd4

SHA1
32b5c968df4f9d8aacf668932a510d6ef2064c9f

SHA256
e5673f9ea294ea420991e36b1d6adc07675c6ec4b86b9c95f08b42239dc4065e

SHA512
45b311ec0e45813f325c2fcf2053f3f008f38672b623297545529b9b43d5009b23cb51531057db50451f6fb5257f1894fce9ac86b35374e2fa56458a6fa5395a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchFilterHost.lnk

Filesize
823B

MD5
f6f2c6c8d642c74ca1909db855fa8c19

SHA1
9a40753376978cb8335d653d617cd88e252707c0

SHA256
b152a541fc6b16e3c5228f601707ba4419982ed42b11fd80778a07ac8682b7c2

SHA512
bfcc86ea730c00ef15eddc70b06b10abd8840082111e4e888b0902069d6522eee7dfbd270f80234840058e72c4c2127c9013a6a133f17f54fcc97a424c037c6f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk

Filesize
742B

MD5
ea0550ac4a61c6081bde1c7cda359da5

SHA1
d72e398408e4c0e6f9071938df58e9876b476e01

SHA256
c7b273de8f744db5a181da8264e86a936d61dd13f45196d6a91d47ed5033edc8

SHA512
3ffabcc85a4e8996295a1784cc78bb7f9a797fb9cc9ee2f071c3623904be0df45afa27086e809e8055f477c9b9fa2b7a4f56eaae56eb4ec16ab2179c03ad7f5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk

Filesize
677B

MD5
9fb39dadb8603b6a4f9eb8d23087b745

SHA1
6ba9d16b824c5beaec1cd5c3feea88c5746429d5

SHA256
d63cbaf705c711ce5613bc85bb642bb413bb2807684670a9cacff6d538cd085e

SHA512
15f2b0735b918a04e80e11535e843de89c038e77f50c17ff3b3b1c2942cb401bca5a7acec0c7e487c03e7a5b69f5b33f257f72d236ac1761b08653c50ac297ba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regedit.lnk

Filesize
984B

MD5
cf390c6ea2b6c8c5673c99fd3948b729

SHA1
34cd9fcba050396785890529c78b5473ab258350

SHA256
e1fd7c20c01565c64c5cf180f501bd0fd9c8d0656b0a53ed246b179b68cb38b3

SHA512
1260a2557d4130543faa088e1ee956f9bdbf95e025129f3049d128c8d009da1ec90d0a6d92667156292cb3039cbfec892070eafebfebe21837ce50dad33f55b2

Download Submit
memory/516-304-0x0000025F5DA30000-0x0000025F5DA31000-memory.dmp

Filesize
4KB

Download
memory/516-312-0x0000025F5DA30000-0x0000025F5DA31000-memory.dmp

Filesize
4KB

Download
memory/516-308-0x0000025F5DA30000-0x0000025F5DA31000-memory.dmp

Filesize
4KB

Download
memory/516-309-0x0000025F5DA30000-0x0000025F5DA31000-memory.dmp

Filesize
4KB

Download
memory/516-310-0x0000025F5DA30000-0x0000025F5DA31000-memory.dmp

Filesize
4KB

Download
memory/516-311-0x0000025F5DA30000-0x0000025F5DA31000-memory.dmp

Filesize
4KB

Download
memory/516-302-0x0000025F5DA30000-0x0000025F5DA31000-memory.dmp

Filesize
4KB

Download
memory/516-303-0x0000025F5DA30000-0x0000025F5DA31000-memory.dmp

Filesize
4KB

Download
memory/516-313-0x0000025F5DA30000-0x0000025F5DA31000-memory.dmp

Filesize
4KB

Download
memory/516-314-0x0000025F5DA30000-0x0000025F5DA31000-memory.dmp

Filesize
4KB

Download
memory/692-65-0x0000000000FC0000-0x0000000000FE4000-memory.dmp

Filesize
144KB

Download
memory/1212-77-0x0000000000080000-0x00000000003A4000-memory.dmp

Filesize
3.1MB

Download
memory/1312-66-0x0000000000F70000-0x0000000000FB2000-memory.dmp

Filesize
264KB

Download
memory/1532-88-0x000000001C140000-0x000000001C190000-memory.dmp

Filesize
320KB

Download
memory/1532-89-0x000000001C250000-0x000000001C302000-memory.dmp

Filesize
712KB

Download
memory/1884-6-0x0000000000270000-0x0000000000358000-memory.dmp

Filesize
928KB

Download
memory/1884-5-0x00007FFA2F173000-0x00007FFA2F175000-memory.dmp

Filesize
8KB

Download
memory/2192-42-0x0000000000E70000-0x0000000000EA0000-memory.dmp

Filesize
192KB

Download
memory/2260-67-0x0000000000860000-0x0000000000884000-memory.dmp

Filesize
144KB

Download
memory/2984-38-0x0000000000EC0000-0x0000000000EEA000-memory.dmp

Filesize
168KB

Download
memory/4824-99-0x0000026F37BD0000-0x0000026F37BF2000-memory.dmp

Filesize
136KB

Download