dcrat | 2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
Size

1.7MB
MD5

46702766a2b352b3db95618c69a14526
SHA1

0c2c1e90dc69c16e2b09b705f6914b2372431a59
SHA256

2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9
SHA512

e1f84e854034293444f0f3ce562816e3f011ec58008f3601e00a7cf7125fc29c2f965fad7a59498d4d96b941006f20a4dcbb3373b325cd9fb6018cfa2aefc06e
SSDEEP

49152:z+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKv:eTHUxUoh1IF9gl2

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	4108	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	4108	schtasks.exe	85

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4832-1-0x0000000000F60000-0x0000000001120000-memory.dmp	dcrat
behavioral2/files/0x0007000000023cc6-30.dat	dcrat
behavioral2/files/0x0008000000023cc4-94.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2016	powershell.exe
2928	powershell.exe
5076	powershell.exe
4408	powershell.exe
3552	powershell.exe
1196	powershell.exe
1884	powershell.exe
4144	powershell.exe
2400	powershell.exe
1932	powershell.exe
1372	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	unsecapp.exe

Executes dropped EXE 9 IoCs

pid	Process
4912	unsecapp.exe
764	unsecapp.exe
1624	unsecapp.exe
1872	unsecapp.exe
4424	unsecapp.exe
1612	unsecapp.exe
1124	unsecapp.exe
4912	unsecapp.exe
4868	unsecapp.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\Updates\RCXB367.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXBCB5.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\RCXB151.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\RCXB57C.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\RCXB150.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files\Microsoft Office\Updates\csrss.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\smss.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\csrss.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\smss.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXBCB6.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\sppsvc.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\0a1fd5f707cd16	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\69ddcba757bf72	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\RCXB366.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\RCXB57B.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\sppsvc.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files\Microsoft Office\Updates\886983d96e3d3e	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\DiagTrack\unsecapp.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Windows\DiagTrack\29c1c3cc0f7685	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Windows\DiagTrack\RCXB790.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Windows\DiagTrack\RCXB791.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Windows\DiagTrack\unsecapp.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	unsecapp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1624	schtasks.exe
4676	schtasks.exe
4320	schtasks.exe
4208	schtasks.exe
3024	schtasks.exe
2136	schtasks.exe
2932	schtasks.exe
3988	schtasks.exe
4040	schtasks.exe
4896	schtasks.exe
2720	schtasks.exe
1044	schtasks.exe
900	schtasks.exe
1820	schtasks.exe
3948	schtasks.exe
2768	schtasks.exe
412	schtasks.exe
1104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4144	powershell.exe
4144	powershell.exe
3552	powershell.exe
3552	powershell.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1932	powershell.exe
1932	powershell.exe
1884	powershell.exe
1884	powershell.exe
2400	powershell.exe
2400	powershell.exe
2928	powershell.exe
2928	powershell.exe
1372	powershell.exe
1372	powershell.exe
1196	powershell.exe
1196	powershell.exe
4408	powershell.exe
4408	powershell.exe
5076	powershell.exe
5076	powershell.exe
2016	powershell.exe
2016	powershell.exe
4144	powershell.exe
3552	powershell.exe
1372	powershell.exe
1196	powershell.exe
2928	powershell.exe
1932	powershell.exe
1884	powershell.exe
2400	powershell.exe
4408	powershell.exe
2016	powershell.exe
5076	powershell.exe
4912	unsecapp.exe
4912	unsecapp.exe
4912	unsecapp.exe
4912	unsecapp.exe
4912	unsecapp.exe
4912	unsecapp.exe
4912	unsecapp.exe
4912	unsecapp.exe
4912	unsecapp.exe
4912	unsecapp.exe
4912	unsecapp.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	4912	unsecapp.exe
Token: SeDebugPrivilege	764	unsecapp.exe
Token: SeDebugPrivilege	1624	unsecapp.exe
Token: SeDebugPrivilege	1872	unsecapp.exe
Token: SeDebugPrivilege	4424	unsecapp.exe
Token: SeDebugPrivilege	1612	unsecapp.exe
Token: SeDebugPrivilege	1124	unsecapp.exe
Token: SeDebugPrivilege	4912	unsecapp.exe
Token: SeDebugPrivilege	4868	unsecapp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4408	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	104
PID 4832 wrote to memory of 4408	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	104
PID 4832 wrote to memory of 4144	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	105
PID 4832 wrote to memory of 4144	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	105
PID 4832 wrote to memory of 2400	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	106
PID 4832 wrote to memory of 2400	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	106
PID 4832 wrote to memory of 3552	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	107
PID 4832 wrote to memory of 3552	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	107
PID 4832 wrote to memory of 1372	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	108
PID 4832 wrote to memory of 1372	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	108
PID 4832 wrote to memory of 1932	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	109
PID 4832 wrote to memory of 1932	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	109
PID 4832 wrote to memory of 5076	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	110
PID 4832 wrote to memory of 5076	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	110
PID 4832 wrote to memory of 2928	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	111
PID 4832 wrote to memory of 2928	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	111
PID 4832 wrote to memory of 2016	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	112
PID 4832 wrote to memory of 2016	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	112
PID 4832 wrote to memory of 1884	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	113
PID 4832 wrote to memory of 1884	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	113
PID 4832 wrote to memory of 1196	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	114
PID 4832 wrote to memory of 1196	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	114
PID 4832 wrote to memory of 4528	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	126
PID 4832 wrote to memory of 4528	4832	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	126
PID 4528 wrote to memory of 4384	4528	cmd.exe	128
PID 4528 wrote to memory of 4384	4528	cmd.exe	128
PID 4528 wrote to memory of 4912	4528	cmd.exe	135
PID 4528 wrote to memory of 4912	4528	cmd.exe	135
PID 4912 wrote to memory of 2264	4912	unsecapp.exe	139
PID 4912 wrote to memory of 2264	4912	unsecapp.exe	139
PID 4912 wrote to memory of 5088	4912	unsecapp.exe	140
PID 4912 wrote to memory of 5088	4912	unsecapp.exe	140
PID 2264 wrote to memory of 764	2264	WScript.exe	147
PID 2264 wrote to memory of 764	2264	WScript.exe	147
PID 764 wrote to memory of 512	764	unsecapp.exe	150
PID 764 wrote to memory of 512	764	unsecapp.exe	150
PID 764 wrote to memory of 784	764	unsecapp.exe	151
PID 764 wrote to memory of 784	764	unsecapp.exe	151
PID 512 wrote to memory of 1624	512	WScript.exe	153
PID 512 wrote to memory of 1624	512	WScript.exe	153
PID 1624 wrote to memory of 2660	1624	unsecapp.exe	155
PID 1624 wrote to memory of 2660	1624	unsecapp.exe	155
PID 1624 wrote to memory of 4264	1624	unsecapp.exe	156
PID 1624 wrote to memory of 4264	1624	unsecapp.exe	156
PID 2660 wrote to memory of 1872	2660	WScript.exe	159
PID 2660 wrote to memory of 1872	2660	WScript.exe	159
PID 1872 wrote to memory of 2212	1872	unsecapp.exe	161
PID 1872 wrote to memory of 2212	1872	unsecapp.exe	161
PID 1872 wrote to memory of 1500	1872	unsecapp.exe	162
PID 1872 wrote to memory of 1500	1872	unsecapp.exe	162
PID 2212 wrote to memory of 4424	2212	WScript.exe	163
PID 2212 wrote to memory of 4424	2212	WScript.exe	163
PID 4424 wrote to memory of 1168	4424	unsecapp.exe	165
PID 4424 wrote to memory of 1168	4424	unsecapp.exe	165
PID 4424 wrote to memory of 232	4424	unsecapp.exe	166
PID 4424 wrote to memory of 232	4424	unsecapp.exe	166
PID 1168 wrote to memory of 1612	1168	WScript.exe	167
PID 1168 wrote to memory of 1612	1168	WScript.exe	167
PID 1612 wrote to memory of 3524	1612	unsecapp.exe	169
PID 1612 wrote to memory of 3524	1612	unsecapp.exe	169
PID 1612 wrote to memory of 5020	1612	unsecapp.exe	170
PID 1612 wrote to memory of 5020	1612	unsecapp.exe	170
PID 3524 wrote to memory of 1124	3524	WScript.exe	171
PID 3524 wrote to memory of 1124	3524	WScript.exe	171

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
"C:\Users\Admin\AppData\Local\Temp\2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1VAXs169f1.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4384
- - C:\Windows\DiagTrack\unsecapp.exe
    "C:\Windows\DiagTrack\unsecapp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50361dcd-df2d-4cc3-956e-00296293f69e.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Windows\DiagTrack\unsecapp.exe
        
        C:\Windows\DiagTrack\unsecapp.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:764
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63eef266-f837-43bd-89fb-5077a6ace6ca.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:512
        
        C:\Windows\DiagTrack\unsecapp.exe
        
        C:\Windows\DiagTrack\unsecapp.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6449d724-51b1-4cc4-8a44-91422972ad5b.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\DiagTrack\unsecapp.exe
        
        C:\Windows\DiagTrack\unsecapp.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ddff1957-deab-45b2-8a97-06ca03ddeca5.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\DiagTrack\unsecapp.exe
        
        C:\Windows\DiagTrack\unsecapp.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\609a4498-f3c2-4158-af31-554023bff5f2.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\DiagTrack\unsecapp.exe
        
        C:\Windows\DiagTrack\unsecapp.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe08ea6a-7496-4633-90a2-58ac3931cf1c.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\DiagTrack\unsecapp.exe
        
        C:\Windows\DiagTrack\unsecapp.exe
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e08a36ff-723a-41d4-96e4-3db63c592644.vbs"
        16⤵
        
        PID:3912
        
        C:\Windows\DiagTrack\unsecapp.exe
        
        C:\Windows\DiagTrack\unsecapp.exe
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed953718-91d5-4096-b455-943dff2e267b.vbs"
        18⤵
        
        PID:1212
        
        C:\Windows\DiagTrack\unsecapp.exe
        
        C:\Windows\DiagTrack\unsecapp.exe
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7aceffe-eed5-4b4f-beae-da74a280aff8.vbs"
        20⤵
        
        PID:2248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff74e224-1156-4452-8d49-ff2f06dacccf.vbs"
        20⤵
        
        PID:1856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e703685-24d4-4ed1-816b-ec254c0c0f92.vbs"
        18⤵
        
        PID:3360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f74cc990-f23d-4870-860d-7b429a97c33e.vbs"
        16⤵
        
        PID:664
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d9009fd-8900-4fea-8ece-6daa42a0b38d.vbs"
        14⤵
        
        PID:5020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b9a01736-3b03-4cd7-a467-0a77d93c97e9.vbs"
        12⤵
        
        PID:232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a4764d4-fbda-4aca-aab2-b20c0424db9f.vbs"
        10⤵
        
        PID:1500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3c33f6c-8159-41d3-a051-0484a742bc1b.vbs"
        8⤵
        
        PID:4264
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e73dc90f-5199-44e0-8197-95196ace3ada.vbs"
        6⤵
        
        PID:784
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03942aa8-0f7e-4fc1-9c7f-36d847246305.vbs"
      4⤵
      PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\Network Sharing\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\Network Sharing\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Updates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Updates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\DiagTrack\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\DiagTrack\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Windows\DiagTrack\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\unsecapp.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Temp\03942aa8-0f7e-4fc1-9c7f-36d847246305.vbs

Filesize
485B

MD5
254a4af869ad959a4153c0ec5f0dc140

SHA1
9bf77a392ee81c678fa1e8a86ee383960d46e350

SHA256
6a0cd8a4e787826491bebd785876b18b1451492c8e85b5465782f4a9b08f4d0b

SHA512
2992862d0ee019dae9fa7553e50d735cf83113876181408590822c62fe2281ab08e629539d55a68f85b3d78c583103540355692dab88563bdf77fb744380422c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1VAXs169f1.bat

Filesize
198B

MD5
66f08b5e33a042d13f8d5db8e8326b38

SHA1
c225094dd8e86dc3e6e8420388fe82a6bc8e1546

SHA256
f94f0eee2eae44ee9648f4aab0190dc4adaf6b8b972984afe812baced55f1fba

SHA512
a1f1174f1ac5f2b7adf8967e7bb2cc9fccb104edbbec988ff3c88006c6ad489b670786d2cc22a5d5da6d6cb6aa1e6cfab58b4dd7f8328e97c35c4c65b750865f

Download Submit
C:\Users\Admin\AppData\Local\Temp\50361dcd-df2d-4cc3-956e-00296293f69e.vbs

Filesize
709B

MD5
5035624d834dbf7822670a4c5f601b0e

SHA1
62f280b2b666af1699f12219ce971f0fd5ef99e0

SHA256
fb6cce9862f1179de6b17c50606e7d215c5e544a11f7d22ca430bd8df43186c8

SHA512
9132a6775103ea2cebee37b2856dc0af99a45c1db5684ce97a73192da267b9221d2d41fb591f571630222277f4154c11d40f853bd3fed3cc90bc9e394d0cb174

Download Submit
C:\Users\Admin\AppData\Local\Temp\609a4498-f3c2-4158-af31-554023bff5f2.vbs

Filesize
709B

MD5
9500ebd515f6ae21aaaf96149d1e5992

SHA1
bda38f65e2abdcead19b68f65542b6bb79572566

SHA256
e24dbfb92f6ca4b1a310a5b9fc6ede993b165b57a36b94ec171cac2ba50e3211

SHA512
0cd9e69cedf6cc0ebaedfc4cfe041cc201ab285f7c9c12561a7c2a711925452c1f9feda170f9508151e55adb41464c42bad9434c1aba80a1c691f857e8f73f1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\63eef266-f837-43bd-89fb-5077a6ace6ca.vbs

Filesize
708B

MD5
25a52f7ab4f6d98a2b02a4316ec1f39c

SHA1
ab545ff348cc8888222d4d4ecdce64e2da9b4919

SHA256
660ca627248ae3de5debbe3fa5055bd4ba9ea1f83b6ef6ad91235b6f88933443

SHA512
a279db55f0562f0dbd47da3ffd521e49056a3657a39ebb0acb4b7ec532a4698b2640ab90a55faf0e5724780b55e874109fb1ae0f9582cdd511474d1a95cdb46f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6449d724-51b1-4cc4-8a44-91422972ad5b.vbs

Filesize
709B

MD5
3bedbd1d1b7c509e8008584761644555

SHA1
e04141f743182a54e91383c1c712ea58f41acc04

SHA256
06b8dd180a9535e7b594078a701d6ff8ca0ff09c45ff7c6cbb687a3a56add65a

SHA512
4623f4badfe5dd73347c131a64816a2cbe61659845390ba9db3f3b40990d3aeac464b3a895cfcdfd038d8d83da055970e61a52b82c7163d047543b14a81e1211

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vew3amps.vof.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ddff1957-deab-45b2-8a97-06ca03ddeca5.vbs

Filesize
709B

MD5
1705a425c923df384f38d8040e978622

SHA1
23583c36cb021b8297cf35cc684f09363c343f02

SHA256
23fd3370152c61ffa7708d1396eae200d2394cffc6ea15fb6f55c2b7e1986e7e

SHA512
37ef98b2ebf9e500cdfd66a27a70e53bcc470f704189e6e187c23d4ea9ab456b3edcc3ebb9e2292d31d08512326d61a271cac9157fd5020d1a07fa69f251542b

Download Submit
C:\Users\Admin\AppData\Local\Temp\e08a36ff-723a-41d4-96e4-3db63c592644.vbs

Filesize
709B

MD5
9643df0f199e4d377b8587911724d3d6

SHA1
9364c76ca5892919a1458c33c62fddff2b0fe6c8

SHA256
3844464f7adea1fcf69bfbf63d0bf6b5bdafbec7e13330d759bd7335af0a9ace

SHA512
44c0235058207470a69d9cca49df6a070732ff8aab857ac5b0b3dd287d47841147135fa712df043b0eb429d289a332d9e30e6d8b0b450d47937fbd7560ef1af8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe08ea6a-7496-4633-90a2-58ac3931cf1c.vbs

Filesize
709B

MD5
9c2c82aa3457796923cd30db962edd79

SHA1
977018f0470c64ffdc997b9a08edd708d3e16c47

SHA256
0422ef47c530f4ee29f04d0bb508d163bd72260c4e7f70d40863d5ec82e1e7b8

SHA512
2720927a665fabb18d6197ab8ee5bf7965937ed9e8ee347da347389297e7d1fdcb5c556c9ecba06e38e074c7750d2939c5d0ea1fc5df034bd5ddac3a81b8f4c5

Download Submit
C:\Users\Default\Idle.exe

Filesize
1.7MB

MD5
46702766a2b352b3db95618c69a14526

SHA1
0c2c1e90dc69c16e2b09b705f6914b2372431a59

SHA256
2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9

SHA512
e1f84e854034293444f0f3ce562816e3f011ec58008f3601e00a7cf7125fc29c2f965fad7a59498d4d96b941006f20a4dcbb3373b325cd9fb6018cfa2aefc06e

Download Submit
C:\Users\Default\Idle.exe

Filesize
1.7MB

MD5
9901565c20ac42217ce3b9515b5d6689

SHA1
81194935b8d5bae4e0e7ba6a6f402c88e1427ce8

SHA256
0aef5943560f4a5d9aca2aeef3c78433dcebcf1beb6564f98c650cc3d8dfae8e

SHA512
3069a83fd384b27542a191093de9077bee18620d09aef11790fdabdafc322d17ae7f1cbeb9980339f23e9e809aef74394bcc445cff190c9995499ba0014908e3

Download Submit
memory/1612-302-0x000000001B3A0000-0x000000001B3B2000-memory.dmp

Filesize
72KB

Download
memory/1624-268-0x000000001B6E0000-0x000000001B6F2000-memory.dmp

Filesize
72KB

Download
memory/2264-253-0x00000177EFE40000-0x00000177EFE8E000-memory.dmp

Filesize
312KB

Download
memory/4144-120-0x00000225393B0000-0x00000225393D2000-memory.dmp

Filesize
136KB

Download
memory/4832-9-0x000000001BC90000-0x000000001BC9C000-memory.dmp

Filesize
48KB

Download
memory/4832-6-0x000000001BC50000-0x000000001BC60000-memory.dmp

Filesize
64KB

Download
memory/4832-15-0x000000001C6B0000-0x000000001C6BA000-memory.dmp

Filesize
40KB

Download
memory/4832-14-0x000000001C450000-0x000000001C45C000-memory.dmp

Filesize
48KB

Download
memory/4832-13-0x000000001C980000-0x000000001CEA8000-memory.dmp

Filesize
5.2MB

Download
memory/4832-12-0x000000001C420000-0x000000001C432000-memory.dmp

Filesize
72KB

Download
memory/4832-10-0x000000001BE00000-0x000000001BE08000-memory.dmp

Filesize
32KB

Download
memory/4832-18-0x000000001C570000-0x000000001C57C000-memory.dmp

Filesize
48KB

Download
memory/4832-7-0x000000001BC60000-0x000000001BC76000-memory.dmp

Filesize
88KB

Download
memory/4832-8-0x000000001BC80000-0x000000001BC90000-memory.dmp

Filesize
64KB

Download
memory/4832-17-0x000000001C680000-0x000000001C688000-memory.dmp

Filesize
32KB

Download
memory/4832-125-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/4832-5-0x0000000003330000-0x0000000003338000-memory.dmp

Filesize
32KB

Download
memory/4832-0-0x00007FF976223000-0x00007FF976225000-memory.dmp

Filesize
8KB

Download
memory/4832-4-0x000000001BDB0000-0x000000001BE00000-memory.dmp

Filesize
320KB

Download
memory/4832-3-0x000000001BC30000-0x000000001BC4C000-memory.dmp

Filesize
112KB

Download
memory/4832-23-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/4832-2-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/4832-22-0x00007FF976220000-0x00007FF976CE1000-memory.dmp

Filesize
10.8MB

Download
memory/4832-1-0x0000000000F60000-0x0000000001120000-memory.dmp

Filesize
1.8MB

Download
memory/4832-19-0x000000001C690000-0x000000001C69C000-memory.dmp

Filesize
48KB

Download
memory/4832-16-0x000000001C560000-0x000000001C56E000-memory.dmp

Filesize
56KB

Download
memory/4868-336-0x0000000003200000-0x0000000003212000-memory.dmp

Filesize
72KB

Download
memory/4912-243-0x000000001B050000-0x000000001B062000-memory.dmp

Filesize
72KB

Download