dcrat | 2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
Size

1.7MB
MD5

6edab7625800c81a8eb6ef36c2fb54fe
SHA1

28fe7ca7e96ccd496bb474ce9be0c7a828a92fed
SHA256

2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5
SHA512

2de808f6acfa8fd5d734db89d75668bab1187ab68d62a432d86fe8b4a1fb6de5422c4374cb8c0a2b894c1f8fb9fa514a3238e93123486c1254075178c67cba71
SSDEEP

49152:j+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKv:OTHUxUoh1IF9gl2

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1120	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1040	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	1040	schtasks.exe	83

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1216-1-0x0000000000F40000-0x0000000001100000-memory.dmp	dcrat
behavioral2/files/0x0008000000023c14-30.dat	dcrat
behavioral2/files/0x000b000000023bf7-111.dat	dcrat
behavioral2/files/0x000b000000023c11-122.dat	dcrat
behavioral2/files/0x001a000000023c2b-146.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1152	powershell.exe
2292	powershell.exe
4100	powershell.exe
1388	powershell.exe
932	powershell.exe
2760	powershell.exe
232	powershell.exe
4316	powershell.exe
924	powershell.exe
1000	powershell.exe
628	powershell.exe
2764	powershell.exe
4780	powershell.exe
3056	powershell.exe
3984	powershell.exe
1000	powershell.exe
1636	powershell.exe
2864	powershell.exe
1632	powershell.exe
4144	powershell.exe
624	powershell.exe
3652	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	wininit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	wininit.exe

Executes dropped EXE 4 IoCs

pid	Process
1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1940	wininit.exe
2176	wininit.exe
2620	wininit.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\migwiz\winlogon.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Windows\SysWOW64\migwiz\cc11b995f2a76d	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\winlogon.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\swidtag\9e8d7a4ca61bd9	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files (x86)\Google\Temp\explorer.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RCX9339.tmp	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\lsass.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\WmiPrvSE.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\RCX9C89.tmp	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\RCX9E9E.tmp	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\taskhostw.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\lsass.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\RCXA3F2.tmp	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\56085415360792	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\6203df4a6bafc7	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files (x86)\Windows Mail\wininit.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\Microsoft Office\Office16\WmiPrvSE.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RuntimeBroker.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\RCX9C88.tmp	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\dllhost.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files (x86)\Windows Mail\56085415360792	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\5940a34987c991	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\Internet Explorer\ja-JP\taskhostw.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ea9f0e6c9e2dcd	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\RCXA3F1.tmp	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\Microsoft Office\dwm.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files (x86)\Google\Temp\7a0fd90576e088	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\dllhost.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\Microsoft Office\Office16\24dbde2999530e	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wininit.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\Microsoft Office\6cb0b6c459d5d3	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\dotnet\swidtag\RuntimeBroker.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RCX933A.tmp	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\RCX9F1C.tmp	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\explorer.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Program Files\Microsoft Office\dwm.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\OCR\de-de\taskhostw.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\dwm.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\6cb0b6c459d5d3	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\dwm.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
File created	C:\Windows\servicing\ja-JP\StartMenuExperienceHost.exe	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	wininit.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	wininit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
876	schtasks.exe
696	schtasks.exe
2176	schtasks.exe
4688	schtasks.exe
1444	schtasks.exe
1060	schtasks.exe
704	schtasks.exe
4460	schtasks.exe
1660	schtasks.exe
4864	schtasks.exe
1848	schtasks.exe
3640	schtasks.exe
1944	schtasks.exe
2000	schtasks.exe
3392	schtasks.exe
736	schtasks.exe
2512	schtasks.exe
1840	schtasks.exe
468	schtasks.exe
4036	schtasks.exe
3268	schtasks.exe
3664	schtasks.exe
4464	schtasks.exe
2268	schtasks.exe
4084	schtasks.exe
4036	schtasks.exe
2656	schtasks.exe
1648	schtasks.exe
632	schtasks.exe
3772	schtasks.exe
4308	schtasks.exe
696	schtasks.exe
2944	schtasks.exe
3412	schtasks.exe
3064	schtasks.exe
1180	schtasks.exe
2180	schtasks.exe
3880	schtasks.exe
1120	schtasks.exe
1936	schtasks.exe
4920	schtasks.exe
2992	schtasks.exe
1544	schtasks.exe
4884	schtasks.exe
5048	schtasks.exe
1452	schtasks.exe
3812	schtasks.exe
1860	schtasks.exe
3904	schtasks.exe
2408	schtasks.exe
2376	schtasks.exe
4864	schtasks.exe
3064	schtasks.exe
2304	schtasks.exe
4620	schtasks.exe
3080	schtasks.exe
3672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
2760	powershell.exe
2760	powershell.exe
624	powershell.exe
624	powershell.exe
4144	powershell.exe
4144	powershell.exe
1000	powershell.exe
1000	powershell.exe
1152	powershell.exe
1152	powershell.exe
924	powershell.exe
924	powershell.exe
1632	powershell.exe
1632	powershell.exe
232	powershell.exe
232	powershell.exe
624	powershell.exe
932	powershell.exe
932	powershell.exe
1636	powershell.exe
1636	powershell.exe
2864	powershell.exe
2864	powershell.exe
2864	powershell.exe
2760	powershell.exe
4144	powershell.exe
1000	powershell.exe
932	powershell.exe
1636	powershell.exe
232	powershell.exe
924	powershell.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	1940	wininit.exe
Token: SeDebugPrivilege	2176	wininit.exe
Token: SeDebugPrivilege	2620	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1636	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	112
PID 1216 wrote to memory of 1636	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	112
PID 1216 wrote to memory of 1152	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	113
PID 1216 wrote to memory of 1152	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	113
PID 1216 wrote to memory of 932	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	114
PID 1216 wrote to memory of 932	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	114
PID 1216 wrote to memory of 2760	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	115
PID 1216 wrote to memory of 2760	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	115
PID 1216 wrote to memory of 2864	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	116
PID 1216 wrote to memory of 2864	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	116
PID 1216 wrote to memory of 924	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	117
PID 1216 wrote to memory of 924	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	117
PID 1216 wrote to memory of 1632	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	118
PID 1216 wrote to memory of 1632	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	118
PID 1216 wrote to memory of 624	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	119
PID 1216 wrote to memory of 624	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	119
PID 1216 wrote to memory of 4144	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	120
PID 1216 wrote to memory of 4144	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	120
PID 1216 wrote to memory of 1000	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	121
PID 1216 wrote to memory of 1000	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	121
PID 1216 wrote to memory of 232	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	122
PID 1216 wrote to memory of 232	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	122
PID 1216 wrote to memory of 3516	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	134
PID 1216 wrote to memory of 3516	1216	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	134
PID 3516 wrote to memory of 2588	3516	cmd.exe	136
PID 3516 wrote to memory of 2588	3516	cmd.exe	136
PID 3516 wrote to memory of 1052	3516	cmd.exe	138
PID 3516 wrote to memory of 1052	3516	cmd.exe	138
PID 1052 wrote to memory of 3652	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	174
PID 1052 wrote to memory of 3652	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	174
PID 1052 wrote to memory of 3984	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	175
PID 1052 wrote to memory of 3984	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	175
PID 1052 wrote to memory of 2292	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	176
PID 1052 wrote to memory of 2292	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	176
PID 1052 wrote to memory of 628	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	177
PID 1052 wrote to memory of 628	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	177
PID 1052 wrote to memory of 4316	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	178
PID 1052 wrote to memory of 4316	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	178
PID 1052 wrote to memory of 3056	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	179
PID 1052 wrote to memory of 3056	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	179
PID 1052 wrote to memory of 1000	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	180
PID 1052 wrote to memory of 1000	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	180
PID 1052 wrote to memory of 4780	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	182
PID 1052 wrote to memory of 4780	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	182
PID 1052 wrote to memory of 1388	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	184
PID 1052 wrote to memory of 1388	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	184
PID 1052 wrote to memory of 2764	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	186
PID 1052 wrote to memory of 2764	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	186
PID 1052 wrote to memory of 4100	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	187
PID 1052 wrote to memory of 4100	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	187
PID 1052 wrote to memory of 1940	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	196
PID 1052 wrote to memory of 1940	1052	2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe	196
PID 1940 wrote to memory of 3980	1940	wininit.exe	200
PID 1940 wrote to memory of 3980	1940	wininit.exe	200
PID 1940 wrote to memory of 2544	1940	wininit.exe	201
PID 1940 wrote to memory of 2544	1940	wininit.exe	201
PID 3980 wrote to memory of 2176	3980	WScript.exe	210
PID 3980 wrote to memory of 2176	3980	WScript.exe	210
PID 2176 wrote to memory of 3596	2176	wininit.exe	212
PID 2176 wrote to memory of 3596	2176	wininit.exe	212
PID 2176 wrote to memory of 2904	2176	wininit.exe	213
PID 2176 wrote to memory of 2904	2176	wininit.exe	213
PID 3596 wrote to memory of 2620	3596	WScript.exe	214
PID 3596 wrote to memory of 2620	3596	WScript.exe	214

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
"C:\Users\Admin\AppData\Local\Temp\2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nv7qRJ8Umn.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe
    "C:\Users\Admin\AppData\Local\Temp\2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4100
  - - C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe
      "C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1940
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a64b69a9-1e02-45a8-ba0b-0bea417cce52.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3980
      - C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe
        
        "C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b67100f8-0f91-42d3-9441-1aa1868f029a.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe
        
        "C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ab4a199-ac23-44a6-a253-5790db38b5bd.vbs"
        9⤵
        
        PID:1496
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\268bca85-7e33-41ca-a60d-0b66322d0794.vbs"
        9⤵
        
        PID:5028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\501d0377-4bed-40c3-966d-6716f80f279e.vbs"
        7⤵
        
        PID:2904
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84f366a8-dcea-474b-a1c3-64ab9762a2cc.vbs"
        5⤵
        
        PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\dotnet\swidtag\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\swidtag\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Downloads\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\ja-JP\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\ja-JP\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\ja-JP\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Documents\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Admin\Documents\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Documents\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Temp\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\Libraries\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Libraries\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Pictures\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office16\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office16\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\SysWOW64\migwiz\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SysWOW64\migwiz\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\SysWOW64\migwiz\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Internet Explorer\ja-JP\taskhostw.exe

Filesize
1.7MB

MD5
15d2eeeb878010d29b014a01681b1223

SHA1
f26f84874957b820d476ae10e8b8d818a19475b6

SHA256
a1d4301ffe43e343d53c5458b5377648cbf52ecff4732157b6a384b5d90531d4

SHA512
7e9e950f66b0ac3f487c3a2ad6f8dde2fd0b6a968572bb5b34c45730c9a63709f17cceb15b4df09b71dde0a739053dac43f7a76f359b466276ac27c875c158d7

Download Submit
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\dllhost.exe

Filesize
1.7MB

MD5
6edab7625800c81a8eb6ef36c2fb54fe

SHA1
28fe7ca7e96ccd496bb474ce9be0c7a828a92fed

SHA256
2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5

SHA512
2de808f6acfa8fd5d734db89d75668bab1187ab68d62a432d86fe8b4a1fb6de5422c4374cb8c0a2b894c1f8fb9fa514a3238e93123486c1254075178c67cba71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2b18b40a90808621be15138e6a5ab8dd849c62d5cc9bb43def5598a2ef578be5.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
413295041ef4563a17d06ae8e68a63c1

SHA1
15546eda67178f9402ee2010ba20a0e94f27cbe3

SHA256
9d6aa78156417d11d1f960a68fdae4572deea1118a25914d99410f0dba572231

SHA512
fc337bf789304d318ecf0c275d6a98c31113748da6f157b3518c558f2a17403132ed36d3c89b7584d2a30419f06564bca917ea116f2696ca6e2059e61e952d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
92075279f2dbcaa5724ee5a47e49712f

SHA1
8dd3e2faa8432dde978946ebaf9054f7c6e0b2cb

SHA256
fd985ddd090621af25aa77aebff689c95ea7679ff0e81887124b2802ae3e9442

SHA512
744c62556233d9872f43ffb5a5a98aee20a44834436306f0a948c8c4072bdb46ef8044616593747edd645caaee60faf8b14fedb2d6df5f6019b5c73357d80d22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
07ab6cc81c5230a598c0ad1711b6bd97

SHA1
de7e270e12d447dfc5896b7c96777eb32725778a

SHA256
900aa2c83ec8773c3f9705f75b28fff0eaca57f7adb33dc82564d7ea8f8069a3

SHA512
ffef0ad0824ea0fdab29eb3c44448100f79365a1729c7665eba9aef85a88e60901bc6a6c248de15a28d21be9ce5839d68861e4449ff557d8845927c740ba3a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
150616521d490e160cd33b97d678d206

SHA1
71594f5b97a4a61fe5f120eb10bcd6b73d7e6e78

SHA256
94595c05912cbb8380f7ed34499eb01fb91707a1ed1c02c02002a4361e889827

SHA512
7043dc4b336b1688205fbe762e731478ecaa0036c9f5e0434c79b8a6f8fa58b0705c8674fd6a047e6009edc52c37ce4e2ce81694e13b79a3e8183a32307f3815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9405862a3b15dc34824f6a0e5f077f4f

SHA1
bbe0000e06be94fa61d6e223fb38b1289908723d

SHA256
0a0869426bca171c080316948a4638a7152018ea5e07de97b2d51e0d90905210

SHA512
fc7ae988b81dec5b13ae9878350cd9d063538bfb2bc14f099087836ed54cd77a36bc7c4276fa075a80a3cd20e7620fa2ba5a8b5b7bf98698b10752749187148d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fe9b96bc4e29457b2d225a5412322a52

SHA1
551e29903e926b5d6c52a8f57cf10475ba790bd0

SHA256
e81b9bfd38a5199813d703d5caf75baa6f62847b2b9632302b5d6f10dd6cf997

SHA512
ff912526647f6266f37749dfdc3ed5fd37c35042ba481331434168704c827d128c22093ba73d7ad0cecde10365f0978fcd3f3e2af1a1c280cd2e592a62d5fa80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bf4015b074a6f408647188368cbe25f4

SHA1
a765f181884d7a02ddeab628fe609618692a36e6

SHA256
cee8320faacd6e6e833cb29ee5c2f6d273d0661e2bde852dc25efc4fad5f109a

SHA512
cec96f77452fb6dc3217af488b54d3850794780d10528c010aebb35895e434208ecff91f73a19b1c24a83efeb3d4d6a2100162b25ca6f23d12d118323390890c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ab4a199-ac23-44a6-a253-5790db38b5bd.vbs

Filesize
731B

MD5
f677fd4a48bb1a86730ab74135051a7d

SHA1
57aceea590ac5f4639ffbca2bcd56b771b4f6720

SHA256
0c4bd9acef854efc81e39fe29395f74ef59992a9929ed7e51587a9a57f261d58

SHA512
97cd7b38d6c9e8e6739f080845d1698a7a388f178f0b1f4d05da3f7b526935ac5f05ab80b212dcbca7cf5708d8c96feada542480655b483ea03b9b5258976dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\84f366a8-dcea-474b-a1c3-64ab9762a2cc.vbs

Filesize
507B

MD5
3ee000cc3c1bf9d3f899957ca4a591d3

SHA1
3ab4e8aae991ab5c098b7cbb6a7a35c8fcd9d522

SHA256
de23513c8a03b622b92c1d701b713d3b01a5414fd18d75fddb3b2ced6f6828a6

SHA512
925290c3e4ceee465aec5c33d9eaa9503d309a1e9e247d29e1a765547ac1972ef4566b2c5281189b10044f699748e469819d2721810b9c433c8512f2842cd192

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nv7qRJ8Umn.bat

Filesize
267B

MD5
5e19d80244b53235364e8e74e55b1794

SHA1
2bf0cd6acc4da13a4e17326ebe1e9571efd0d95c

SHA256
327480129ea7841247ae51428a35138cad398e1172d3d29a291e89a57a63e32a

SHA512
a0ddf6fb518be5b8b00376ec2da14777ee048bccd9e198ea1e88579a62ebfd2150063749a6f86d6db47ae4c63bd12c6ef343a50c2ac8e0073f5331ff8c973134

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oe2mowe2.1fr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a64b69a9-1e02-45a8-ba0b-0bea417cce52.vbs

Filesize
731B

MD5
30d1815798ac43d4ef8bc6beb29fdf18

SHA1
a98e16eb6c73ab5589a590572c777d6cd70ea26b

SHA256
c7d122238474932a994c2f5397f546aa3679dc7eb374baa8504f8cb502b9f4f7

SHA512
ab7b542683b6cdb76924fbb1d3f765b7a426243d400fbe414f56ff1c5e27cc899a1dafa5edf62d29af059f4e795ed61009e852ff91bbe9f06d94cfa1006cc896

Download Submit
C:\Users\Admin\AppData\Local\Temp\b67100f8-0f91-42d3-9441-1aa1868f029a.vbs

Filesize
731B

MD5
c033d25d9af2d7e4530efddf321b0bd5

SHA1
50679cf7abc0fdbd0eef30bd7a0c6a30851a240c

SHA256
4d73871ef82eb0005d50d563033bcc6e6d6358ed5a73b8e65b87140f62d8e18c

SHA512
addd3463a5301301209883e8c856cf16ebb57d23b7c76f33d8cba72e28bad2d23431cda52aa2da3d1bff3512b55e8703352e29b8cf361a61699b417577bff4c4

Download Submit
C:\Users\Admin\Documents\SearchApp.exe

Filesize
1.7MB

MD5
5c5dbe8948092323b6e2615ea10e6071

SHA1
35617c07e6442bc20ecf4d9e8531cc8a82dea2d8

SHA256
757f0a2fe1985d29cb6647a65aef71dc21176ef77adcc4b70f078f516929c1f3

SHA512
ec25a79b9d8998c284889890059f0856a70a0496104b65b4439a4e393cd127965087ca98aca4594903e10274b155c6aae8b3dbe5d124ae119957c875068f06a6

Download Submit
C:\Users\Public\Libraries\SppExtComObj.exe

Filesize
1.7MB

MD5
2a23e91692550c702936de56b6deba21

SHA1
ef334cf612cd81fb3a5fd9dfe2b583adf8a38877

SHA256
4a45603f9a7c15442360f9a4704fe7b86c961ff912b93d76f3d6d08d15cd035e

SHA512
935b7182935dd5cf3eca18a8244fbb4af6dfda00b8b343c63e67a49b07ed7635b2a4c1bab623765b9f4702e59d1835d9d2303a31f747dad998c229ec72ee14fa

Download Submit
memory/1052-282-0x000000001B1B0000-0x000000001B1C2000-memory.dmp

Filesize
72KB

Download
memory/1216-19-0x000000001BE50000-0x000000001BE5C000-memory.dmp

Filesize
48KB

Download
memory/1216-22-0x00007FF98C820000-0x00007FF98D2E1000-memory.dmp

Filesize
10.8MB

Download
memory/1216-1-0x0000000000F40000-0x0000000001100000-memory.dmp

Filesize
1.8MB

Download
memory/1216-23-0x00007FF98C820000-0x00007FF98D2E1000-memory.dmp

Filesize
10.8MB

Download
memory/1216-13-0x000000001C9B0000-0x000000001CED8000-memory.dmp

Filesize
5.2MB

Download
memory/1216-0-0x00007FF98C823000-0x00007FF98C825000-memory.dmp

Filesize
8KB

Download
memory/1216-17-0x000000001BE30000-0x000000001BE38000-memory.dmp

Filesize
32KB

Download
memory/1216-12-0x00000000033B0000-0x00000000033C2000-memory.dmp

Filesize
72KB

Download
memory/1216-16-0x000000001BE20000-0x000000001BE2E000-memory.dmp

Filesize
56KB

Download
memory/1216-15-0x000000001C6A0000-0x000000001C6AA000-memory.dmp

Filesize
40KB

Download
memory/1216-14-0x000000001BE10000-0x000000001BE1C000-memory.dmp

Filesize
48KB

Download
memory/1216-2-0x00007FF98C820000-0x00007FF98D2E1000-memory.dmp

Filesize
10.8MB

Download
memory/1216-165-0x00007FF98C820000-0x00007FF98D2E1000-memory.dmp

Filesize
10.8MB

Download
memory/1216-143-0x00007FF98C823000-0x00007FF98C825000-memory.dmp

Filesize
8KB

Download
memory/1216-18-0x000000001BE40000-0x000000001BE4C000-memory.dmp

Filesize
48KB

Download
memory/1216-5-0x0000000001980000-0x0000000001988000-memory.dmp

Filesize
32KB

Download
memory/1216-10-0x00000000033A0000-0x00000000033A8000-memory.dmp

Filesize
32KB

Download
memory/1216-6-0x0000000003340000-0x0000000003350000-memory.dmp

Filesize
64KB

Download
memory/1216-9-0x0000000003390000-0x000000000339C000-memory.dmp

Filesize
48KB

Download
memory/1216-7-0x0000000003370000-0x0000000003386000-memory.dmp

Filesize
88KB

Download
memory/1216-8-0x0000000003350000-0x0000000003360000-memory.dmp

Filesize
64KB

Download
memory/1216-4-0x00000000033C0000-0x0000000003410000-memory.dmp

Filesize
320KB

Download
memory/1216-3-0x0000000001960000-0x000000000197C000-memory.dmp

Filesize
112KB

Download
memory/1940-481-0x000000001B050000-0x000000001B062000-memory.dmp

Filesize
72KB

Download
memory/2760-164-0x000002E16E630000-0x000002E16E652000-memory.dmp

Filesize
136KB

Download