dcrat | fd198cf3ef764ffa17e7bd465d666057804a25ed5c6061074c0de7b6df43a667

Analysis

max time kernel
137s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2eff63cdfbb658f2a6e69851e7de131a.exe
Size

5.9MB
MD5

2eff63cdfbb658f2a6e69851e7de131a
SHA1

8a9e262a7319d2699cbee02b9de83fecd4bb3457
SHA256

5174e6fefa2a518cdaadb75f07a9bb7f9aaa6e0e24ba1610d3e400036cf02900
SHA512

3e3ea7e36e9dbaa5a969846f575f5138ba416a88bdc07f1e99af66a6c18a458434c680ade203dda242be3aa10c02c21e3f9427ad39ef90b72cc03855ddc93e40
SSDEEP

98304:hyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4T:hyeU11Rvqmu8TWKnF6N/1wO

Score

10^/10

dcrat defense_evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5684	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5720	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5588	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	4696	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	4696	schtasks.exe	88

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2eff63cdfbb658f2a6e69851e7de131a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2eff63cdfbb658f2a6e69851e7de131a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2eff63cdfbb658f2a6e69851e7de131a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4636	powershell.exe
5096	powershell.exe
2624	powershell.exe
1060	powershell.exe
3196	powershell.exe
680	powershell.exe
372	powershell.exe
1864	powershell.exe
4856	powershell.exe
380	powershell.exe
1748	powershell.exe
4316	powershell.exe
2168	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2eff63cdfbb658f2a6e69851e7de131a.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	2eff63cdfbb658f2a6e69851e7de131a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 3 IoCs

pid	Process
456	RuntimeBroker.exe
520	RuntimeBroker.exe
4376	RuntimeBroker.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2eff63cdfbb658f2a6e69851e7de131a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2eff63cdfbb658f2a6e69851e7de131a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
456	RuntimeBroker.exe
456	RuntimeBroker.exe
520	RuntimeBroker.exe
520	RuntimeBroker.exe
4376	RuntimeBroker.exe
4376	RuntimeBroker.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\66fc9ff0ee96c2	2eff63cdfbb658f2a6e69851e7de131a.exe
File created	C:\Program Files\edge_BITS_4484_1595890955\fontdrvhost.exe	2eff63cdfbb658f2a6e69851e7de131a.exe
File created	C:\Program Files\edge_BITS_4484_1595890955\5b884080fd4f94	2eff63cdfbb658f2a6e69851e7de131a.exe
File created	C:\Program Files\edge_BITS_4588_1354277851\SearchApp.exe	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Program Files\edge_BITS_4588_1354277851\SearchApp.exe	2eff63cdfbb658f2a6e69851e7de131a.exe
File created	C:\Program Files\edge_BITS_4588_1354277851\38384e6a620884	2eff63cdfbb658f2a6e69851e7de131a.exe
File created	C:\Program Files\Windows Security\BrowserCore\sihost.exe	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Program Files\edge_BITS_4484_1595890955\RCXB33A.tmp	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Program Files\edge_BITS_4588_1354277851\RCXB9B8.tmp	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\RCXBBDD.tmp	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Program Files\edge_BITS_4484_1595890955\RCXB2CB.tmp	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Program Files\edge_BITS_4484_1595890955\fontdrvhost.exe	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Program Files\edge_BITS_4588_1354277851\RCXB9A7.tmp	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\RCXBBCC.tmp	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\sihost.exe	2eff63cdfbb658f2a6e69851e7de131a.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\security\cap\fontdrvhost.exe	2eff63cdfbb658f2a6e69851e7de131a.exe
File created	C:\Windows\security\cap\5b884080fd4f94	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Windows\security\cap\RCXB55E.tmp	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Windows\security\cap\RCXB56E.tmp	2eff63cdfbb658f2a6e69851e7de131a.exe
File opened for modification	C:\Windows\security\cap\fontdrvhost.exe	2eff63cdfbb658f2a6e69851e7de131a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	2eff63cdfbb658f2a6e69851e7de131a.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4852	schtasks.exe
4996	schtasks.exe
5588	schtasks.exe
1984	schtasks.exe
4816	schtasks.exe
936	schtasks.exe
4928	schtasks.exe
560	schtasks.exe
3172	schtasks.exe
1856	schtasks.exe
956	schtasks.exe
996	schtasks.exe
4820	schtasks.exe
4352	schtasks.exe
5684	schtasks.exe
5720	schtasks.exe
1744	schtasks.exe
4896	schtasks.exe
4772	schtasks.exe
4812	schtasks.exe
2304	schtasks.exe
1844	schtasks.exe
4844	schtasks.exe
4632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
3024	2eff63cdfbb658f2a6e69851e7de131a.exe
1864	powershell.exe
1864	powershell.exe
2624	powershell.exe
2624	powershell.exe
680	powershell.exe
680	powershell.exe
4636	powershell.exe
4636	powershell.exe
5096	powershell.exe
5096	powershell.exe
380	powershell.exe
380	powershell.exe
4316	powershell.exe
4316	powershell.exe
3196	powershell.exe
3196	powershell.exe
1748	powershell.exe
1748	powershell.exe
1060	powershell.exe
1060	powershell.exe
372	powershell.exe
372	powershell.exe
5096	powershell.exe
4856	powershell.exe
4856	powershell.exe
2168	powershell.exe
2168	powershell.exe
4856	powershell.exe
372	powershell.exe
1864	powershell.exe
2624	powershell.exe
680	powershell.exe
1748	powershell.exe
380	powershell.exe
4636	powershell.exe
4316	powershell.exe
3196	powershell.exe
2168	powershell.exe
1060	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	2eff63cdfbb658f2a6e69851e7de131a.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	372	powershell.exe
Token: SeDebugPrivilege	456	RuntimeBroker.exe
Token: SeDebugPrivilege	520	RuntimeBroker.exe
Token: SeDebugPrivilege	4376	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1864	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	113
PID 3024 wrote to memory of 1864	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	113
PID 3024 wrote to memory of 5096	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	114
PID 3024 wrote to memory of 5096	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	114
PID 3024 wrote to memory of 372	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	115
PID 3024 wrote to memory of 372	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	115
PID 3024 wrote to memory of 4636	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	117
PID 3024 wrote to memory of 4636	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	117
PID 3024 wrote to memory of 2168	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	118
PID 3024 wrote to memory of 2168	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	118
PID 3024 wrote to memory of 4316	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	119
PID 3024 wrote to memory of 4316	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	119
PID 3024 wrote to memory of 680	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	120
PID 3024 wrote to memory of 680	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	120
PID 3024 wrote to memory of 1748	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	121
PID 3024 wrote to memory of 1748	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	121
PID 3024 wrote to memory of 3196	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	122
PID 3024 wrote to memory of 3196	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	122
PID 3024 wrote to memory of 1060	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	124
PID 3024 wrote to memory of 1060	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	124
PID 3024 wrote to memory of 380	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	125
PID 3024 wrote to memory of 380	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	125
PID 3024 wrote to memory of 2624	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	126
PID 3024 wrote to memory of 2624	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	126
PID 3024 wrote to memory of 4856	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	127
PID 3024 wrote to memory of 4856	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	127
PID 3024 wrote to memory of 644	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	139
PID 3024 wrote to memory of 644	3024	2eff63cdfbb658f2a6e69851e7de131a.exe	139
PID 644 wrote to memory of 4416	644	cmd.exe	141
PID 644 wrote to memory of 4416	644	cmd.exe	141
PID 644 wrote to memory of 456	644	cmd.exe	142
PID 644 wrote to memory of 456	644	cmd.exe	142
PID 456 wrote to memory of 820	456	RuntimeBroker.exe	145
PID 456 wrote to memory of 820	456	RuntimeBroker.exe	145
PID 456 wrote to memory of 1824	456	RuntimeBroker.exe	146
PID 456 wrote to memory of 1824	456	RuntimeBroker.exe	146
PID 820 wrote to memory of 520	820	WScript.exe	156
PID 820 wrote to memory of 520	820	WScript.exe	156
PID 520 wrote to memory of 860	520	RuntimeBroker.exe	157
PID 520 wrote to memory of 860	520	RuntimeBroker.exe	157
PID 520 wrote to memory of 2196	520	RuntimeBroker.exe	158
PID 520 wrote to memory of 2196	520	RuntimeBroker.exe	158
PID 860 wrote to memory of 4376	860	WScript.exe	160
PID 860 wrote to memory of 4376	860	WScript.exe	160
PID 4376 wrote to memory of 1448	4376	RuntimeBroker.exe	161
PID 4376 wrote to memory of 1448	4376	RuntimeBroker.exe	161
PID 4376 wrote to memory of 5988	4376	RuntimeBroker.exe	162
PID 4376 wrote to memory of 5988	4376	RuntimeBroker.exe	162

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2eff63cdfbb658f2a6e69851e7de131a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2eff63cdfbb658f2a6e69851e7de131a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2eff63cdfbb658f2a6e69851e7de131a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2eff63cdfbb658f2a6e69851e7de131a.exe
"C:\Users\Admin\AppData\Local\Temp\2eff63cdfbb658f2a6e69851e7de131a.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/7e20f84d5244aba7145631d4073af8/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/d25f591a00514bc9ba8441/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\se3mFL4n1a.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4416
- - C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe
    "C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:456
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2694d73d-e5ff-4a2d-8733-780a3485c3e1.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:820
    - - C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe
        
        C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:520
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c8e77b1-8ec5-4178-92e0-30eaf58cdf52.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:860
        
        C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe
        
        C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ced0542-c0a4-4d00-b8cc-8702147165fd.vbs"
        8⤵
        
        PID:1448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75ee7772-c231-48f8-9784-7ad5b8d0fb9b.vbs"
        8⤵
        
        PID:5988
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55cec1b3-df08-4f1f-b4e5-444003be7932.vbs"
        6⤵
        
        PID:2196
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22b0e0ca-7e32-4123-980b-0168a79f08cc.vbs"
      4⤵
      PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\7e20f84d5244aba7145631d4073af8\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\7e20f84d5244aba7145631d4073af8\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\7e20f84d5244aba7145631d4073af8\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\edge_BITS_4484_1595890955\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4484_1595890955\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\edge_BITS_4484_1595890955\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\security\cap\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\security\cap\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\security\cap\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\d25f591a00514bc9ba8441\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\d25f591a00514bc9ba8441\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\d25f591a00514bc9ba8441\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files\edge_BITS_4588_1354277851\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4588_1354277851\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files\edge_BITS_4588_1354277851\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\edge_BITS_4484_1595890955\fontdrvhost.exe

Filesize
5.9MB

MD5
e7febd96d002b06f87eae7a64eb46314

SHA1
e00778068508ff382e6604f8883faef1820ffe85

SHA256
1b82cdb9a99150ac17c8082fc43065495e1a405eaeb519aac6f3b6fb7cbc5f66

SHA512
d872789f6f47b0d0db8c2a026799711382795c4f34ea28bf06f86535629a91eeb8f3eda97d1676d529d22e395db04b8ec1d360399fa47ae3120c60db842a82d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
229da4b4256a6a948830de7ee5f9b298

SHA1
8118b8ddc115689ca9dc2fe8c244350333c5ba8b

SHA256
3d63b4a66e80ed97a8d74ea9dee7645942aafbd4abf1b31afed1027e5967fe11

SHA512
3a4ec8f720000a32bb1555b32db13236a73bb6e654e35b4de8bdb0fc0de535584bc08ebe25c7066324e86faa33e8f571a11cc4e5ef00be78e2993e228f615224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f68785608a60c0961b2926f9c4d4ff87

SHA1
e90357d9a679b851acf30e5e7aa6f76f2e6d3bb4

SHA256
edeed8daa6363551c6ffe770dc95fc9a767da6a020004c61c8e3d81eccb9d673

SHA512
fa369a235b3d4375e7856e39f42b17fb118fadb0b48fbe71074fa47354d0713662b950142ab5083c01cc850f79bbb0abe154eefe0e754b9b76e8d3b330daf652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5e4343881dc5fcb6305d29ef34a5ce28

SHA1
823b588ad6905d682cc3b7ac7bf7184d71da3d45

SHA256
27e82cc6e13b0db3a8b74798dffe21837cd4ef1f519519227bbd41ef05f428ac

SHA512
7a8c265e8dc6b4ad85132c4182270322023b4d59c97b466b5cce24402426c32fe14500343938c069cb17f985c73ef00f06187669d5b0c2050839a4cf6eb91762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
856d4328f99937476c1d34b5a03daaf8

SHA1
367f439b74760c236f1a95cf5d7de28ff3ec4b40

SHA256
6159722066119c162ed49973d2852c8c4420d89fcc78e69e2e7317a53f85cca1

SHA512
7782c1f714d9c21512b46f0c3caa1c475d304f0fd9b6c4537b3c4ac3b3a5ec9a6ee83d5240867364c34c8ac7a751f90aacce6d952d5ea17af834c65a5ef5d91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fb615e25fa5c5d81a46365d6446ed714

SHA1
a57ba54012b1fb1920cfcf276424556d6dc547fc

SHA256
61387deb1626bfef8716a58b204fe05f3df45181550ac38a081c97409c8973fc

SHA512
75961d4e10c7387ca20add4c96b2c4ebb897de417a18b6c6ac9008baa7c0d38823db4797d42e423225c09314ebfe8b000aa9f659f2e992ac8eba8a071407414e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c44e48d99762769d16de7352e92db16f

SHA1
29898e4ddba0504899fe0f0a55abacf592689e1b

SHA256
f92b4e399718fecfdc08924f70f0bdb7c5e0014eaeec343d815a503e06205bc8

SHA512
18cfd8b4bf3871c26c01d20ecd90f76493a6e55d7df33e78fb1491f6151ab3c04589758d6419f7b73a1288d5e65b85f40142bb7e3df5bc46e7fe4cf2da014879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8a1ec688da6aecc29adad317a53f0b27

SHA1
87e0b65d6be79be0cd0bc2d99f8e0e8a169406c6

SHA256
5878989a12563098e507af48834e0c0e92adfa760379baf9e8b46b9c53fa182d

SHA512
362fbd2dc7185482a1f319bbb50a7416c5feeb2ce7fac0c7cdd1690567704f3698ef41238721421039e2c570a3dc2998325b4be60dec79c0ed2d00608387c503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
226b55fdb0a63ac9ca46990a4a0accf2

SHA1
cb4ca93fa4a4e7ac4c2278a71da33cab8d99bc84

SHA256
44cb3bbf708735f43c9f07b3be3b110ae35b8c4904a0a9b8e0496c7ae313885a

SHA512
a45725acce36bb369715127097cfc9f481ac1ea42fb819e7df8559ecb83ad03beee2c089616146b02fc5406356ef855a3f7d3a06dc125336c6bb46b7ceba46df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ceb796de20c8360e1e53623d78696e8a

SHA1
52e20d1bb718b5e04290816c3c740d8f89265bcb

SHA256
cdf217f7e76215d14186a36614f8d2bd6f911869af5c12d98827ec42734ce321

SHA512
2d9f010240f49f4ea4537ece426edeccf8f6b1f2013bfb5e5e8412bc54993043e101f205ed5ca93f26d77de3cce1ab7620b7f97792df06d6c803695f9baaf869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
47dc8ed1f00b2cf40d90efa529ee35cc

SHA1
851d6a181ebb44256367c73042ed4f774bce9bdd

SHA256
2a1fa5eb6fa8a3b821776f5db5d69d414ca120a4612e613ec6ad34d216b2223e

SHA512
3dc49732881a4c8d2edfd4619ea4d206cca74fabba7d00f2021a7e07dba47c436a10f2d591ca43930c674ffe6b5f528a9e10e543dd87edf97d3f2f078c23c928

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c8e77b1-8ec5-4178-92e0-30eaf58cdf52.vbs

Filesize
726B

MD5
d775fbe20f135271cfa88e02bd18c9b7

SHA1
eda3bb79592395e0ef9e69f283fa9ccd89a6b043

SHA256
402316182d92f8a3256a11548fd9fd073513b7c2e30864cc3633160d07039bf0

SHA512
fd8cbdd33f99a307a789295d0233011b43d6611118c9691d623d6880c70e7585a380324b9486a740051f61351088db598267800bd0fc12c21f19978eb220f700

Download Submit
C:\Users\Admin\AppData\Local\Temp\1ced0542-c0a4-4d00-b8cc-8702147165fd.vbs

Filesize
727B

MD5
8c830e412e7b18eb0c12d9b08cfcdb76

SHA1
d32cb9a746a597241f3dc91853d1a3f4201477b3

SHA256
b21236ba3525f7f0e6c82ccc8bfd9bd34affeffb0c1327cd007d38631c689e04

SHA512
c1565cf947e5e87901022a322ae883a9d7063b1a6aa20ac3ffa0d51b67235b3d9aa3a7547f4af65a2c4e2daaa75d07f53f6eac57e840669b9ceeaade52514dfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\22b0e0ca-7e32-4123-980b-0168a79f08cc.vbs

Filesize
503B

MD5
9359c078584d0eb204e5e141af7182b0

SHA1
953fb125bb7ee80fe92ccd43ca1613c4ab002a27

SHA256
a9880e9eb726069fa12da82d1bc74de0f550b9da203d6af5d065e7b556ea5381

SHA512
64fe214e61b1aae8e7d55933258e6d435635e44bf89af2b5cf9eb98fa322cbc1cf38bdc3c894057661aa1c6484ddfdf101a94fe8469e1e8c0dd280994c1536f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2694d73d-e5ff-4a2d-8733-780a3485c3e1.vbs

Filesize
726B

MD5
588407dfe456652fe0c95b620480b2a1

SHA1
064e86277842c41fe6d0d4ede4d42ad10a3ab598

SHA256
2f9f93fe391af20cbfd9352b32a1179a9b560b108025eb1899058badd6679ea8

SHA512
c5e9a5efabf09450a6c3119930c21362ecd3b0188ea9f182446df37fba512afa05de8262c2496acf49fb70163b620c476cc0bcc61bf432fb8025394ac48b786c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_esgdqbar.wdk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\se3mFL4n1a.bat

Filesize
216B

MD5
17bc95a6d5b9bd886fd9613cb36deb85

SHA1
ef49f09d09de45e868b9507f6b80217de6f58e52

SHA256
5dc3693117ea51e6ec042696bebb8a7f80bf45e78e3fd40ddba24ed49ee9d907

SHA512
d3b85ec8072450a7ca27630fb70239ef72c87ab943e8fa435a62370704b75e91119da3375f0cbbc0470d89292c5330217b5c5d5c4a7e54756ca0505a7863ca51

Download Submit
C:\d25f591a00514bc9ba8441\wininit.exe

Filesize
5.9MB

MD5
2eff63cdfbb658f2a6e69851e7de131a

SHA1
8a9e262a7319d2699cbee02b9de83fecd4bb3457

SHA256
5174e6fefa2a518cdaadb75f07a9bb7f9aaa6e0e24ba1610d3e400036cf02900

SHA512
3e3ea7e36e9dbaa5a969846f575f5138ba416a88bdc07f1e99af66a6c18a458434c680ade203dda242be3aa10c02c21e3f9427ad39ef90b72cc03855ddc93e40

Download Submit
memory/456-315-0x000000001D1D0000-0x000000001D1E2000-memory.dmp

Filesize
72KB

Download
memory/520-329-0x000000001D5F0000-0x000000001D602000-memory.dmp

Filesize
72KB

Download
memory/1864-169-0x000001FC1D780000-0x000001FC1D7A2000-memory.dmp

Filesize
136KB

Download
memory/3024-29-0x000000001D430000-0x000000001D43C000-memory.dmp

Filesize
48KB

Download
memory/3024-39-0x000000001D6D0000-0x000000001D6D8000-memory.dmp

Filesize
32KB

Download
memory/3024-36-0x000000001D690000-0x000000001D69E000-memory.dmp

Filesize
56KB

Download
memory/3024-35-0x000000001D680000-0x000000001D688000-memory.dmp

Filesize
32KB

Download
memory/3024-34-0x000000001D670000-0x000000001D67E000-memory.dmp

Filesize
56KB

Download
memory/3024-32-0x000000001D650000-0x000000001D65C000-memory.dmp

Filesize
48KB

Download
memory/3024-31-0x000000001D6C0000-0x000000001D6C8000-memory.dmp

Filesize
32KB

Download
memory/3024-28-0x000000001D420000-0x000000001D428000-memory.dmp

Filesize
32KB

Download
memory/3024-27-0x000000001D410000-0x000000001D41C000-memory.dmp

Filesize
48KB

Download
memory/3024-22-0x000000001BAF0000-0x000000001BAF8000-memory.dmp

Filesize
32KB

Download
memory/3024-21-0x000000001BAE0000-0x000000001BAEC000-memory.dmp

Filesize
48KB

Download
memory/3024-20-0x000000001BAD0000-0x000000001BAD8000-memory.dmp

Filesize
32KB

Download
memory/3024-16-0x000000001BA50000-0x000000001BA60000-memory.dmp

Filesize
64KB

Download
memory/3024-15-0x0000000002F50000-0x0000000002F58000-memory.dmp

Filesize
32KB

Download
memory/3024-13-0x0000000002F60000-0x0000000002F72000-memory.dmp

Filesize
72KB

Download
memory/3024-12-0x0000000002EE0000-0x0000000002EE8000-memory.dmp

Filesize
32KB

Download
memory/3024-11-0x0000000002EC0000-0x0000000002ED6000-memory.dmp

Filesize
88KB

Download
memory/3024-8-0x0000000002F00000-0x0000000002F50000-memory.dmp

Filesize
320KB

Download
memory/3024-7-0x0000000002E90000-0x0000000002EAC000-memory.dmp

Filesize
112KB

Download
memory/3024-38-0x000000001D6B0000-0x000000001D6BC000-memory.dmp

Filesize
48KB

Download
memory/3024-6-0x0000000002E60000-0x0000000002E68000-memory.dmp

Filesize
32KB

Download
memory/3024-37-0x000000001D6A0000-0x000000001D6A8000-memory.dmp

Filesize
32KB

Download
memory/3024-40-0x000000001D7E0000-0x000000001D7EA000-memory.dmp

Filesize
40KB

Download
memory/3024-183-0x00007FFF53380000-0x00007FFF53E41000-memory.dmp

Filesize
10.8MB

Download
memory/3024-41-0x000000001D6E0000-0x000000001D6EC000-memory.dmp

Filesize
48KB

Download
memory/3024-33-0x000000001D660000-0x000000001D66A000-memory.dmp

Filesize
40KB

Download
memory/3024-0-0x00007FFF53383000-0x00007FFF53385000-memory.dmp

Filesize
8KB

Download
memory/3024-30-0x000000001D440000-0x000000001D44C000-memory.dmp

Filesize
48KB

Download
memory/3024-26-0x000000001BC20000-0x000000001BC2C000-memory.dmp

Filesize
48KB

Download
memory/3024-25-0x000000001D940000-0x000000001DE68000-memory.dmp

Filesize
5.2MB

Download
memory/3024-24-0x000000001BC10000-0x000000001BC22000-memory.dmp

Filesize
72KB

Download
memory/3024-19-0x000000001BAC0000-0x000000001BACC000-memory.dmp

Filesize
48KB

Download
memory/3024-18-0x000000001BA70000-0x000000001BAC6000-memory.dmp

Filesize
344KB

Download
memory/3024-17-0x000000001BA60000-0x000000001BA6A000-memory.dmp

Filesize
40KB

Download
memory/3024-14-0x0000000002EF0000-0x0000000002EFC000-memory.dmp

Filesize
48KB

Download
memory/3024-9-0x0000000002E70000-0x0000000002E78000-memory.dmp

Filesize
32KB

Download
memory/3024-10-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

Filesize
64KB

Download
memory/3024-5-0x0000000001610000-0x000000000161E000-memory.dmp

Filesize
56KB

Download
memory/3024-4-0x0000000001600000-0x000000000160E000-memory.dmp

Filesize
56KB

Download
memory/3024-3-0x00007FFF53380000-0x00007FFF53E41000-memory.dmp

Filesize
10.8MB

Download
memory/3024-2-0x00000000015C0000-0x00000000015C1000-memory.dmp

Filesize
4KB

Download
memory/3024-1-0x0000000000440000-0x0000000000D38000-memory.dmp

Filesize
9.0MB

Download