5656064ae4d3c302be4f376131bce57fa83ba30e94c329f33adb91836d7f4bf8

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Size

1.9MB
MD5

34655ac11b4f6a8d6f1ea8e2fbbe0676
SHA1

d17ed388047ec77145ef4c96e3760ea94985caa7
SHA256

75b2e0c469d7b50ea3a5f022b84db475f4009e17265ead71e5a68a9a90a44688
SHA512

2c2bf7b06e1a6ddfc2bbfe21a9c1a21cea9a33015ad62837dd1dee81e8a096b951c1dae3f3a95ae052f014e563b040da9d3ee9c96565116933603a99ab9e61e2
SSDEEP

24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5296	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5772	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5156	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5260	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5408	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5424	820	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	820	schtasks.exe	88

UAC bypass 3 TTPs 21 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5056	powershell.exe
2244	powershell.exe
3068	powershell.exe
2732	powershell.exe
3296	powershell.exe
6040	powershell.exe
5404	powershell.exe
2932	powershell.exe
6140	powershell.exe
2016	powershell.exe
6092	powershell.exe
2872	powershell.exe
2784	powershell.exe
3368	powershell.exe
5204	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe

Executes dropped EXE 6 IoCs

pid	Process
4464	winlogon.exe
3960	winlogon.exe
3296	winlogon.exe
2544	winlogon.exe
1480	winlogon.exe
5740	winlogon.exe

Checks whether UAC is enabled 1 TTPs 14 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\Idle.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCX7A89.tmp	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCX7A8A.tmp	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Idle.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Program Files (x86)\Google\Update\RCX8194.tmp	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Program Files (x86)\Google\Update\RCX8195.tmp	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File created	C:\Program Files (x86)\Windows Media Player\6ccacd8608530f	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File created	C:\Program Files (x86)\Google\Update\csrss.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File created	C:\Program Files (x86)\Google\Update\886983d96e3d3e	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Program Files (x86)\Google\Update\csrss.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\cc11b995f2a76d	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File created	C:\Windows\IME\it-IT\RuntimeBroker.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File created	C:\Windows\IME\it-IT\9e8d7a4ca61bd9	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\RCX8485.tmp	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Windows\Fonts\RCX89A9.tmp	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Windows\IME\it-IT\RuntimeBroker.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File created	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\csrss.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File created	C:\Windows\Fonts\winlogon.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Windows\Fonts\winlogon.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File created	C:\Windows\RemotePackages\RemoteApps\StartMenuExperienceHost.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Windows\IME\it-IT\RCX8C2B.tmp	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File created	C:\Windows\RemotePackages\RemoteApps\55b276f4edf653	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\RCX8417.tmp	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Windows\RemotePackages\RemoteApps\StartMenuExperienceHost.exe	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Windows\Fonts\RCX89B9.tmp	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
File opened for modification	C:\Windows\IME\it-IT\RCX8C9A.tmp	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	winlogon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4680	schtasks.exe
4672	schtasks.exe
3164	schtasks.exe
5156	schtasks.exe
1808	schtasks.exe
1616	schtasks.exe
4660	schtasks.exe
5260	schtasks.exe
2484	schtasks.exe
3976	schtasks.exe
828	schtasks.exe
5008	schtasks.exe
4608	schtasks.exe
1896	schtasks.exe
4964	schtasks.exe
5424	schtasks.exe
4604	schtasks.exe
5296	schtasks.exe
5772	schtasks.exe
4828	schtasks.exe
4956	schtasks.exe
3404	schtasks.exe
4732	schtasks.exe
4864	schtasks.exe
4716	schtasks.exe
2028	schtasks.exe
4556	schtasks.exe
4848	schtasks.exe
4704	schtasks.exe
3336	schtasks.exe
3624	schtasks.exe
4572	schtasks.exe
5096	schtasks.exe
3112	schtasks.exe
1732	schtasks.exe
4212	schtasks.exe
4816	schtasks.exe
4768	schtasks.exe
2328	schtasks.exe
4928	schtasks.exe
5408	schtasks.exe
3508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
3068	powershell.exe
3068	powershell.exe
3368	powershell.exe
3368	powershell.exe
6140	powershell.exe
6140	powershell.exe
5056	powershell.exe
5056	powershell.exe
2932	powershell.exe
2932	powershell.exe
2244	powershell.exe
2244	powershell.exe
2732	powershell.exe
2732	powershell.exe
3296	powershell.exe
3296	powershell.exe
5204	powershell.exe
5204	powershell.exe
2872	powershell.exe
2872	powershell.exe
6092	powershell.exe
6092	powershell.exe
6040	powershell.exe
6040	powershell.exe
2784	powershell.exe
2784	powershell.exe
2016	powershell.exe
2016	powershell.exe
5404	powershell.exe
5404	powershell.exe
5404	powershell.exe
2016	powershell.exe
2872	powershell.exe
3068	powershell.exe
3068	powershell.exe
3368	powershell.exe
2932	powershell.exe
3296	powershell.exe
6140	powershell.exe
2732	powershell.exe
5204	powershell.exe
2244	powershell.exe
6092	powershell.exe
6040	powershell.exe
5056	powershell.exe
5056	powershell.exe
2784	powershell.exe
4464	winlogon.exe
3960	winlogon.exe
3296	winlogon.exe
3296	winlogon.exe
2544	winlogon.exe
1480	winlogon.exe
5740	winlogon.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	6140	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	5204	powershell.exe
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeDebugPrivilege	6040	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	4464	winlogon.exe
Token: SeDebugPrivilege	3960	winlogon.exe
Token: SeDebugPrivilege	3296	winlogon.exe
Token: SeDebugPrivilege	2544	winlogon.exe
Token: SeDebugPrivilege	1480	winlogon.exe
Token: SeDebugPrivilege	5740	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 2872	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	134
PID 5460 wrote to memory of 2872	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	134
PID 5460 wrote to memory of 3068	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	135
PID 5460 wrote to memory of 3068	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	135
PID 5460 wrote to memory of 5404	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	136
PID 5460 wrote to memory of 5404	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	136
PID 5460 wrote to memory of 2932	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	137
PID 5460 wrote to memory of 2932	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	137
PID 5460 wrote to memory of 2732	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	138
PID 5460 wrote to memory of 2732	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	138
PID 5460 wrote to memory of 3296	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	139
PID 5460 wrote to memory of 3296	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	139
PID 5460 wrote to memory of 5204	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	140
PID 5460 wrote to memory of 5204	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	140
PID 5460 wrote to memory of 2784	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	141
PID 5460 wrote to memory of 2784	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	141
PID 5460 wrote to memory of 6140	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	142
PID 5460 wrote to memory of 6140	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	142
PID 5460 wrote to memory of 5056	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	143
PID 5460 wrote to memory of 5056	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	143
PID 5460 wrote to memory of 2016	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	144
PID 5460 wrote to memory of 2016	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	144
PID 5460 wrote to memory of 3368	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	145
PID 5460 wrote to memory of 3368	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	145
PID 5460 wrote to memory of 2244	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	146
PID 5460 wrote to memory of 2244	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	146
PID 5460 wrote to memory of 6040	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	147
PID 5460 wrote to memory of 6040	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	147
PID 5460 wrote to memory of 6092	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	148
PID 5460 wrote to memory of 6092	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	148
PID 5460 wrote to memory of 4516	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	164
PID 5460 wrote to memory of 4516	5460	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe	164
PID 4516 wrote to memory of 5324	4516	cmd.exe	166
PID 4516 wrote to memory of 5324	4516	cmd.exe	166
PID 4516 wrote to memory of 4464	4516	cmd.exe	169
PID 4516 wrote to memory of 4464	4516	cmd.exe	169
PID 4464 wrote to memory of 5968	4464	winlogon.exe	171
PID 4464 wrote to memory of 5968	4464	winlogon.exe	171
PID 4464 wrote to memory of 3328	4464	winlogon.exe	172
PID 4464 wrote to memory of 3328	4464	winlogon.exe	172
PID 5968 wrote to memory of 3960	5968	WScript.exe	174
PID 5968 wrote to memory of 3960	5968	WScript.exe	174
PID 3960 wrote to memory of 4832	3960	winlogon.exe	175
PID 3960 wrote to memory of 4832	3960	winlogon.exe	175
PID 3960 wrote to memory of 5808	3960	winlogon.exe	176
PID 3960 wrote to memory of 5808	3960	winlogon.exe	176
PID 4832 wrote to memory of 3296	4832	WScript.exe	181
PID 4832 wrote to memory of 3296	4832	WScript.exe	181
PID 3296 wrote to memory of 4496	3296	winlogon.exe	182
PID 3296 wrote to memory of 4496	3296	winlogon.exe	182
PID 3296 wrote to memory of 5260	3296	winlogon.exe	183
PID 3296 wrote to memory of 5260	3296	winlogon.exe	183
PID 4496 wrote to memory of 2544	4496	WScript.exe	187
PID 4496 wrote to memory of 2544	4496	WScript.exe	187
PID 2544 wrote to memory of 5756	2544	winlogon.exe	188
PID 2544 wrote to memory of 5756	2544	winlogon.exe	188
PID 2544 wrote to memory of 5780	2544	winlogon.exe	189
PID 2544 wrote to memory of 5780	2544	winlogon.exe	189
PID 5756 wrote to memory of 1480	5756	WScript.exe	191
PID 5756 wrote to memory of 1480	5756	WScript.exe	191
PID 1480 wrote to memory of 1844	1480	winlogon.exe	192
PID 1480 wrote to memory of 1844	1480	winlogon.exe	192
PID 1480 wrote to memory of 2184	1480	winlogon.exe	193
PID 1480 wrote to memory of 2184	1480	winlogon.exe	193

System policy modification 1 TTPs 21 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
"C:\Users\Admin\AppData\Local\Temp\34655ac11b4f6a8d6f1ea8e2fbbe0676.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\34655ac11b4f6a8d6f1ea8e2fbbe0676.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\7e20f84d5244aba7145631d4073af8\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\My Documents\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d25f591a00514bc9ba8441\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d25f591a00514bc9ba8441\TextInputHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\it-IT\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FU5t9pRjNL.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5324
- - C:\Windows\Fonts\winlogon.exe
    "C:\Windows\Fonts\winlogon.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4464
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3dd17b7-d646-4a7c-90ab-4df43ebab7a4.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5968
    - - C:\Windows\Fonts\winlogon.exe
        
        C:\Windows\Fonts\winlogon.exe
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3960
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78f3b82f-3961-42b8-90a2-5096834a78c7.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\Fonts\winlogon.exe
        
        C:\Windows\Fonts\winlogon.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb1e9304-a752-4fad-b32a-e49d646fbca0.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\Fonts\winlogon.exe
        
        C:\Windows\Fonts\winlogon.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbe95dde-77dc-485e-998e-026781b0cde6.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\Windows\Fonts\winlogon.exe
        
        C:\Windows\Fonts\winlogon.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d11f1b7c-a954-43ab-a1c4-35391b5dbf56.vbs"
        12⤵
        
        PID:1844
        
        C:\Windows\Fonts\winlogon.exe
        
        C:\Windows\Fonts\winlogon.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f1be790-c663-41d8-ad57-388ff40f3d21.vbs"
        14⤵
        
        PID:1408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f42dcc16-b0a7-42b3-8477-6210519e1b59.vbs"
        14⤵
        
        PID:764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e081ab2-7915-401f-bb3d-465110a47eff.vbs"
        12⤵
        
        PID:2184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\604ea1a1-ddd7-4e01-b7df-997a8912fe54.vbs"
        10⤵
        
        PID:5780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c37e47a-4fa5-4b4a-928f-82ecea047ab8.vbs"
        8⤵
        
        PID:5260
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68b72fbc-4cdc-460b-82ca-eb6104c280ea.vbs"
        6⤵
        
        PID:5808
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e83f49d5-15c7-4a0b-88b0-42e5c171766c.vbs"
      4⤵
      PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\7e20f84d5244aba7145631d4073af8\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\7e20f84d5244aba7145631d4073af8\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\7e20f84d5244aba7145631d4073af8\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\My Documents\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\My Documents\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\d25f591a00514bc9ba8441\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\d25f591a00514bc9ba8441\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\d25f591a00514bc9ba8441\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Downloads\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Downloads\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\d25f591a00514bc9ba8441\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\d25f591a00514bc9ba8441\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\d25f591a00514bc9ba8441\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteApps\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteApps\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Videos\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Admin\Videos\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Videos\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Fonts\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\Fonts\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\it-IT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\IME\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\7e20f84d5244aba7145631d4073af8\fontdrvhost.exe

Filesize
1.9MB

MD5
4211e11d9a2e2d47e2a10c70cefa2565

SHA1
86d98f062585f196a8f57ac090087ad9f11a98ed

SHA256
37856a1d1c58b3182c768e6933dd321a32427019cd7134652ea5b9583f35f2e4

SHA512
de26259391b9f1ab59de581fc2fe5a01f6a69b5df4809c74783b9effbebd80f1c1316f1fe95e46397330b853acb0e605148dca77ef98d31058602c2f753b60ba

Download Submit
C:\Program Files (x86)\Windows Media Player\Idle.exe

Filesize
1.9MB

MD5
34655ac11b4f6a8d6f1ea8e2fbbe0676

SHA1
d17ed388047ec77145ef4c96e3760ea94985caa7

SHA256
75b2e0c469d7b50ea3a5f022b84db475f4009e17265ead71e5a68a9a90a44688

SHA512
2c2bf7b06e1a6ddfc2bbfe21a9c1a21cea9a33015ad62837dd1dee81e8a096b951c1dae3f3a95ae052f014e563b040da9d3ee9c96565116933603a99ab9e61e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
364147c1feef3565925ea5b4ac701a01

SHA1
9a46393ac3ffad3bb3c8f0e074b65d68d75e21ef

SHA256
38cf1ab1146ad24e88763fc0508c2a99478d8428b453ba8c8b830d2883a4562b

SHA512
bfec1d3f22abd5668def189259deb4d919ceb4d51ac965d0baf9b6cf8bea0db680d49a2b8d0b75524cc04c7803cdfd91e484b31dc8ddc3ff47d1e5c59a9e35cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e69ced0a44ced088c3954d6ae03796e7

SHA1
ef4cac17b8643fb57424bb56907381a555a8cb92

SHA256
49ee2b78c2766e68fad51109337710f032e25649bcebebf14562edfbf2e98108

SHA512
15ebe961c61ee8efadd8370d856c936e5b605c3b847b8ddabb3cafb63c724d374a0a9567054852444de95794c7c8b3f9f12d05258104573c7546ff88023d7cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fdbc304f3d894fc63c481c99aa258017

SHA1
47cd3a7cae4dbf6bdd92532bbb69224a75221b86

SHA256
58c02d17c622f9ffc1744d26a3be409d7a95796119bcea540e54dcf687c8abb3

SHA512
18923c6b620a47d59377bdffd8dbf9717750a52980530cd67c169704649e471b1583eda2045cc7db84e560a9672759f8ea0c3a5ab45d4f328e17aa6e0ca5fae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
94f35f261590c8add6967ae13ee05fab

SHA1
e0e5828e2c4b7d1937fde13dbfcc63f59c1899c7

SHA256
db908d6ae1a8ae3e77e93332eaa24f8316aa9e65285996439d35a133024e1a63

SHA512
3e3438bc5e8dfe738d8cf374d444f9f8600cadac6071708426b7852d3a84f0363f79ae6895f11206b5c7fbb8c850725318196c4171112634cfef3d2d70d1e8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3357c199be211a745818714039e25935

SHA1
7d50d07ff2e234f3d10a88363796cbd615b1e9a3

SHA256
668bb751b77a8c5c53c7efcb71e3ee9b2902388e0503e6d6ad3647587a0a0a38

SHA512
052751067bede3dba675313a1c0d88c0e76d62bbc903dbd9ba4cf2b8d03530716c021926bbe34242af9516a77e27df080d1cedde04d8cb51c88c1484ea8a1077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e1c41ab70e6e5907330c398d5789b851

SHA1
39dbfc40fb75793d222369e59ae5d784f5c3b7a3

SHA256
90c7c4c7f4671b52194b8e5d5e43715003581b96ee6418ced8c3bab9329a1fad

SHA512
a5e07a6316a8142a0680d9ae73890daabb18de56540ed1025f1a7a463b7992854b7b31c537d8e1a32deaf8864dfacc88fb2203c22891643f9e1ddc713968c3fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f26021db51b2ceb0c03baf5665a86386

SHA1
5487265d705c72daa8495c543f2182a64b373da3

SHA256
56a4d25798b8d3102fec5025892dd6ff79500aee72db311e82b1308f1783db6f

SHA512
e09f018d22c3dee7ff7dbd6d79182e5c94be1aba0ceaeef3652d254712fa8393dc81002e20de3749abd3420ce0ed23dee176fa50eeaf80d6ee09a9dae2a1a49f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6f1be790-c663-41d8-ad57-388ff40f3d21.vbs

Filesize
705B

MD5
efee26695151ca48cf14c5eace316fd4

SHA1
3288d949e6e069b09041403d5e149dc82127c83e

SHA256
38f5e0ff8f7b702d32de7a6f2dd45ebd34b8d548e3f0e6b0857062a6e187435a

SHA512
2cc1caf2c3058bafd8065152c5387cf55a63e0af377a560289620e91257ef1aeda02c549f8e3651d212fd441d10c71d35e97ca6cb9ddcd2cb10ac7ecd8f49856

Download Submit
C:\Users\Admin\AppData\Local\Temp\78f3b82f-3961-42b8-90a2-5096834a78c7.vbs

Filesize
705B

MD5
1045ac74f0b03a2abbbf17afe022fec6

SHA1
2367924543c7bcba4a6777fe82bad23bed8ca3ef

SHA256
507733bafb7fbcda1cc29f2040359d000aa2943a6c496c7661094b60205e87c6

SHA512
9f6963c83b987e062e76943208249e9e74e07522744ba4b1966ecae57099892775e6b483c21834a5d18f439c4eb5243ceaa524a26ae932d28d49ab2d8363999e

Download Submit
C:\Users\Admin\AppData\Local\Temp\FU5t9pRjNL.bat

Filesize
194B

MD5
4bba262541f501fc11d00d95bd6def69

SHA1
0e7f19bfe38eca09327dea417146e70cff548f88

SHA256
ad8bbf11ce0e496c83e9e4e7a7a5f03719d808bd60c44a3a16897338fa55f139

SHA512
14b177a56947d8d73aeec9e484c48297f901b29f73e052cd33e54f98ba4d3a8862f88d0b42171d6226dcae7cc9ffeb3d8587971aad0a8adf72cbbda200b6b6c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2bixyh1.p2b.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3dd17b7-d646-4a7c-90ab-4df43ebab7a4.vbs

Filesize
705B

MD5
fb2ce8b99939ec54e50d3ce320c9d331

SHA1
85f9904a75f160e13898b12d233fc3727bc8ced4

SHA256
6e7272450e0b0eb74f3701d7561a7f4759f584d278758cec266e6a00fe3b879b

SHA512
25c25e69dbd8adb382bcec9b1f410d4c8cecd8f957e466e26f64afe9bf9093f8b129b9742f7ae919744c461c00ba8ebabf811ba0171a2b28211b836ebd3eb16d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbe95dde-77dc-485e-998e-026781b0cde6.vbs

Filesize
705B

MD5
21133d4011dc426e82e63bfe99af0e5e

SHA1
67f1b155564729b143d2e18145f17f829e5fb954

SHA256
25e66a6113a11f92c7e0b56505895cdb39c1e98412b53a6645bfd90459f9650b

SHA512
82c45c6af8e12be394da328cb82d6635c6280fe789779ca8401968066d5904b6c958058993de9501d570a8b6d9c41b1cd2ffe570ae00a8b9777e96f6602e91e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\d11f1b7c-a954-43ab-a1c4-35391b5dbf56.vbs

Filesize
705B

MD5
ec32179519350dad6cd5efb85c34e520

SHA1
bdad35aa4e548e23fb5eff734acbcddb0e4ad2b9

SHA256
24f7c3785d6b70aa7b82a2d6786528d55414cb6622a7cc72501b0b9e464f5a8f

SHA512
fbe384ba097463409d09a4f34c659a85745e02a2579e7e81f1535f3fa1b13ca487d8480999b13f8508eea586db5b7a31c0dd3b74fd60c6aa47b6924d2eb818a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\e83f49d5-15c7-4a0b-88b0-42e5c171766c.vbs

Filesize
481B

MD5
0267004bd458085a9d9c2c172450162c

SHA1
8f386d4e2e9474e268b4ed3a042ceb6ad1518fdd

SHA256
f4b955fdc79db556d54187c2d37438be43a5925cb148a741e8874be275c3b60e

SHA512
cee3bfcb0b324dc127d56521949ed64447e37709b7fbb85c0ee60e5a87210d6c9a8a4ff34ab1f18b850aef792014894249637a490f4608ba7583782497a3116b

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb1e9304-a752-4fad-b32a-e49d646fbca0.vbs

Filesize
705B

MD5
c3f6fab623c6831bae31451763714e35

SHA1
d220fc77c56ac0199821f7ec6931d34bff5440e3

SHA256
3d0ab0f1214d7d5142772e295cc12f56dd4b503203fbfcc1dc4fced93245cb00

SHA512
1ac2552dba7942c925ee7f650f6dd884d42b246a1513b3239fee947c7529e676acf03714ed6855a9f488dec31a7cf4e42cbab4b16f69bd3e51284999b255475b

Download Submit
C:\Users\Admin\Documents\spoolsv.exe

Filesize
1.9MB

MD5
829c6632311527c03989a87da17b8ff4

SHA1
07b8bfebb59abb088cb317dd455d17bf3d7d7295

SHA256
1fd79f21ade48522f8c0ec011ec769fc8620cf76bb09d20b15d98e462b6a336d

SHA512
d9bbe3e10c0803f636d2db3bf3afafb9e051225a02d497c569b3a08687eccc7e21d37abc39a4bfb6192e4f8cbb69e0324c8bf2eb7d829f4afed33117f99275dd

Download Submit
C:\Users\Admin\Videos\unsecapp.exe

Filesize
1.9MB

MD5
9150586ba7515586a183afc953e89415

SHA1
14f818da771a431ed419d41e565292e9bc8dd552

SHA256
d06dba3893a5279e7ff53358962e4d2e9da39c60232b0dd4efe9faad1a529e2f

SHA512
742d8d39f98bb808ceb49000ff70fa799924c017ee395924ae7e34ec02aaf795a32333203c74f352c94450a08aaab05fb118c35424bb9508f41fc37364c17eb2

Download Submit
C:\Windows\IME\it-IT\RuntimeBroker.exe

Filesize
1.9MB

MD5
b523df3885f88b3780493ae39e2eae84

SHA1
a0f851d9989e89f00dec4d44a4b649c17848ff77

SHA256
d90a09ca170421f1c948ce876e485e24075b3853ebc4a827587ddd72b42d7089

SHA512
2144819816a1c2691dd10024d61242f8787995a1eebe4b57a9dd8b2c327fb9eb3ac1d2ed13024139b69077583546ea98052448906d1c709709607cfc6c08f403

Download Submit
C:\Windows\RemotePackages\RemoteApps\StartMenuExperienceHost.exe

Filesize
1.9MB

MD5
7fe727db381843354dc584088bf27833

SHA1
de9cc6e8fac00b80db87bbbc0130a89bd3f4ddb1

SHA256
2783848156c868215879db1e7c0e97063451d5c19a75514e0de5de7201d041ed

SHA512
0e2beecae8ac8c71ea7eb9f2e33fe8c925a7a0c9d82fa99a2c50a602f81e816d224ee00d7de9765c895e37ad898e189f8a9d430b0b42e841b4e78dacab333128

Download Submit
memory/3068-230-0x00000162C12C0000-0x00000162C12E2000-memory.dmp

Filesize
136KB

Download
memory/3960-404-0x000000001B510000-0x000000001B566000-memory.dmp

Filesize
344KB

Download
memory/4464-391-0x000000001B7C0000-0x000000001B816000-memory.dmp

Filesize
344KB

Download
memory/5460-13-0x000000001BA70000-0x000000001BA82000-memory.dmp

Filesize
72KB

Download
memory/5460-10-0x000000001BA50000-0x000000001BA5C000-memory.dmp

Filesize
48KB

Download
memory/5460-16-0x000000001BC60000-0x000000001BC6A000-memory.dmp

Filesize
40KB

Download
memory/5460-18-0x000000001BC80000-0x000000001BC88000-memory.dmp

Filesize
32KB

Download
memory/5460-245-0x00007FFE742D0000-0x00007FFE74D91000-memory.dmp

Filesize
10.8MB

Download
memory/5460-19-0x000000001BC90000-0x000000001BC9C000-memory.dmp

Filesize
48KB

Download
memory/5460-17-0x000000001BC70000-0x000000001BC7E000-memory.dmp

Filesize
56KB

Download
memory/5460-15-0x000000001BAA0000-0x000000001BAAC000-memory.dmp

Filesize
48KB

Download
memory/5460-14-0x000000001C540000-0x000000001CA68000-memory.dmp

Filesize
5.2MB

Download
memory/5460-0-0x00007FFE742D3000-0x00007FFE742D5000-memory.dmp

Filesize
8KB

Download
memory/5460-11-0x000000001BA60000-0x000000001BA68000-memory.dmp

Filesize
32KB

Download
memory/5460-191-0x00007FFE742D0000-0x00007FFE74D91000-memory.dmp

Filesize
10.8MB

Download
memory/5460-9-0x000000001B4A0000-0x000000001B4F6000-memory.dmp

Filesize
344KB

Download
memory/5460-179-0x00007FFE742D3000-0x00007FFE742D5000-memory.dmp

Filesize
8KB

Download
memory/5460-8-0x000000001B490000-0x000000001B49A000-memory.dmp

Filesize
40KB

Download
memory/5460-7-0x000000001B470000-0x000000001B486000-memory.dmp

Filesize
88KB

Download
memory/5460-5-0x0000000001160000-0x0000000001168000-memory.dmp

Filesize
32KB

Download
memory/5460-20-0x000000001BCA0000-0x000000001BCAC000-memory.dmp

Filesize
48KB

Download
memory/5460-6-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/5460-4-0x000000001BA00000-0x000000001BA50000-memory.dmp

Filesize
320KB

Download
memory/5460-3-0x000000001B450000-0x000000001B46C000-memory.dmp

Filesize
112KB

Download
memory/5460-2-0x00007FFE742D0000-0x00007FFE74D91000-memory.dmp

Filesize
10.8MB

Download
memory/5460-1-0x0000000000650000-0x000000000083A000-memory.dmp

Filesize
1.9MB

Download
memory/5740-449-0x000000001C310000-0x000000001C366000-memory.dmp

Filesize
344KB

Download