dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
Size

1.6MB
MD5

522b3cc9b8e0565c5a2eb2d40b7a9513
SHA1

86d71ba007afecc0f28e9815086992099a13f2c4
SHA256

86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12
SHA512

a22e86028dc923064c045563341d3c144f9d3473935c8ebecf54e2a6ab4afb5b21d2cc0a80f92dc96ceb294dbbf2a33ebc48122079acb62f9ec140230e3e6c73
SSDEEP

24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5596	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5160	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5928	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5912	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6012	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6036	3940	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	3940	schtasks.exe	88

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral26/memory/1316-1-0x0000000000D20000-0x0000000000EC2000-memory.dmp	dcrat
behavioral26/files/0x0007000000024336-26.dat	dcrat
behavioral26/files/0x0009000000024361-61.dat	dcrat
behavioral26/files/0x000d0000000233a7-72.dat	dcrat
behavioral26/files/0x000d000000024149-95.dat	dcrat
behavioral26/files/0x0008000000024339-150.dat	dcrat
behavioral26/files/0x000900000002434a-186.dat	dcrat
behavioral26/files/0x0008000000024355-210.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3720	powershell.exe
5784	powershell.exe
5968	powershell.exe
3816	powershell.exe
4044	powershell.exe
1528	powershell.exe
3580	powershell.exe
452	powershell.exe
1840	powershell.exe
5600	powershell.exe
5996	powershell.exe
3488	powershell.exe
4936	powershell.exe
1384	powershell.exe
3304	powershell.exe
912	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 13 IoCs

pid	Process
4604	RuntimeBroker.exe
4480	RuntimeBroker.exe
2304	RuntimeBroker.exe
5916	RuntimeBroker.exe
4276	RuntimeBroker.exe
1416	RuntimeBroker.exe
5908	RuntimeBroker.exe
3876	RuntimeBroker.exe
2620	RuntimeBroker.exe
5316	RuntimeBroker.exe
1528	RuntimeBroker.exe
5336	RuntimeBroker.exe
4248	RuntimeBroker.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\RCXD7FC.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\RCXE39F.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCXE620.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files\Uninstall Information\22eafd247d37c3	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\edge_BITS_4576_864690144\RCXDE8A.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\RuntimeBroker.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCXE621.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXE836.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\Uninstall Information\TextInputHost.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Adobe\backgroundTaskHost.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files (x86)\Adobe\eddb19405b7ce1	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files\edge_BITS_4576_864690144\wininit.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\RuntimeBroker.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\edge_BITS_4576_864690144\wininit.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\9e8d7a4ca61bd9	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files\Uninstall Information\TextInputHost.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files (x86)\Adobe\RCXD7FB.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\RCXE39E.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXE8B4.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\edge_BITS_4576_864690144\RCXDE89.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files (x86)\Adobe\backgroundTaskHost.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files\edge_BITS_4576_864690144\56085415360792	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\886983d96e3d3e	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Containers\serviced\RCXF0F7.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\ServiceProfiles\SearchApp.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\ServiceProfiles\NetworkService\taskhostw.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\ServiceProfiles\NetworkService\ea9f0e6c9e2dcd	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\ServiceProfiles\RCXD354.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Containers\serviced\SppExtComObj.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\ServiceProfiles\RCXD355.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\ServiceProfiles\SearchApp.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\taskhostw.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Containers\serviced\RCXF079.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\ServiceProfiles\38384e6a620884	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Containers\serviced\SppExtComObj.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\RCXD569.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\RCXD5D7.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Containers\serviced\e1ef82546f0b02	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1724	schtasks.exe
4868	schtasks.exe
5912	schtasks.exe
3832	schtasks.exe
4704	schtasks.exe
1520	schtasks.exe
3912	schtasks.exe
5596	schtasks.exe
4544	schtasks.exe
1668	schtasks.exe
2460	schtasks.exe
4796	schtasks.exe
4696	schtasks.exe
4792	schtasks.exe
3452	schtasks.exe
4776	schtasks.exe
6036	schtasks.exe
4860	schtasks.exe
1980	schtasks.exe
2108	schtasks.exe
1560	schtasks.exe
4680	schtasks.exe
2672	schtasks.exe
4656	schtasks.exe
1448	schtasks.exe
3724	schtasks.exe
4768	schtasks.exe
3548	schtasks.exe
5080	schtasks.exe
2976	schtasks.exe
1252	schtasks.exe
4452	schtasks.exe
4592	schtasks.exe
4728	schtasks.exe
5928	schtasks.exe
3028	schtasks.exe
3572	schtasks.exe
4160	schtasks.exe
4604	schtasks.exe
4888	schtasks.exe
6012	schtasks.exe
2752	schtasks.exe
380	schtasks.exe
1072	schtasks.exe
5160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
1384	powershell.exe
1384	powershell.exe
5784	powershell.exe
5784	powershell.exe
5996	powershell.exe
5996	powershell.exe
4936	powershell.exe
4044	powershell.exe
4936	powershell.exe
4044	powershell.exe
5600	powershell.exe
5600	powershell.exe
452	powershell.exe
452	powershell.exe
5968	powershell.exe
5968	powershell.exe
3304	powershell.exe
3304	powershell.exe
912	powershell.exe
912	powershell.exe
1840	powershell.exe
1840	powershell.exe
1528	powershell.exe
1528	powershell.exe
3816	powershell.exe
3816	powershell.exe
3488	powershell.exe
3488	powershell.exe
3580	powershell.exe
3580	powershell.exe
3720	powershell.exe
3720	powershell.exe
3816	powershell.exe
3720	powershell.exe
1528	powershell.exe
3488	powershell.exe
1384	powershell.exe
1384	powershell.exe
4044	powershell.exe
5784	powershell.exe
5784	powershell.exe
4936	powershell.exe
5996	powershell.exe
5996	powershell.exe
5600	powershell.exe
5600	powershell.exe
5968	powershell.exe
1840	powershell.exe
912	powershell.exe
3580	powershell.exe
3304	powershell.exe
452	powershell.exe
4604	RuntimeBroker.exe
4604	RuntimeBroker.exe
4480	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	5784	powershell.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	5600	powershell.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	5968	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	4604	RuntimeBroker.exe
Token: SeDebugPrivilege	4480	RuntimeBroker.exe
Token: SeDebugPrivilege	2304	RuntimeBroker.exe
Token: SeDebugPrivilege	5916	RuntimeBroker.exe
Token: SeDebugPrivilege	4276	RuntimeBroker.exe
Token: SeDebugPrivilege	1416	RuntimeBroker.exe
Token: SeDebugPrivilege	5908	RuntimeBroker.exe
Token: SeDebugPrivilege	3876	RuntimeBroker.exe
Token: SeDebugPrivilege	2620	RuntimeBroker.exe
Token: SeDebugPrivilege	5316	RuntimeBroker.exe
Token: SeDebugPrivilege	1528	RuntimeBroker.exe
Token: SeDebugPrivilege	5336	RuntimeBroker.exe
Token: SeDebugPrivilege	4248	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1384	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	139
PID 1316 wrote to memory of 1384	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	139
PID 1316 wrote to memory of 5996	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	140
PID 1316 wrote to memory of 5996	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	140
PID 1316 wrote to memory of 5784	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	141
PID 1316 wrote to memory of 5784	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	141
PID 1316 wrote to memory of 3720	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	142
PID 1316 wrote to memory of 3720	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	142
PID 1316 wrote to memory of 3580	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	144
PID 1316 wrote to memory of 3580	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	144
PID 1316 wrote to memory of 3488	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	146
PID 1316 wrote to memory of 3488	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	146
PID 1316 wrote to memory of 1528	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	147
PID 1316 wrote to memory of 1528	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	147
PID 1316 wrote to memory of 5600	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	149
PID 1316 wrote to memory of 5600	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	149
PID 1316 wrote to memory of 1840	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	150
PID 1316 wrote to memory of 1840	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	150
PID 1316 wrote to memory of 4936	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	151
PID 1316 wrote to memory of 4936	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	151
PID 1316 wrote to memory of 3816	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	152
PID 1316 wrote to memory of 3816	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	152
PID 1316 wrote to memory of 912	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	153
PID 1316 wrote to memory of 912	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	153
PID 1316 wrote to memory of 5968	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	154
PID 1316 wrote to memory of 5968	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	154
PID 1316 wrote to memory of 452	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	155
PID 1316 wrote to memory of 452	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	155
PID 1316 wrote to memory of 3304	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	156
PID 1316 wrote to memory of 3304	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	156
PID 1316 wrote to memory of 4044	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	157
PID 1316 wrote to memory of 4044	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	157
PID 1316 wrote to memory of 4604	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	171
PID 1316 wrote to memory of 4604	1316	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	171
PID 4604 wrote to memory of 5640	4604	RuntimeBroker.exe	173
PID 4604 wrote to memory of 5640	4604	RuntimeBroker.exe	173
PID 4604 wrote to memory of 844	4604	RuntimeBroker.exe	174
PID 4604 wrote to memory of 844	4604	RuntimeBroker.exe	174
PID 5640 wrote to memory of 4480	5640	WScript.exe	175
PID 5640 wrote to memory of 4480	5640	WScript.exe	175
PID 4480 wrote to memory of 5360	4480	RuntimeBroker.exe	176
PID 4480 wrote to memory of 5360	4480	RuntimeBroker.exe	176
PID 4480 wrote to memory of 1304	4480	RuntimeBroker.exe	177
PID 4480 wrote to memory of 1304	4480	RuntimeBroker.exe	177
PID 5360 wrote to memory of 2304	5360	WScript.exe	186
PID 5360 wrote to memory of 2304	5360	WScript.exe	186
PID 2304 wrote to memory of 5212	2304	RuntimeBroker.exe	187
PID 2304 wrote to memory of 5212	2304	RuntimeBroker.exe	187
PID 2304 wrote to memory of 4136	2304	RuntimeBroker.exe	188
PID 2304 wrote to memory of 4136	2304	RuntimeBroker.exe	188
PID 5212 wrote to memory of 5916	5212	WScript.exe	189
PID 5212 wrote to memory of 5916	5212	WScript.exe	189
PID 5916 wrote to memory of 5556	5916	RuntimeBroker.exe	190
PID 5916 wrote to memory of 5556	5916	RuntimeBroker.exe	190
PID 5916 wrote to memory of 3620	5916	RuntimeBroker.exe	191
PID 5916 wrote to memory of 3620	5916	RuntimeBroker.exe	191
PID 5556 wrote to memory of 4276	5556	WScript.exe	192
PID 5556 wrote to memory of 4276	5556	WScript.exe	192
PID 4276 wrote to memory of 1188	4276	RuntimeBroker.exe	193
PID 4276 wrote to memory of 1188	4276	RuntimeBroker.exe	193
PID 4276 wrote to memory of 548	4276	RuntimeBroker.exe	194
PID 4276 wrote to memory of 548	4276	RuntimeBroker.exe	194
PID 1188 wrote to memory of 1416	1188	WScript.exe	195
PID 1188 wrote to memory of 1416	1188	WScript.exe	195

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
"C:\Users\Admin\AppData\Local\Temp\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\backgroundTaskHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Searches\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4576_864690144\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\7330c8a20692d0b35002ea5a\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\TextInputHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\7330c8a20692d0b35002ea5a\sysmon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\SppExtComObj.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
  "C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1244d92-5129-49ba-a8be-91f831e8af61.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5640
  - - C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
      C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22e1aabb-e38f-4110-af3f-9b105ef33fc8.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5360
      - C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\976dc5c8-2b4d-4e6f-bf22-86c423b55bb0.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5212
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe5c363f-cbf8-40fb-98e7-d178a7ebacfa.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5556
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ea92186-d602-4d99-83ac-0f21aa14f121.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f12a3fbd-0228-4a22-8913-44b7eb2f0aad.vbs"
        13⤵
        
        PID:6052
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3886cc49-b810-4b94-8507-4dbc26c3c971.vbs"
        15⤵
        
        PID:2608
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d54df874-b8f7-4800-b747-79272bbab297.vbs"
        17⤵
        
        PID:2168
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c01da59-e0d7-499e-8352-883db5be1fa7.vbs"
        19⤵
        
        PID:3560
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24a520aa-b07a-47b9-8d01-b0e6ac76e389.vbs"
        21⤵
        
        PID:4336
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f788efc-5965-4d2a-8638-e79506fef1bd.vbs"
        23⤵
        
        PID:5232
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b6db04f-f59c-43d6-94d6-dee190c32cb3.vbs"
        25⤵
        
        PID:5652
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        
        C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8458511-2513-4f14-b192-65b5a5fbb82f.vbs"
        27⤵
        
        PID:4884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4756470-a4a5-4f5d-a01c-c0b3e81bf58b.vbs"
        27⤵
        
        PID:3824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10b5992e-d7f9-4e4c-b7e2-a82f86ae5ecc.vbs"
        25⤵
        
        PID:5612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86044448-32ec-4cc6-b1e4-255052faa4b4.vbs"
        23⤵
        
        PID:1924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd2d0f7c-b22e-499a-9545-03afa6924350.vbs"
        21⤵
        
        PID:380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9bd22eaa-0c93-4669-b844-ce6e4842cba0.vbs"
        19⤵
        
        PID:4396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12481b12-0953-4086-8d9c-1fe1b1b60417.vbs"
        17⤵
        
        PID:3460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\157e34d0-daa2-45a5-8617-762fcdc0ed5c.vbs"
        15⤵
        
        PID:1668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0221ebb7-bc90-4b12-be13-d355151fa8d8.vbs"
        13⤵
        
        PID:2544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60190aee-56d4-4875-a942-ef4ef3825d52.vbs"
        11⤵
        
        PID:548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f0a5285-de34-41cb-a3d5-a4cc21ad9a53.vbs"
        9⤵
        
        PID:3620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ff92d02-ad09-447b-85b7-c146954d9888.vbs"
        7⤵
        
        PID:4136
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\772f040d-d24a-4d71-809a-1b1c5725c227.vbs"
        5⤵
        
        PID:1304
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2308dd47-6235-4cba-83dc-48bf9587dbc9.vbs"
    3⤵
    PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Windows\ServiceProfiles\NetworkService\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Windows\ServiceProfiles\NetworkService\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Searches\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Admin\Searches\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Searches\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\edge_BITS_4576_864690144\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4576_864690144\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\edge_BITS_4576_864690144\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\7330c8a20692d0b35002ea5a\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\7330c8a20692d0b35002ea5a\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\7330c8a20692d0b35002ea5a\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\7330c8a20692d0b35002ea5a\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\7330c8a20692d0b35002ea5a\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\7330c8a20692d0b35002ea5a\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\7330c8a20692d0b35002ea5a\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Windows\Containers\serviced\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\7330c8a20692d0b35002ea5a\OfficeClickToRun.exe

Filesize
1.6MB

MD5
4139f32ae1311cf8dececa1a3e5ba793

SHA1
2ce35296782ccec2bc4d6251a7987cf81f62de20

SHA256
da9741f4c4a552d22e16e9ef5fefb509cbbab9c63e99025ad281d1fa9b705805

SHA512
4a369ebfebae4ee623413c0f0a0ce2398c210f6da3810c7d78cad9d779838d74081bbb6ed3a77e614a768ecb3d1070aa31918aba4f26501a622a8d959da97acb

Download Submit
C:\7330c8a20692d0b35002ea5a\sysmon.exe

Filesize
1.6MB

MD5
44d8f0b81c1e0aa11c1d031e08048687

SHA1
494c094e3b104e04efbc3fd4719cc9f468bbccd2

SHA256
7a3f9ec94cc89ceddaebf682f4eaff21c167dcf02abf53aac8d0d7cb6e2bf16b

SHA512
abca947fa58245c8084ba3298bafdea4016a991d6e1dc60bc2076a8abc046babfd7205cf9f1ac0ac4e775a2de0c21f92bb4b9a35cee0bc721d3c9245cc0a0f25

Download Submit
C:\Program Files (x86)\Adobe\backgroundTaskHost.exe

Filesize
1.6MB

MD5
522b3cc9b8e0565c5a2eb2d40b7a9513

SHA1
86d71ba007afecc0f28e9815086992099a13f2c4

SHA256
86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12

SHA512
a22e86028dc923064c045563341d3c144f9d3473935c8ebecf54e2a6ab4afb5b21d2cc0a80f92dc96ceb294dbbf2a33ebc48122079acb62f9ec140230e3e6c73

Download Submit
C:\Program Files\Uninstall Information\TextInputHost.exe

Filesize
1.6MB

MD5
c3a593c4a0aead9c11b2373ddaeb77a8

SHA1
d02488e2be1c29c33240d0a5ac910b28df688ae8

SHA256
73cfbbd254e70382c3089d2f5dcd8bfe8362f694c16a75d523330a649dc173d5

SHA512
90a06439d55db79a4cdf5a3d641d95a43aebcf52cb620991ad5d24ec5d6bc8406a5ddf022b405f4a820f79a906b8df849e5b68bb02b90c5d4ffc37de1a2cc3a5

Download Submit
C:\Recovery\WindowsRE\upfc.exe

Filesize
1.6MB

MD5
1927a45627407c8b287b955a23065201

SHA1
9d6275aae0339da96dae043cc81d9abe627ab22a

SHA256
1818934b61960c0230563a5c115e9772236f7611382674a9ff13512dfa69cf8a

SHA512
10a89a253cfeccbe59ef3a2b84168320c857fe02de0fe60098533035de0061401dd8109576020417a98f9ec8be791b517ff13aed6211ff944a0b33e33814dc79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5298af510096b88490b00b468206c966

SHA1
afc8d92a832bf530001e9d7bce0a917067b1a753

SHA256
d1dae534bb9fc91682d16c2a30657cf3eafa4db82fec8d1477dde2d0e9af5a18

SHA512
9653df3b73599ad282259e3990d18b4e56f556d6fbc33697293503cc88738473245f7507b571059460ce57e6267219bc7b95ed1e90c198d0726a13b91427419e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
af1e26d635495e7a52c5dc500610ee76

SHA1
7cffa44b70451795e240e707ca3c134b15fe4837

SHA256
3505a6078d79916aa201ce904383522973f0aed79ce19f86d74a879f81ce6980

SHA512
b6cabf85d7c177df9b81cb3e902171ad1cad43dbb6b21fa5735f8393a7b7cacbd1ac6bc4456be691070fec964c10d867e2db29efd7c6c7581ab3bbecac57a534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
210a7332dab4b7beeb837a8d733effb7

SHA1
04d1d6dd4d3be5261446e14a6671bd8e64736c6b

SHA256
7cba482ca75e6fe444c5b7b58bb4a5725c0fa42c90298ffab0649b9e88b2760c

SHA512
4e39940735dd854e65a67fc665ddb5a33fb69b86e3eb06dbcc9dfdbd843ee0479272840450fb39172c13daed3f3fe4d84355899cf066451e7b656da22b28d2bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
af1324e7a4e3e6cfc7ee7add0391f0b9

SHA1
19117163248a95e5ceb83b6dc8c21e396f33bcaf

SHA256
a31abfc5cc0132c488495c81046d7f3c7eed1e7a6923d94ffd85b58436871a52

SHA512
6a05a892ec41527782b418a2f232300da84eff105b2d9c1cb55c7e9ce1ef13beab2d57b4bf3cc73d1e5b2710010f3622500c4d8e0cb2fa8e5365b6ff007e9d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9ea4fdbf8bad883929456091a1e50194

SHA1
fc3b6026729ad36729c2cc4349b8e7a94255ad71

SHA256
ca2f5b4e41b386c2f09fb10d2cf78cd395b614ea6c7c11ec155b415550262e2e

SHA512
27bdd15bf73b9fe22005834e083c1e05919532a4f3eb4c4c41727f8175f35ab2119625ee7d8cc0ab86e00631393c8c839f05dcd3cdcd6644b83de41649472211

Download Submit
C:\Users\Admin\AppData\Local\Temp\22e1aabb-e38f-4110-af3f-9b105ef33fc8.vbs

Filesize
721B

MD5
9a2941d67baf239bb3222a4b0a7ac917

SHA1
3c936fd34f8515c73ca872c9cfd2c9aae16e805f

SHA256
67a6e1e7db89446a65792fee06a38302595cea9a0c2f87a9a12ed0bba8591bbe

SHA512
62c82c3bd33c13d4b06fd406bf370ed3dd7c8030cfddadf9fe2e6dd1a2b1ecb4d5c1d7afb14e727ed2f5cdde6a398761f29a9437b1a39284d8d821ea29a94b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2308dd47-6235-4cba-83dc-48bf9587dbc9.vbs

Filesize
497B

MD5
670b4d455d0fb0e7597f15f3b85b5a9a

SHA1
b85e2d450eb39da405e5f33091406ddf90258a1e

SHA256
247993108c2609742c9b5b911c5d2ad20423e211be014d98a868d997da76d727

SHA512
a7ed0a7656ddf69a16897241aa28dacfc442440b017401296e6f5e81e070b0a09e2a3bbd87dbaf63c8ffeb6661d63d0748f5e27d07c71393dfb6bc4c08edf3ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\24a520aa-b07a-47b9-8d01-b0e6ac76e389.vbs

Filesize
721B

MD5
6e84aa1ecd73a50a893bfd97e6fa4a60

SHA1
f398bb118709e13ac3e73451a84c58a12d520220

SHA256
4eaf391e5303508b9239519ce5213c9abe94e8a57a7c10924dff1bbe6af20076

SHA512
8b5386619e2cd212eb2d06aec320c17c15910bfc0b021c6e329768f068fe441d85c9dab366c8261717efc7a937d0b453c698ece301d7c16f8fd5922924973f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ea92186-d602-4d99-83ac-0f21aa14f121.vbs

Filesize
721B

MD5
bbb1f728f562f2d14c2b03bd0aebad1d

SHA1
d754872cc35af8ef73bd5a8e1d8e6a7efc8a925a

SHA256
262fd8f562be68f77face7d61c5eb479c8f20ae687f15db632189f6c95c685bc

SHA512
54db37b2ffbb9ead251036413eb639bfee8981c546ae35fe496274f474a9baa860ba132c79bd84d235e038e746e883fda6ffeb597ffdf5f720b98952187b93cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2f788efc-5965-4d2a-8638-e79506fef1bd.vbs

Filesize
721B

MD5
0b5306919ce4684b9e645c14026fd79e

SHA1
4f13aedbc6e0682de5404d30b0b470116d96ba95

SHA256
8d890ba98c6b6850d51508b0d1087d574f79f0d00d643ae6f3c761c0dfa9bb68

SHA512
4a9b3d742960293adfea433e5dc2693f45eabedfce8ce6a4c389373a00ccaac6be8cb07def3d6c876fc1b5264e5e077ce59a406c8bae0d1518146b88c7a6072c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3886cc49-b810-4b94-8507-4dbc26c3c971.vbs

Filesize
721B

MD5
f09ab11f81aec33b5252d1e2f42d8918

SHA1
e2cc206db6459e1e345a49e15fa2492d5d8cb47f

SHA256
4fc03420f00987994b60c9754f3bcdc57f2bc20bae44f38cc1635c8117750215

SHA512
f041cf20b6caa92ceab8c8668271d5b3569e6ac704e994b0e9bece91def5a9da37b4362163c1aee00f8bc9825ed3812d6d8595f8778e3d5374c4dc84eb0f0244

Download Submit
C:\Users\Admin\AppData\Local\Temp\6b6db04f-f59c-43d6-94d6-dee190c32cb3.vbs

Filesize
721B

MD5
f0e14d8f6d3e23dc96b18a692004165e

SHA1
1550581620e872ff5f0fea73493bd218a8f63197

SHA256
fc3eb6229810c29dd18849516e0998246a24593a0a4c4ad3ea5d26e605c6d055

SHA512
8abbbe3abe852ebe9552fb79e156a855759e4fdcd68667744d4f29fd6669cb140e8ab71eba6b6f53ee8c8e4a780af52f16992cb32fc24abba3fd6aa9984d8f6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\976dc5c8-2b4d-4e6f-bf22-86c423b55bb0.vbs

Filesize
721B

MD5
8ef0a6e6b23870ce898e08dc95715bf9

SHA1
8c60e75d6bca4b8afa6652f1f1de9a519940239d

SHA256
b1afc6552ea77cd0a5bcf1c45393d1de8d6b6beec39d2040227a3271ebcafe2c

SHA512
c8207154d4e9a04a7f45f5f1a356364f69cc3f65fec2d22424ad3f126b0d350706895e77728f2167cdb03885c818d70f1993b5b36b45c6d1968607b8dbc8fc41

Download Submit
C:\Users\Admin\AppData\Local\Temp\9c01da59-e0d7-499e-8352-883db5be1fa7.vbs

Filesize
721B

MD5
5ce76734f1583a2383f58f360a9dcf2f

SHA1
6079ccae196a51808eda2744e42bf0c54722c2cd

SHA256
f12c0909928977fbe34d73bc4d31b54ddef5db85299dce0c8c95da3a3221828c

SHA512
42064258abb27af5e9257958e2fe295f5fae0ad551c697faeaba8c383c5037f243e462fab380d92188e5ebc338f0e41bac5d0a36fecbb1191a71ae7473d7c00e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2rlj11u1.5dr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1244d92-5129-49ba-a8be-91f831e8af61.vbs

Filesize
721B

MD5
6fe1f1b3694e6d9440f4612b5d865168

SHA1
99b9ef66c14bec54dcf04cd735dfdfefe30bed86

SHA256
235d6a43954c437ec85c09f519c3cdd75510eea89a05f2491753757dc126724d

SHA512
ac3786336fb06207934d6ff942f02beae59afc838938f56e9a1f3a2420ea7fe0dac084652f2ad5779cf289f12c15d28ea78b1b9493e282fec7139f9517656bbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\d54df874-b8f7-4800-b747-79272bbab297.vbs

Filesize
721B

MD5
d954c89ded128e0a240c007cc59a049d

SHA1
53187afa458d26b84445d9888be6662ff49b1ba6

SHA256
63253ee573305e0f729009cc3539e7977334a8ddcf9de2e36fbe5c7b4ae58f3f

SHA512
09d9c31cbcaec3b9995703983d17f5bffb78c464f6c7bb0b74b232c389b5804697932b63cfc00cfbad2348d736b54e4ef92ebd29a647b7cf51c31d5b028c800c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f12a3fbd-0228-4a22-8913-44b7eb2f0aad.vbs

Filesize
721B

MD5
0fb8348192d6a94ace677bdfccbd1973

SHA1
39d8aaa8f5cbf35bae7654ead5a69c3dd38541c0

SHA256
900060a02032276b58c8f1fa4b6a6a0aac5ffab8576e1384713ea0706d270281

SHA512
86e9fc565b3fc049395c5af93ed0230c8e9f7475b1017fc21a86aa9e409cc527edd4a6f0b58bb625e7c49252d5349d384983e693e97ade4aca0b37bf784ed7f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe5c363f-cbf8-40fb-98e7-d178a7ebacfa.vbs

Filesize
721B

MD5
015a9b538e9978e6fe0971a2aac1e17a

SHA1
86d5816e07e5e0acaabb818fddee0dd13d1b0c71

SHA256
a01e95cf943c4750ef7bd26344a8e929dba08ea72e311b8de8fb1d69fe2162f5

SHA512
4c19e5849fa0f22f55e8f92975752900547c17764335224c481351604fec97d76e0085d07ba851edcdf2fcd4a5ab90352a24e4df8252906535243797e1b3d2ea

Download Submit
C:\Users\Admin\System.exe

Filesize
1.6MB

MD5
9c6f59179f9ce815d134a949ca138e5c

SHA1
f4da34b00fbd55a7e6e3ac8af718e3969d48f6a6

SHA256
129b5e962c123febe8aaa76dcac9619a4b9aea3277cc445175e05de3c96e33f7

SHA512
ef0823be39d5980037b798abe02e5d47cbec512f940728c1398559f8c555c16781363aac734fcec4af13a30691bc12e00f6d2bf149ddd6320752e767d512554a

Download Submit
C:\Windows\ServiceProfiles\NetworkService\taskhostw.exe

Filesize
1.6MB

MD5
fb3158e45f5fa393dd74ef4c7a648f21

SHA1
06ded0db8c7aefec5f41d8ac03f4d846cb5d3950

SHA256
749ed55932f48d0717b7030197a4194915193a299f100774d6e5604d7819744d

SHA512
36d8eded9082eeb538bc2a0d0d74e59021867225deca454ea96cc9d9612eda94533264d63a34a3eb1c387d70672ad5b08e764e3309dc5d7c319fd0902d6ef694

Download Submit
memory/1316-13-0x0000000003180000-0x000000000318E000-memory.dmp

Filesize
56KB

Download
memory/1316-11-0x0000000003160000-0x000000000316C000-memory.dmp

Filesize
48KB

Download
memory/1316-1-0x0000000000D20000-0x0000000000EC2000-memory.dmp

Filesize
1.6MB

Download
memory/1316-201-0x00007FFB955C0000-0x00007FFB96081000-memory.dmp

Filesize
10.8MB

Download
memory/1316-189-0x00007FFB955C3000-0x00007FFB955C5000-memory.dmp

Filesize
8KB

Download
memory/1316-14-0x000000001BBC0000-0x000000001BBC8000-memory.dmp

Filesize
32KB

Download
memory/1316-15-0x000000001BBD0000-0x000000001BBD8000-memory.dmp

Filesize
32KB

Download
memory/1316-17-0x000000001BBF0000-0x000000001BBFC000-memory.dmp

Filesize
48KB

Download
memory/1316-16-0x000000001BBE0000-0x000000001BBEA000-memory.dmp

Filesize
40KB

Download
memory/1316-12-0x0000000003170000-0x000000000317A000-memory.dmp

Filesize
40KB

Download
memory/1316-0-0x00007FFB955C3000-0x00007FFB955C5000-memory.dmp

Filesize
8KB

Download
memory/1316-429-0x00007FFB955C0000-0x00007FFB96081000-memory.dmp

Filesize
10.8MB

Download
memory/1316-4-0x000000001BB70000-0x000000001BBC0000-memory.dmp

Filesize
320KB

Download
memory/1316-9-0x0000000003130000-0x0000000003138000-memory.dmp

Filesize
32KB

Download
memory/1316-10-0x0000000003150000-0x000000000315C000-memory.dmp

Filesize
48KB

Download
memory/1316-5-0x00000000017D0000-0x00000000017E0000-memory.dmp

Filesize
64KB

Download
memory/1316-2-0x00007FFB955C0000-0x00007FFB96081000-memory.dmp

Filesize
10.8MB

Download
memory/1316-7-0x0000000001810000-0x0000000001818000-memory.dmp

Filesize
32KB

Download
memory/1316-8-0x0000000003140000-0x0000000003150000-memory.dmp

Filesize
64KB

Download
memory/1316-6-0x0000000003110000-0x0000000003126000-memory.dmp

Filesize
88KB

Download
memory/1316-3-0x00000000017F0000-0x000000000180C000-memory.dmp

Filesize
112KB

Download
memory/1384-282-0x000001E87B930000-0x000001E87B952000-memory.dmp

Filesize
136KB

Download
memory/1416-529-0x000000001CFD0000-0x000000001D0D2000-memory.dmp

Filesize
1.0MB

Download