dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86c8fa2e136e29f51a3670f440b9f0a0.exe
Size

2.5MB
MD5

86c8fa2e136e29f51a3670f440b9f0a0
SHA1

103d45983c01fc861cb7390afe5db10ff2892fc0
SHA256

da49bed9676a8352a71fdd38dc855a01ca72f5dd393a91e9d7ad71ef9a4f11eb
SHA512

7c5f74c7a041c38216dc4a7f1d60d1a622227b8cd5aea5c1c4d200a5ccfabd7cbd2a17b22ca2ff028fc45dd0373df8cf9a5998cbefe7873fa7f9eda7ad117ddb
SSDEEP

49152:BjLLQdzMIwA7G5ALF/CT2vyYSjEf+QSs5saA2R97oF/cZ8ekY4E7Jy:B2l7G5Auotf+Lg4ElM

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	4484	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	4484	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	4484	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	4484	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	4484	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	4484	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	4484	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	4484	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4484	schtasks.exe	87

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4848	powershell.exe
1836	powershell.exe
776	powershell.exe
1308	powershell.exe
1456	powershell.exe
5012	powershell.exe
468	powershell.exe
856	powershell.exe
4232	powershell.exe
2368	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	86c8fa2e136e29f51a3670f440b9f0a0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe

Executes dropped EXE 16 IoCs

pid	Process
3096	OfficeClickToRun.exe
3804	OfficeClickToRun.exe
4708	OfficeClickToRun.exe
3876	OfficeClickToRun.exe
2000	OfficeClickToRun.exe
3012	OfficeClickToRun.exe
1420	OfficeClickToRun.exe
980	OfficeClickToRun.exe
4592	OfficeClickToRun.exe
436	OfficeClickToRun.exe
4960	OfficeClickToRun.exe
2844	OfficeClickToRun.exe
4888	OfficeClickToRun.exe
4020	OfficeClickToRun.exe
1696	OfficeClickToRun.exe
5048	OfficeClickToRun.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Documents and Settings\\OfficeClickToRun.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\msihnd\\dllhost.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\0154351536fc379faee1\\services.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\mfcm140\\dllhost.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\dwmcore\\taskhostw.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RINTL.en-us\\OfficeClickToRun.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Documents and Settings\\services.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\3ac54ddf2ad44faa6035cf\\csrss.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\86c8fa2e136e29f51a3670f440b9f0a0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\85edcd8fbc445760ff0796aa459e3c42\\86c8fa2e136e29f51a3670f440b9f0a0.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\System32\mfcm140\5940a34987c991	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Windows\System32\dwmcore\taskhostw.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\dwmcore\RCX6EDC.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\msihnd\RCX7C75.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\mfcm140\dllhost.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Windows\System32\dwmcore\ea9f0e6c9e2dcd	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Windows\System32\mfcm140\dllhost.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Windows\System32\msihnd\dllhost.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Windows\System32\msihnd\5940a34987c991	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\mfcm140\RCX6CB7.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\dwmcore\taskhostw.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\msihnd\dllhost.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\mfcm140\RCX6CB6.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\dwmcore\RCX6ECB.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\msihnd\RCX7C74.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us\OfficeClickToRun.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us\e6c9b481da804f	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us\RCX715D.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us\RCX716E.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us\OfficeClickToRun.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	86c8fa2e136e29f51a3670f440b9f0a0.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2960	schtasks.exe
4576	schtasks.exe
4620	schtasks.exe
1568	schtasks.exe
4604	schtasks.exe
3264	schtasks.exe
2152	schtasks.exe
3704	schtasks.exe
408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
468	powershell.exe
468	powershell.exe
4232	powershell.exe
4232	powershell.exe
776	powershell.exe
776	powershell.exe
1308	powershell.exe
1308	powershell.exe
856	powershell.exe
856	powershell.exe
5012	powershell.exe
5012	powershell.exe
1456	powershell.exe
1456	powershell.exe
4848	powershell.exe
4848	powershell.exe
1836	powershell.exe
1836	powershell.exe
2368	powershell.exe
2368	powershell.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
468	powershell.exe
776	powershell.exe
1836	powershell.exe
1456	powershell.exe
4848	powershell.exe
4232	powershell.exe
2368	powershell.exe
1308	powershell.exe
5012	powershell.exe
856	powershell.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
3096	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe
Token: SeDebugPrivilege	468	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	3096	OfficeClickToRun.exe
Token: SeDebugPrivilege	3804	OfficeClickToRun.exe
Token: SeDebugPrivilege	4708	OfficeClickToRun.exe
Token: SeDebugPrivilege	3876	OfficeClickToRun.exe
Token: SeDebugPrivilege	2000	OfficeClickToRun.exe
Token: SeDebugPrivilege	3012	OfficeClickToRun.exe
Token: SeDebugPrivilege	1420	OfficeClickToRun.exe
Token: SeDebugPrivilege	980	OfficeClickToRun.exe
Token: SeDebugPrivilege	4592	OfficeClickToRun.exe
Token: SeDebugPrivilege	436	OfficeClickToRun.exe
Token: SeDebugPrivilege	4960	OfficeClickToRun.exe
Token: SeDebugPrivilege	2844	OfficeClickToRun.exe
Token: SeDebugPrivilege	4888	OfficeClickToRun.exe
Token: SeDebugPrivilege	4020	OfficeClickToRun.exe
Token: SeDebugPrivilege	1696	OfficeClickToRun.exe
Token: SeDebugPrivilege	5048	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 468	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	100
PID 4944 wrote to memory of 468	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	100
PID 4944 wrote to memory of 5012	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	101
PID 4944 wrote to memory of 5012	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	101
PID 4944 wrote to memory of 1456	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	102
PID 4944 wrote to memory of 1456	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	102
PID 4944 wrote to memory of 1308	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	103
PID 4944 wrote to memory of 1308	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	103
PID 4944 wrote to memory of 776	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	105
PID 4944 wrote to memory of 776	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	105
PID 4944 wrote to memory of 1836	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	106
PID 4944 wrote to memory of 1836	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	106
PID 4944 wrote to memory of 2368	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	108
PID 4944 wrote to memory of 2368	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	108
PID 4944 wrote to memory of 4232	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	109
PID 4944 wrote to memory of 4232	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	109
PID 4944 wrote to memory of 856	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	110
PID 4944 wrote to memory of 856	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	110
PID 4944 wrote to memory of 4848	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	111
PID 4944 wrote to memory of 4848	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	111
PID 4944 wrote to memory of 3096	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	121
PID 4944 wrote to memory of 3096	4944	86c8fa2e136e29f51a3670f440b9f0a0.exe	121
PID 3096 wrote to memory of 4944	3096	OfficeClickToRun.exe	122
PID 3096 wrote to memory of 4944	3096	OfficeClickToRun.exe	122
PID 3096 wrote to memory of 2756	3096	OfficeClickToRun.exe	123
PID 3096 wrote to memory of 2756	3096	OfficeClickToRun.exe	123
PID 4944 wrote to memory of 3804	4944	WScript.exe	126
PID 4944 wrote to memory of 3804	4944	WScript.exe	126
PID 3804 wrote to memory of 4896	3804	OfficeClickToRun.exe	127
PID 3804 wrote to memory of 4896	3804	OfficeClickToRun.exe	127
PID 3804 wrote to memory of 1932	3804	OfficeClickToRun.exe	128
PID 3804 wrote to memory of 1932	3804	OfficeClickToRun.exe	128
PID 4896 wrote to memory of 4708	4896	WScript.exe	130
PID 4896 wrote to memory of 4708	4896	WScript.exe	130
PID 4708 wrote to memory of 3748	4708	OfficeClickToRun.exe	131
PID 4708 wrote to memory of 3748	4708	OfficeClickToRun.exe	131
PID 4708 wrote to memory of 3668	4708	OfficeClickToRun.exe	132
PID 4708 wrote to memory of 3668	4708	OfficeClickToRun.exe	132
PID 3748 wrote to memory of 3876	3748	WScript.exe	140
PID 3748 wrote to memory of 3876	3748	WScript.exe	140
PID 3876 wrote to memory of 4944	3876	OfficeClickToRun.exe	141
PID 3876 wrote to memory of 4944	3876	OfficeClickToRun.exe	141
PID 3876 wrote to memory of 3528	3876	OfficeClickToRun.exe	142
PID 3876 wrote to memory of 3528	3876	OfficeClickToRun.exe	142
PID 4944 wrote to memory of 2000	4944	WScript.exe	143
PID 4944 wrote to memory of 2000	4944	WScript.exe	143
PID 2000 wrote to memory of 1792	2000	OfficeClickToRun.exe	144
PID 2000 wrote to memory of 1792	2000	OfficeClickToRun.exe	144
PID 2000 wrote to memory of 2800	2000	OfficeClickToRun.exe	145
PID 2000 wrote to memory of 2800	2000	OfficeClickToRun.exe	145
PID 1792 wrote to memory of 3012	1792	WScript.exe	146
PID 1792 wrote to memory of 3012	1792	WScript.exe	146
PID 3012 wrote to memory of 1520	3012	OfficeClickToRun.exe	147
PID 3012 wrote to memory of 1520	3012	OfficeClickToRun.exe	147
PID 3012 wrote to memory of 1776	3012	OfficeClickToRun.exe	148
PID 3012 wrote to memory of 1776	3012	OfficeClickToRun.exe	148
PID 1520 wrote to memory of 1420	1520	WScript.exe	149
PID 1520 wrote to memory of 1420	1520	WScript.exe	149
PID 1420 wrote to memory of 3096	1420	OfficeClickToRun.exe	150
PID 1420 wrote to memory of 3096	1420	OfficeClickToRun.exe	150
PID 1420 wrote to memory of 3128	1420	OfficeClickToRun.exe	151
PID 1420 wrote to memory of 3128	1420	OfficeClickToRun.exe	151
PID 3096 wrote to memory of 980	3096	WScript.exe	152
PID 3096 wrote to memory of 980	3096	WScript.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\86c8fa2e136e29f51a3670f440b9f0a0.exe
"C:\Users\Admin\AppData\Local\Temp\86c8fa2e136e29f51a3670f440b9f0a0.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\86c8fa2e136e29f51a3670f440b9f0a0.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\mfcm140\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\dwmcore\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\85edcd8fbc445760ff0796aa459e3c42\86c8fa2e136e29f51a3670f440b9f0a0.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\msihnd\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Documents and Settings\OfficeClickToRun.exe
  "C:\Documents and Settings\OfficeClickToRun.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\094f3850-ba09-4738-9521-4e4c78059874.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Documents and Settings\OfficeClickToRun.exe
      "C:\Documents and Settings\OfficeClickToRun.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3804
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\742c4d29-bff7-46f1-a711-0ca7315e77b5.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4896
      - C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36191436-411f-4b8b-a478-74dde1ec6284.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe855776-de4d-4463-8dbe-1dca73b873a6.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38cbca9b-59a4-4233-a2fe-fd343b4fbe50.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2757bf69-954e-4025-996b-3b40ae4a3025.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c712ab1-6ac5-4cd4-9591-458617287065.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19959937-5f6c-4d42-aade-6fade1d9cc55.vbs"
        17⤵
        
        PID:3848
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3f7adff-b908-4642-a98b-b402019d33d9.vbs"
        19⤵
        
        PID:3884
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c19d9c1-fb7b-43a4-9e39-7ef15ca99020.vbs"
        21⤵
        
        PID:4488
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e04ffe5-c646-4493-8fbc-c38a788b72ea.vbs"
        23⤵
        
        PID:1684
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39a18b14-d619-4592-82c5-0722f0dec05d.vbs"
        25⤵
        
        PID:4936
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9cc7973-dea3-4b20-aa8e-10e60e47ae9b.vbs"
        27⤵
        
        PID:4528
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41c49f0b-5827-4b07-963d-1cde01b39902.vbs"
        29⤵
        
        PID:3300
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff022a97-2647-4641-95ea-5ce2141b93e2.vbs"
        31⤵
        
        PID:4708
        
        C:\Documents and Settings\OfficeClickToRun.exe
        
        "C:\Documents and Settings\OfficeClickToRun.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5048
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd5e8250-7cea-4ffe-a363-c524f76f482d.vbs"
        31⤵
        
        PID:4180
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05749d6f-6cd3-484c-b2af-ca7aa058d8ed.vbs"
        29⤵
        
        PID:5056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca3355eb-fda5-4e7f-821b-614baeea9fc9.vbs"
        27⤵
        
        PID:1236
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6ccd47da-1ea3-4a07-9f08-9c590c3adc17.vbs"
        25⤵
        
        PID:1968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\562029f9-d8a7-497a-864a-0893187d1be2.vbs"
        23⤵
        
        PID:3112
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d9f47c2-1c64-4b6d-8cc2-363e72cac2d0.vbs"
        21⤵
        
        PID:3484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9719bb00-1297-47fa-ab82-4ed58c90b247.vbs"
        19⤵
        
        PID:2912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\386ab9a7-ce5c-4312-aa85-2c68e2af314c.vbs"
        17⤵
        
        PID:1992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3fd89570-9cd0-4952-acfe-ec3325123a58.vbs"
        15⤵
        
        PID:3128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16d0edac-d1c5-41ce-9471-96d5a931738f.vbs"
        13⤵
        
        PID:1776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce5e9cc8-d46c-4e53-87ec-2029f7c11db3.vbs"
        11⤵
        
        PID:2800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5e872fd-5b9d-4765-b5be-1a5dfe9c5993.vbs"
        9⤵
        
        PID:3528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2ebe82d-64d3-4477-8c04-5741fa120883.vbs"
        7⤵
        
        PID:3668
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30d93020-c8d3-491f-99ea-211c043d97bb.vbs"
        5⤵
        
        PID:1932
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66b14f84-793a-448c-9ca5-503152758f61.vbs"
    3⤵
    PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\mfcm140\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\dwmcore\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "86c8fa2e136e29f51a3670f440b9f0a0" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\85edcd8fbc445760ff0796aa459e3c42\86c8fa2e136e29f51a3670f440b9f0a0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Documents and Settings\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Documents and Settings\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\msihnd\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\0154351536fc379faee1\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OfficeClickToRun.exe.log

Filesize
1KB

MD5
9699cf9bb24ebbc9b1035710e92b7bd2

SHA1
73f0f26db57ea306970a76f42c647bbce02a3f23

SHA256
fd35f3609663bec79a5254866d1c47342fbde3f94808acff8c3eaa19b24f67e5

SHA512
3a433f40f25b5a5c09f8de45ebd0b5485b3b54eb0c1c08a1dbae776629710b8d8f5fee21329d146867e49b5d35108bba6eff3995fb7c6246dbe6fe475eadf0bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1641de9a10da75d35edf03caa25212c1

SHA1
af73f64f8ce476c8e4eb56bb40426552d34c1ca8

SHA256
5fbacccb41dad88018fad178d824e1dc4cdc48e08032d374ac88d37c88ee60c2

SHA512
7123f9d69a0930a5143e442893cb2711bd9fd911f50e00f7b651ff8d448b78541ea0fa5f36452ad30e4c90ebfd1b1cc51e97422d6649089ec6b9f783ee6101e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
94f35f261590c8add6967ae13ee05fab

SHA1
e0e5828e2c4b7d1937fde13dbfcc63f59c1899c7

SHA256
db908d6ae1a8ae3e77e93332eaa24f8316aa9e65285996439d35a133024e1a63

SHA512
3e3438bc5e8dfe738d8cf374d444f9f8600cadac6071708426b7852d3a84f0363f79ae6895f11206b5c7fbb8c850725318196c4171112634cfef3d2d70d1e8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c8fd95453fe0d2e0f6d8e5ac03994b1

SHA1
d9811cf9d2b0d0ce3387fd79462cd592b005a634

SHA256
232dac927d663f4ed67a4f005da093bc9865c323767c29c3b4a21797f4a60e58

SHA512
f334216c706e96e85910bc14e7eeec0da3e6f4e9a8620108c938d997266939170aabfdfddd9830f454a34d0db503f8f0bbe63c910007bfd03f294f8a34945810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c44e48d99762769d16de7352e92db16f

SHA1
29898e4ddba0504899fe0f0a55abacf592689e1b

SHA256
f92b4e399718fecfdc08924f70f0bdb7c5e0014eaeec343d815a503e06205bc8

SHA512
18cfd8b4bf3871c26c01d20ecd90f76493a6e55d7df33e78fb1491f6151ab3c04589758d6419f7b73a1288d5e65b85f40142bb7e3df5bc46e7fe4cf2da014879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
47d9df7fab0d0c96afdd2ca49f2b5030

SHA1
92583883bcf376062ddef5db2333f066d8d36612

SHA256
0f244dd39698dace2c650435886b1175ea01131e581d6c13888576c07fa40b02

SHA512
1844ce4f35849b70c246127482040986caa1bbae2d81119c77e9841f2a3280aabae0ad0db52fc29fe48023b4f4c073fe759b1f54e70e1562289d5e349c015200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3357c199be211a745818714039e25935

SHA1
7d50d07ff2e234f3d10a88363796cbd615b1e9a3

SHA256
668bb751b77a8c5c53c7efcb71e3ee9b2902388e0503e6d6ad3647587a0a0a38

SHA512
052751067bede3dba675313a1c0d88c0e76d62bbc903dbd9ba4cf2b8d03530716c021926bbe34242af9516a77e27df080d1cedde04d8cb51c88c1484ea8a1077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0c3cddab7d289f65843ac7ee436ff50d

SHA1
19046a0dc416df364c3be08b72166becf7ed9ca9

SHA256
c94ea9a9d0877a48ade47f77733be15871512f7aded45a211eb636bdcf7e45a1

SHA512
45c710a959f67ed05c25709c24887a4d5e5909e94f2012bd1cad64b32729fafea6f6628b2552f36c9d98bf8a1ddf50bb84d92d6e1cb15f20b2a74739ff19c9ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\094f3850-ba09-4738-9521-4e4c78059874.vbs

Filesize
722B

MD5
4588fbc70db5346aea8926a5df4b8a2e

SHA1
f47c210a97025ffd6a89b2a5c4fc75cb6487cc12

SHA256
781b3c286d4be9619d9d6dad19538ef4f00790fd24ad8b0f5e746cb1b1f49e8c

SHA512
4badc47fe441d8207aadef97f036989dc5c9021a2b3245909a80b584aab73639a0281197d5ecaf52a0cf57ba89cd4bc25771ad7d3f558c7c1696ae973948c046

Download Submit
C:\Users\Admin\AppData\Local\Temp\0c19d9c1-fb7b-43a4-9e39-7ef15ca99020.vbs

Filesize
721B

MD5
a998c96733ecda8f212c05d8e7dad87e

SHA1
4665efb29c31eec63b45741784dfa1b487a26fdc

SHA256
98e6cabab6db5e76271686d3cb945c66620da1cc0974047608ba12c8ee50a578

SHA512
71ec2c3ba9ec033ec1015558bb703b077ce27b5ca4a1026796f39dad4b4e30d2986e9c8325d31c5f6c199de3ee01bb53ec8768205903e455d99f86ed9d645904

Download Submit
C:\Users\Admin\AppData\Local\Temp\0c712ab1-6ac5-4cd4-9591-458617287065.vbs

Filesize
722B

MD5
d574a263e8ddbbff2f7c41e7f66fa1e7

SHA1
35b7553ae1f6e00a3e69e23db3da1ae989156ded

SHA256
3076cbca61747990aa2695e20f5b89d5c2a5ae5892a9726b8459966617f2aa3b

SHA512
c7d82f560a0cdefafc2ab0a3fd6fe59cb6fd097da154f4d2090254664b8a2dfe2d71200992287175c3b9073262558d1e78be47825a1bad2955315f9d6d10030e

Download Submit
C:\Users\Admin\AppData\Local\Temp\19959937-5f6c-4d42-aade-6fade1d9cc55.vbs

Filesize
721B

MD5
706805c184dfa2d029b7469adfd664d1

SHA1
bc33ea683ef6c1af92035bbbde052f27fd1f5b87

SHA256
27284dc48c3037e31334ddba5b7d7fa6ac425f14c1018b6c008ce3000a0616e6

SHA512
3f3ed7ecb768d3e5ff4c9e3b6d2c9055b291ddb45c74f8a29b796422a724766636d43b0019faf7ea34e7dbfd41f7de2ea9620419fd08937fb1bb54951d02649f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2757bf69-954e-4025-996b-3b40ae4a3025.vbs

Filesize
722B

MD5
5d46b8a366b996a92e80ced8dce47b32

SHA1
0909814668b14c07124cca9efd7b24fc666541be

SHA256
7e8fc67b85cb080a00200fb93e422b00fdc52ed7c434b3fa60c2bce50da2b020

SHA512
94d42098987efb7c34b997fc36cb75c0196e9ec8f78d348b3c015fd4a840dbaef84288f58fc9e252ce3172a94c645edc10c9528a617984249c397dd6a635170f

Download Submit
C:\Users\Admin\AppData\Local\Temp\36191436-411f-4b8b-a478-74dde1ec6284.vbs

Filesize
722B

MD5
f86f1615198391e7c37d168e0896e116

SHA1
0e568070611c22bde0c7293b6cbd51dd5cb644e3

SHA256
19f19d6920ba04eb9da4ed4ce7cf5372d20b218eb0ddbae27e5d8ab0b5212c57

SHA512
ca61a3e525c6ba96940a80a6c6805dcdbdfef7ae490a78c482e0540a0f899fef385e1082285498bc9c9b7df50452a7e596b1914be9f4c58430c4fdbf2efc930e

Download Submit
C:\Users\Admin\AppData\Local\Temp\38cbca9b-59a4-4233-a2fe-fd343b4fbe50.vbs

Filesize
722B

MD5
fbf5a135226fbe855e1a451a735c17e8

SHA1
7a7f1710b38e300dd8095fb4604d9b764efa531a

SHA256
02b1ce38e60a5b4173f174f47284ff0a1263c29a2521bce3181098e806826dea

SHA512
edb5403174ab317b1e381a91f3359ea641b13d753f03fd35381c6767058405fe5872e86bcf1c4b69d0229eecc69a4052d70194f4e524b69c8e4c3b7922409324

Download Submit
C:\Users\Admin\AppData\Local\Temp\39a18b14-d619-4592-82c5-0722f0dec05d.vbs

Filesize
722B

MD5
5e44ef7d3bc5f004e7944570b71e98ce

SHA1
53f0779db60468741bfabff8547603a060159f35

SHA256
7c010e2922f320e677946b08cde8b38864055aa3086cdc7fb4ed684c6216dcb5

SHA512
c036358dfd6891bb0ec03d808639dd4dee45d7db98c59d98cd96fef5ca1a31218163fd2133f992f14928a0c65575e037422dc76a884681a03adbeb834593f490

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e04ffe5-c646-4493-8fbc-c38a788b72ea.vbs

Filesize
722B

MD5
be7aefc79a5be212b89d39f46567627a

SHA1
9283489cefb15dcae31d50bc869f999c44355826

SHA256
95c3308e3c8eb9eafb5ee2e1b16628bf57f0ad2f2844592618d9138aad632be2

SHA512
bd29cdb1dbe5cd58cad15fd193ac8946f89cf4ab742e0523ee12bfa08a51a0015d25fd1fc3f758ceef4387de17eb4273d92fd23eb8ae787833ad82d0bbc7e1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\66b14f84-793a-448c-9ca5-503152758f61.vbs

Filesize
498B

MD5
1ef348e93905e61976f8a23971a46aea

SHA1
ed68d7b8f891f418ab5aa0c19e274214d8f089c1

SHA256
9c07b5d1c1a8966ad291cbe91817be7096c1c680ad82e4bfe5ff4dab201e58de

SHA512
fa9f28b2b36a98b8376b5f8c4eedb05d8da17bc4d8ad2d67bc2a78fd49c9f5ad53950d26bafcb08b41664676296a3dfb63f023fa068567d53c40f37293603296

Download Submit
C:\Users\Admin\AppData\Local\Temp\742c4d29-bff7-46f1-a711-0ca7315e77b5.vbs

Filesize
722B

MD5
8ed40bbc5c37196519854bee90a6c146

SHA1
a793aad951150937958a4cc060cbf3316dcc8e66

SHA256
fd76f441f8ce0834296e8a791685e8e8600096a170eb36c6321157e3a2367da0

SHA512
2b6726c561d8c39976126ec83b9c21729f4cae60e89985b69a5085d5edc996c25dfa852225c8840d04dddf00c75f5091edccaec4c83516f291f8a75ba3433e7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tbe0vr3a.jzj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9cc7973-dea3-4b20-aa8e-10e60e47ae9b.vbs

Filesize
722B

MD5
66193ab67c90ba39ae4e81ba63c466de

SHA1
21b225f2358ea81c026a1648d2a862fe0d1c94dc

SHA256
f56dd20f2c057dc42d1ae759316e3a11fcbeb35b98daf5fc5deeec121e36ed77

SHA512
857a3633667e9b6fb6105ddb7db47f48d5fcc13d3920a31cf8215654a263fb231a8a0da29ad8984f448fea4e5f51a33df57a2cd074f07379ea1d98e15e7fa714

Download Submit
C:\Users\Admin\AppData\Local\Temp\d3f7adff-b908-4642-a98b-b402019d33d9.vbs

Filesize
722B

MD5
f2a74517be38c2f953f0af4e90df1d31

SHA1
ab299b2b521e160ead2256a37fce485e8e759bda

SHA256
8bbfe238e1259445910eee2eae289d86de169d333a591b3226d2a728cd589928

SHA512
a707eefc4dbf67e7a4c6858a66a9e1a16477c63a1738c59ee27a4b14a3ed314725c73cf96ae22d95f00a8c9318f7f996197ee5b25d1f7a469f2b615a89934031

Download Submit
C:\Users\Admin\AppData\Local\Temp\fe855776-de4d-4463-8dbe-1dca73b873a6.vbs

Filesize
722B

MD5
0d0b8897c9e50f0c3f47cd604ed81c5a

SHA1
c62b152663e95c7cefca3a08f01553e30d83fcfb

SHA256
f25e1453b8354eca1df65a263e2d196163ad8a6c2f1766aa4956558330cc1f9c

SHA512
707fc6912566fedc177642775fa8424a74a3552abe4760cfaf97c47a4eabfece0725cbfc3f65a92cd416e595678da2115c2febafe0df0255e30e926c3c6faca6

Download Submit
C:\Users\services.exe

Filesize
2.5MB

MD5
86c8fa2e136e29f51a3670f440b9f0a0

SHA1
103d45983c01fc861cb7390afe5db10ff2892fc0

SHA256
da49bed9676a8352a71fdd38dc855a01ca72f5dd393a91e9d7ad71ef9a4f11eb

SHA512
7c5f74c7a041c38216dc4a7f1d60d1a622227b8cd5aea5c1c4d200a5ccfabd7cbd2a17b22ca2ff028fc45dd0373df8cf9a5998cbefe7873fa7f9eda7ad117ddb

Download Submit
memory/436-426-0x0000000002D60000-0x0000000002D72000-memory.dmp

Filesize
72KB

Download
memory/436-425-0x000000001B7E0000-0x000000001B836000-memory.dmp

Filesize
344KB

Download
memory/468-207-0x0000026CE94B0000-0x0000026CE94D2000-memory.dmp

Filesize
136KB

Download
memory/980-402-0x00000000028D0000-0x00000000028E2000-memory.dmp

Filesize
72KB

Download
memory/3096-320-0x000000001C1E0000-0x000000001C1F2000-memory.dmp

Filesize
72KB

Download
memory/4020-473-0x000000001B760000-0x000000001B7B6000-memory.dmp

Filesize
344KB

Download
memory/4020-481-0x000000001C390000-0x000000001C492000-memory.dmp

Filesize
1.0MB

Download
memory/4708-346-0x000000001BC40000-0x000000001BC96000-memory.dmp

Filesize
344KB

Download
memory/4888-460-0x000000001B420000-0x000000001B432000-memory.dmp

Filesize
72KB

Download
memory/4888-471-0x000000001C2C0000-0x000000001C3C2000-memory.dmp

Filesize
1.0MB

Download
memory/4944-11-0x000000001CCE0000-0x000000001D208000-memory.dmp

Filesize
5.2MB

Download
memory/4944-3-0x00000000030F0000-0x00000000030FC000-memory.dmp

Filesize
48KB

Download
memory/4944-8-0x000000001C3A0000-0x000000001C3F6000-memory.dmp

Filesize
344KB

Download
memory/4944-7-0x000000001BC60000-0x000000001BC70000-memory.dmp

Filesize
64KB

Download
memory/4944-6-0x000000001BC50000-0x000000001BC60000-memory.dmp

Filesize
64KB

Download
memory/4944-5-0x000000001C3F0000-0x000000001C440000-memory.dmp

Filesize
320KB

Download
memory/4944-2-0x00007FFBBC2F0000-0x00007FFBBCDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4944-4-0x0000000003100000-0x000000000311C000-memory.dmp

Filesize
112KB

Download
memory/4944-0-0x00007FFBBC2F3000-0x00007FFBBC2F5000-memory.dmp

Filesize
8KB

Download
memory/4944-10-0x000000001BC80000-0x000000001BC92000-memory.dmp

Filesize
72KB

Download
memory/4944-13-0x000000001C470000-0x000000001C47A000-memory.dmp

Filesize
40KB

Download
memory/4944-12-0x000000001C460000-0x000000001C46A000-memory.dmp

Filesize
40KB

Download
memory/4944-1-0x0000000000DF0000-0x0000000001076000-memory.dmp

Filesize
2.5MB

Download
memory/4944-16-0x000000001C6A0000-0x000000001C6AC000-memory.dmp

Filesize
48KB

Download
memory/4944-300-0x00007FFBBC2F0000-0x00007FFBBCDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4944-9-0x000000001BC70000-0x000000001BC78000-memory.dmp

Filesize
32KB

Download
memory/4944-17-0x000000001C7B0000-0x000000001C7B8000-memory.dmp

Filesize
32KB

Download
memory/4944-18-0x000000001C7C0000-0x000000001C7CA000-memory.dmp

Filesize
40KB

Download
memory/4944-14-0x000000001C480000-0x000000001C48C000-memory.dmp

Filesize
48KB

Download
memory/4944-15-0x000000001C690000-0x000000001C69A000-memory.dmp

Filesize
40KB

Download
memory/5048-489-0x0000000002BF0000-0x0000000002C02000-memory.dmp

Filesize
72KB

Download