805c5709be7589073f6c90410ba05d8d4240ba487fe7c8febf2de9ba214a489e

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9576cc7c1d016017905b260b127b983f.exe
Size

1.9MB
MD5

9576cc7c1d016017905b260b127b983f
SHA1

085fbeb0456c1eb2f9d1854e4940def27aab0386
SHA256

5d64fc503e241b1ffafe9179e97d244b2af292a14b95f5513c48ba0557d14de2
SHA512

8bb12a73650c814edf1899c1453b40b92114f316de9b76dbd20f724f2970514f0f4c6afcf41a37a8796e90917f4ef11cea1043e6815e08ce199643a27f64c4a0
SSDEEP

24576:0z4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:0OMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

UAC bypass 3 TTPs 33 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9576cc7c1d016017905b260b127b983f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9576cc7c1d016017905b260b127b983f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9576cc7c1d016017905b260b127b983f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2032	powershell.exe
2836	powershell.exe
2164	powershell.exe
2180	powershell.exe
876	powershell.exe
2816	powershell.exe
1492	powershell.exe
2432	powershell.exe
2136	powershell.exe
2620	powershell.exe
1120	powershell.exe
2608	powershell.exe
2720	powershell.exe
2100	powershell.exe
2408	powershell.exe
1348	powershell.exe
1892	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	9576cc7c1d016017905b260b127b983f.exe

Executes dropped EXE 10 IoCs

pid	Process
840	wininit.exe
984	wininit.exe
1044	wininit.exe
3032	wininit.exe
2500	wininit.exe
2372	wininit.exe
1860	wininit.exe
2364	wininit.exe
952	wininit.exe
316	wininit.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9576cc7c1d016017905b260b127b983f.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9576cc7c1d016017905b260b127b983f.exe

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\cc11b995f2a76d	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files (x86)\Uninstall Information\9576cc7c1d016017905b260b127b983f.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files (x86)\Google\CrashReports\6ccacd8608530f	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCXA5FC.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\Idle.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\RCXACE6.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\en-US\RCXB15B.tmp	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files\Internet Explorer\winlogon.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\56085415360792	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files\Internet Explorer\winlogon.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\RCXA3E7.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\9576cc7c1d016017905b260b127b983f.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files (x86)\Windows NT\9576cc7c1d016017905b260b127b983f.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\RCXACE5.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RCXB360.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Windows NT\9576cc7c1d016017905b260b127b983f.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files (x86)\Uninstall Information\8ed4555fa854c3	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files (x86)\Google\CrashReports\Idle.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCXA5FD.tmp	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\taskhost.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files\Internet Explorer\RCX9D6C.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\RCXA3E8.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\taskhost.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\en-US\RCXB15C.tmp	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\wininit.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files (x86)\Windows NT\8ed4555fa854c3	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files\Internet Explorer\RCX9DDA.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\en-US\wininit.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RCXB3CE.tmp	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\b75386f1303e64	9576cc7c1d016017905b260b127b983f.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\setup.exe\RCX9B68.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\tracing\RCX9FDE.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\RCXB854.tmp	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\tracing\f3b6ecef712a24	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\Boot\EFI\es-ES\Idle.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\f3b6ecef712a24	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\RCXAAE0.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\audiodg.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\RCXB855.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\spoolsv.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\Migration\WTR\RCXBA5A.tmp	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\42af1c969fbb7b	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\tracing\spoolsv.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\RCXAAE1.tmp	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\Panther\setup.exe\wininit.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\Panther\setup.exe\wininit.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QHEADLES\audiodg.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\Migration\WTR\6203df4a6bafc7	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\tracing\RCX9FDF.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\Migration\WTR\RCXBA59.tmp	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\Migration\WTR\lsass.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\Panther\setup.exe\56085415360792	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\tracing\spoolsv.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\spoolsv.exe	9576cc7c1d016017905b260b127b983f.exe
File created	C:\Windows\Migration\WTR\lsass.exe	9576cc7c1d016017905b260b127b983f.exe
File opened for modification	C:\Windows\Panther\setup.exe\RCX9B57.tmp	9576cc7c1d016017905b260b127b983f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2648	schtasks.exe
768	schtasks.exe
1792	schtasks.exe
3028	schtasks.exe
1624	schtasks.exe
2228	schtasks.exe
2788	schtasks.exe
2400	schtasks.exe
2768	schtasks.exe
1492	schtasks.exe
320	schtasks.exe
828	schtasks.exe
2812	schtasks.exe
1508	schtasks.exe
2580	schtasks.exe
2684	schtasks.exe
3044	schtasks.exe
1628	schtasks.exe
1520	schtasks.exe
2896	schtasks.exe
2736	schtasks.exe
2844	schtasks.exe
624	schtasks.exe
1096	schtasks.exe
1736	schtasks.exe
1904	schtasks.exe
1152	schtasks.exe
396	schtasks.exe
2456	schtasks.exe
1844	schtasks.exe
2620	schtasks.exe
2236	schtasks.exe
688	schtasks.exe
288	schtasks.exe
1264	schtasks.exe
2712	schtasks.exe
2752	schtasks.exe
2720	schtasks.exe
2996	schtasks.exe
2864	schtasks.exe
2824	schtasks.exe
2916	schtasks.exe
1248	schtasks.exe
1056	schtasks.exe
2668	schtasks.exe
856	schtasks.exe
608	schtasks.exe
3056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2872	9576cc7c1d016017905b260b127b983f.exe
2872	9576cc7c1d016017905b260b127b983f.exe
2872	9576cc7c1d016017905b260b127b983f.exe
2872	9576cc7c1d016017905b260b127b983f.exe
2872	9576cc7c1d016017905b260b127b983f.exe
2872	9576cc7c1d016017905b260b127b983f.exe
2872	9576cc7c1d016017905b260b127b983f.exe
2872	9576cc7c1d016017905b260b127b983f.exe
2872	9576cc7c1d016017905b260b127b983f.exe
1892	powershell.exe
2100	powershell.exe
2816	powershell.exe
1492	powershell.exe
2836	powershell.exe
2408	powershell.exe
2620	powershell.exe
1348	powershell.exe
2608	powershell.exe
2180	powershell.exe
2432	powershell.exe
876	powershell.exe
2720	powershell.exe
2164	powershell.exe
2032	powershell.exe
840	wininit.exe
2136	powershell.exe
1120	powershell.exe
984	wininit.exe
1044	wininit.exe
3032	wininit.exe
2500	wininit.exe
1860	wininit.exe
2364	wininit.exe
952	wininit.exe
316	wininit.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	9576cc7c1d016017905b260b127b983f.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	840	wininit.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	984	wininit.exe
Token: SeDebugPrivilege	1044	wininit.exe
Token: SeDebugPrivilege	3032	wininit.exe
Token: SeDebugPrivilege	2500	wininit.exe
Token: SeDebugPrivilege	1860	wininit.exe
Token: SeDebugPrivilege	2364	wininit.exe
Token: SeDebugPrivilege	952	wininit.exe
Token: SeDebugPrivilege	316	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2816	2872	9576cc7c1d016017905b260b127b983f.exe	77
PID 2872 wrote to memory of 2816	2872	9576cc7c1d016017905b260b127b983f.exe	77
PID 2872 wrote to memory of 2816	2872	9576cc7c1d016017905b260b127b983f.exe	77
PID 2872 wrote to memory of 1892	2872	9576cc7c1d016017905b260b127b983f.exe	78
PID 2872 wrote to memory of 1892	2872	9576cc7c1d016017905b260b127b983f.exe	78
PID 2872 wrote to memory of 1892	2872	9576cc7c1d016017905b260b127b983f.exe	78
PID 2872 wrote to memory of 2608	2872	9576cc7c1d016017905b260b127b983f.exe	79
PID 2872 wrote to memory of 2608	2872	9576cc7c1d016017905b260b127b983f.exe	79
PID 2872 wrote to memory of 2608	2872	9576cc7c1d016017905b260b127b983f.exe	79
PID 2872 wrote to memory of 1348	2872	9576cc7c1d016017905b260b127b983f.exe	80
PID 2872 wrote to memory of 1348	2872	9576cc7c1d016017905b260b127b983f.exe	80
PID 2872 wrote to memory of 1348	2872	9576cc7c1d016017905b260b127b983f.exe	80
PID 2872 wrote to memory of 1120	2872	9576cc7c1d016017905b260b127b983f.exe	81
PID 2872 wrote to memory of 1120	2872	9576cc7c1d016017905b260b127b983f.exe	81
PID 2872 wrote to memory of 1120	2872	9576cc7c1d016017905b260b127b983f.exe	81
PID 2872 wrote to memory of 2408	2872	9576cc7c1d016017905b260b127b983f.exe	82
PID 2872 wrote to memory of 2408	2872	9576cc7c1d016017905b260b127b983f.exe	82
PID 2872 wrote to memory of 2408	2872	9576cc7c1d016017905b260b127b983f.exe	82
PID 2872 wrote to memory of 876	2872	9576cc7c1d016017905b260b127b983f.exe	85
PID 2872 wrote to memory of 876	2872	9576cc7c1d016017905b260b127b983f.exe	85
PID 2872 wrote to memory of 876	2872	9576cc7c1d016017905b260b127b983f.exe	85
PID 2872 wrote to memory of 2180	2872	9576cc7c1d016017905b260b127b983f.exe	88
PID 2872 wrote to memory of 2180	2872	9576cc7c1d016017905b260b127b983f.exe	88
PID 2872 wrote to memory of 2180	2872	9576cc7c1d016017905b260b127b983f.exe	88
PID 2872 wrote to memory of 2620	2872	9576cc7c1d016017905b260b127b983f.exe	90
PID 2872 wrote to memory of 2620	2872	9576cc7c1d016017905b260b127b983f.exe	90
PID 2872 wrote to memory of 2620	2872	9576cc7c1d016017905b260b127b983f.exe	90
PID 2872 wrote to memory of 2136	2872	9576cc7c1d016017905b260b127b983f.exe	91
PID 2872 wrote to memory of 2136	2872	9576cc7c1d016017905b260b127b983f.exe	91
PID 2872 wrote to memory of 2136	2872	9576cc7c1d016017905b260b127b983f.exe	91
PID 2872 wrote to memory of 2432	2872	9576cc7c1d016017905b260b127b983f.exe	92
PID 2872 wrote to memory of 2432	2872	9576cc7c1d016017905b260b127b983f.exe	92
PID 2872 wrote to memory of 2432	2872	9576cc7c1d016017905b260b127b983f.exe	92
PID 2872 wrote to memory of 2164	2872	9576cc7c1d016017905b260b127b983f.exe	94
PID 2872 wrote to memory of 2164	2872	9576cc7c1d016017905b260b127b983f.exe	94
PID 2872 wrote to memory of 2164	2872	9576cc7c1d016017905b260b127b983f.exe	94
PID 2872 wrote to memory of 2100	2872	9576cc7c1d016017905b260b127b983f.exe	95
PID 2872 wrote to memory of 2100	2872	9576cc7c1d016017905b260b127b983f.exe	95
PID 2872 wrote to memory of 2100	2872	9576cc7c1d016017905b260b127b983f.exe	95
PID 2872 wrote to memory of 2836	2872	9576cc7c1d016017905b260b127b983f.exe	96
PID 2872 wrote to memory of 2836	2872	9576cc7c1d016017905b260b127b983f.exe	96
PID 2872 wrote to memory of 2836	2872	9576cc7c1d016017905b260b127b983f.exe	96
PID 2872 wrote to memory of 2032	2872	9576cc7c1d016017905b260b127b983f.exe	97
PID 2872 wrote to memory of 2032	2872	9576cc7c1d016017905b260b127b983f.exe	97
PID 2872 wrote to memory of 2032	2872	9576cc7c1d016017905b260b127b983f.exe	97
PID 2872 wrote to memory of 1492	2872	9576cc7c1d016017905b260b127b983f.exe	98
PID 2872 wrote to memory of 1492	2872	9576cc7c1d016017905b260b127b983f.exe	98
PID 2872 wrote to memory of 1492	2872	9576cc7c1d016017905b260b127b983f.exe	98
PID 2872 wrote to memory of 2720	2872	9576cc7c1d016017905b260b127b983f.exe	99
PID 2872 wrote to memory of 2720	2872	9576cc7c1d016017905b260b127b983f.exe	99
PID 2872 wrote to memory of 2720	2872	9576cc7c1d016017905b260b127b983f.exe	99
PID 2872 wrote to memory of 840	2872	9576cc7c1d016017905b260b127b983f.exe	111
PID 2872 wrote to memory of 840	2872	9576cc7c1d016017905b260b127b983f.exe	111
PID 2872 wrote to memory of 840	2872	9576cc7c1d016017905b260b127b983f.exe	111
PID 840 wrote to memory of 2176	840	wininit.exe	112
PID 840 wrote to memory of 2176	840	wininit.exe	112
PID 840 wrote to memory of 2176	840	wininit.exe	112
PID 840 wrote to memory of 1788	840	wininit.exe	113
PID 840 wrote to memory of 1788	840	wininit.exe	113
PID 840 wrote to memory of 1788	840	wininit.exe	113
PID 2176 wrote to memory of 984	2176	WScript.exe	116
PID 2176 wrote to memory of 984	2176	WScript.exe	116
PID 2176 wrote to memory of 984	2176	WScript.exe	116
PID 984 wrote to memory of 2068	984	wininit.exe	117

System policy modification 1 TTPs 33 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	9576cc7c1d016017905b260b127b983f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	9576cc7c1d016017905b260b127b983f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	9576cc7c1d016017905b260b127b983f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9576cc7c1d016017905b260b127b983f.exe
"C:\Users\Admin\AppData\Local\Temp\9576cc7c1d016017905b260b127b983f.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9576cc7c1d016017905b260b127b983f.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\setup.exe\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\tracing\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\9576cc7c1d016017905b260b127b983f.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\ja-JP\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\en-US\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\9576cc7c1d016017905b260b127b983f.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\Panther\setup.exe\wininit.exe
  "C:\Windows\Panther\setup.exe\wininit.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:840
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69972d40-dc5d-4747-9b00-53fdeb4cdd0e.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\Panther\setup.exe\wininit.exe
      C:\Windows\Panther\setup.exe\wininit.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:984
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c70c5d09-e2ef-4181-b2e0-04c46f838c1d.vbs"
        5⤵
        
        PID:2068
      - C:\Windows\Panther\setup.exe\wininit.exe
        
        C:\Windows\Panther\setup.exe\wininit.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\442cdd65-5108-4ceb-a2f6-e1bd448e7d9a.vbs"
        7⤵
        
        PID:2912
        
        C:\Windows\Panther\setup.exe\wininit.exe
        
        C:\Windows\Panther\setup.exe\wininit.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3032
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6f559f5-a86f-47f7-a593-c2d01b452dba.vbs"
        9⤵
        
        PID:3024
        
        C:\Windows\Panther\setup.exe\wininit.exe
        
        C:\Windows\Panther\setup.exe\wininit.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e58f1ce3-8b21-4da9-82a6-b3092ca0d381.vbs"
        11⤵
        
        PID:2396
        
        C:\Windows\Panther\setup.exe\wininit.exe
        
        C:\Windows\Panther\setup.exe\wininit.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        System policy modification
        
        PID:2372
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00179c0b-47da-4980-be60-701adf104080.vbs"
        13⤵
        
        PID:1272
        
        C:\Windows\Panther\setup.exe\wininit.exe
        
        C:\Windows\Panther\setup.exe\wininit.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8351839f-7eba-4a9e-aeff-12b40920e325.vbs"
        15⤵
        
        PID:1340
        
        C:\Windows\Panther\setup.exe\wininit.exe
        
        C:\Windows\Panther\setup.exe\wininit.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4d0e6ab-2b3c-4cf2-9e69-871b3daca1e7.vbs"
        17⤵
        
        PID:2056
        
        C:\Windows\Panther\setup.exe\wininit.exe
        
        C:\Windows\Panther\setup.exe\wininit.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\955d0617-e10e-407e-bbb4-b49d58cad813.vbs"
        19⤵
        
        PID:1820
        
        C:\Windows\Panther\setup.exe\wininit.exe
        
        C:\Windows\Panther\setup.exe\wininit.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd108427-8a4d-4364-a983-c6b312874c2c.vbs"
        21⤵
        
        PID:1308
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7dbaddf5-9425-4ae8-aa76-f1045cf73b9d.vbs"
        21⤵
        
        PID:1936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70873ed7-959c-4ef7-b871-adaf4788a12a.vbs"
        19⤵
        
        PID:2896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd854dbf-8465-4789-914b-2b51174cf89b.vbs"
        17⤵
        
        PID:1052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5dda15f-9f05-4d8c-98ba-6b9e41d9b1a0.vbs"
        15⤵
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5276eaf-9d3b-472a-ab32-31f3023d97fd.vbs"
        13⤵
        
        PID:2884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eeba4631-a695-4293-bbc8-b94fefd2b111.vbs"
        11⤵
        
        PID:3008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e9740e5-9919-47b8-a481-de28fb49cb5f.vbs"
        9⤵
        
        PID:2312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80801376-fd1f-4d01-8c80-8d756d8ba65e.vbs"
        7⤵
        
        PID:2284
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88006b75-ddd3-4803-87d8-add989eb4ce7.vbs"
        5⤵
        
        PID:2532
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eab2cf72-930f-4423-ae45-2d6988cd9307.vbs"
    3⤵
    PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\setup.exe\wininit.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\setup.exe\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\winlogon.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\tracing\spoolsv.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\tracing\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Windows\tracing\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9576cc7c1d016017905b260b127b983f9" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Uninstall Information\9576cc7c1d016017905b260b127b983f.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9576cc7c1d016017905b260b127b983f" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\9576cc7c1d016017905b260b127b983f.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9576cc7c1d016017905b260b127b983f9" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Uninstall Information\9576cc7c1d016017905b260b127b983f.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\CrashReports\Idle.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\Idle.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\CrashReports\Idle.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\dwm.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\dwm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\dwm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\audiodg.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\audiodg.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Windows\PCHEALTH\ERRORREP\QHEADLES\audiodg.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\taskhost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\taskhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\taskhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\System.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\System.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\System.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\en-US\wininit.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\en-US\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9576cc7c1d016017905b260b127b983f9" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\9576cc7c1d016017905b260b127b983f.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9576cc7c1d016017905b260b127b983f" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\9576cc7c1d016017905b260b127b983f.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9576cc7c1d016017905b260b127b983f9" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\9576cc7c1d016017905b260b127b983f.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\audiodg.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\spoolsv.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\WTR\lsass.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\Migration\WTR\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\csrss.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Uninstall Information\9576cc7c1d016017905b260b127b983f.exe

Filesize
1.9MB

MD5
9576cc7c1d016017905b260b127b983f

SHA1
085fbeb0456c1eb2f9d1854e4940def27aab0386

SHA256
5d64fc503e241b1ffafe9179e97d244b2af292a14b95f5513c48ba0557d14de2

SHA512
8bb12a73650c814edf1899c1453b40b92114f316de9b76dbd20f724f2970514f0f4c6afcf41a37a8796e90917f4ef11cea1043e6815e08ce199643a27f64c4a0

Download Submit
C:\Program Files (x86)\Windows NT\9576cc7c1d016017905b260b127b983f.exe

Filesize
1.9MB

MD5
91e88444556c35fda6505e418e1da7fb

SHA1
fae8314742ee57ad2e475b2970b4c66f1096a44e

SHA256
f63b12c2b42358100561a13f746f8ca5119f823eb0b2e08d67a914d2ba1a360e

SHA512
2991e39e7ed58c965db44ba0c2fd54220c12231af0922b6ad8f2414ed305e89066ad186cdfd8a4f3825249eb18d50dd4736db83d234b7fde46f2993140e1b726

Download Submit
C:\Program Files\Internet Explorer\winlogon.exe

Filesize
1.9MB

MD5
5c807d4431573acb0a9199f7c6f580b1

SHA1
34af6095b527544a593e4e812ddab5669fa6deed

SHA256
57322dbab498bfab506d619d966bda40d0917e4249818e3a78d4515e96a9d19d

SHA512
218d96231f4deadd6ddfdc89ffede9153aff3fa9ffcb52b5a3534ed3b4c117d570fa56d3109e5351f7c3e0acda6be1c0e822bf4766a9dead164df3cea1b48136

Download Submit
C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\System.exe

Filesize
1.9MB

MD5
8413f94d5ccca3bfccceed8592499220

SHA1
a86aedba10d0f96ddd533a2c2522fe80f4b232ae

SHA256
bd6f2ea5cde01f356177f7fa923f61734e35577ab29cf8d0814f80e62343ebb5

SHA512
6e7be3d6b3374faf11140c01adf1af352ee4119140206c2e8b8d03e721eb6cc53bbca85a5fc886d61be14d242be14b68bed807c11fb9528ee22d327c734311ac

Download Submit
C:\Recovery\8490d022-e5e1-11ef-8fd8-4a893fa2fe1c\dwm.exe

Filesize
1.9MB

MD5
682ce6acd08d3b456b9389db0e2a4434

SHA1
493c873bee066270c18a12c4e549f82688f51265

SHA256
6e144f9a2b08bdbdd242800e71936860c0a2c14b6c68daa5c423a553ad217761

SHA512
7b54a356b8584c045e9c3dedaba9d1aa306793cb8ca81b4f50a0cd2769ed3a356c13365cd665f96d9d8e998349c31e9e7587b64d5ec9a52439aaf68a4ea8a61b

Download Submit
C:\Users\Admin\AppData\Local\Temp\442cdd65-5108-4ceb-a2f6-e1bd448e7d9a.vbs

Filesize
716B

MD5
e266c238e3ab34a71ab84e4d4fe0d023

SHA1
1564ac27c99eae7a9aa15b5efa92aed8d717e6b8

SHA256
119407502f78e4ef3cfd6d50e936ebb4b395ec3a209abc0451337300426f37c8

SHA512
59fa1b0d15d826b765f549995673956f3c1ae6ce6be65f65cc91af41d4ddc4a0319da1f213d5ae3987b9660bf74811d8338a5b8799c5026c8087edbf95847082

Download Submit
C:\Users\Admin\AppData\Local\Temp\69972d40-dc5d-4747-9b00-53fdeb4cdd0e.vbs

Filesize
715B

MD5
6ac3405dd8c1c0dbb70f79eb9c16e629

SHA1
7f7796f8c1a413ca59e40e438a4b270ae3024526

SHA256
af6d7a7b645c01d3e82c9c99a770c20d876ad0cc0ff18667f2c1f1d7f29b4018

SHA512
9695c8bed3486111bc0c3d7017a72aa9a77bec5dce165d3b4b8adb37436beb4866e92c70d311f6f33e508f0182d15656cefb9d5447b0cd444731ce9b41eb7c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8351839f-7eba-4a9e-aeff-12b40920e325.vbs

Filesize
716B

MD5
5814da175f06a0cda47f8dba9c63c2ac

SHA1
3a7245cecb7377db73f9e77661a80bc03f244830

SHA256
6cddc80a9178c5f9ae52a47b3157e3fba87454d37df50a4fc2904fb10cde76b2

SHA512
d054a70be07975a46ff1aa7d5609c28c685bd2ed81766d6a03df1ba19a728568fd46579cc1a45caf163a62888122321b2f558e337ff4cb4f38970879c97775d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\955d0617-e10e-407e-bbb4-b49d58cad813.vbs

Filesize
715B

MD5
310796d65161b388adc46e4be203a9f4

SHA1
a5f24104b82935ae1b05ef735ace74cac2838b88

SHA256
abffda24a29573e74d16b1567965d02d3436048fc833d32d9165494dacc65ff6

SHA512
87f39f4bac6a8f5a755f440086374b3c63c31571cc02d40d8fd6b6c5f4d08c47b22550ce754f81e49c34c723c2b7af5c7f3692850561874b5589b68f135a2662

Download Submit
C:\Users\Admin\AppData\Local\Temp\a6f559f5-a86f-47f7-a593-c2d01b452dba.vbs

Filesize
716B

MD5
dbfd3cd658a19ce00d8e5c3b3a8a8afb

SHA1
7e1a0b1ef9b051a6270883f2e5f6e261dc29c021

SHA256
b1fa94d2586686b8ff528b99822ff9469f503029893b0fc83701c7460262ffb0

SHA512
e704f441348ad07e96164042955e8eebf7377a08a7e9ca7cf20562eeb9bd01d2acd07fbcb15cb6ab5410ef5da27d8226e14641a516821edffb075680887ef5a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\c70c5d09-e2ef-4181-b2e0-04c46f838c1d.vbs

Filesize
715B

MD5
a2121b0c6a7690f9a6f32c4916fc721a

SHA1
bda40ee63feac5a71139cca3546a1a1ebc2c7fce

SHA256
ddac3c0310b9126fe3e64c3333e1dfb0b3ba1f7d6b24cde18776a2112be10241

SHA512
6caa6155f9ba7fdd4df2c83d466e177d62a92183cd4122fc10b38dc5fbe4712513381023de477196980c07dbc6a96c4070704dcc596bb2ae890a5e0775f8a34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd108427-8a4d-4364-a983-c6b312874c2c.vbs

Filesize
715B

MD5
9d4686a8ffc20e0e368ceed294e19e4f

SHA1
2b182ea4539f017d1142b2d569e355dbadae268c

SHA256
2e1cde22959b9982f7b2837cb76858c252e8c59887a0a28adf9aa50e542e1f8b

SHA512
d469e3c95ee2ba081a06743887725b645aff2c05dc4c6dd352e7a37ae99b24990c7880204a0c7d734eff462a1ae8bbe4c9ae1b7fde9ffb14d7404662b2ae2599

Download Submit
C:\Users\Admin\AppData\Local\Temp\e58f1ce3-8b21-4da9-82a6-b3092ca0d381.vbs

Filesize
716B

MD5
2d9e7e8f1bba8bf8e787cc760eee64c7

SHA1
eb70eaa2e265222fde56b0a46b9ac8fdeaa0c561

SHA256
46263ca6589c7aaa462794e33cac2a6f0dc11060cf78c6bb2ed72e1e7c591b53

SHA512
456bae4eab00d1e7208ce8086a8a73598d1387869a74c7ee8d350a1a39c1df08c829b2861fed99913fd27c768e3a9ba276487803dc24704c8a6f7bd8ded64bcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\eab2cf72-930f-4423-ae45-2d6988cd9307.vbs

Filesize
492B

MD5
a582a7033ce9d08cf49f683ddb1891f6

SHA1
3b7980d7c405afec156aaf3d0f48e0365cdd528e

SHA256
cdccbb543faeb3386562baf43e311ec208b1a3893f93678507eee7e2207b9836

SHA512
7d4d3f8d5aed3579ae5b983e27866d95a5e3276b123aac07b63cd68b82d72818d2485d3335270a58d92bcff84aed6492172b24d62bb4e80465c6247bce57a4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\f4d0e6ab-2b3c-4cf2-9e69-871b3daca1e7.vbs

Filesize
716B

MD5
12b95b4d36619964d7eefae243d9dd7a

SHA1
17e18e39630e1c8d7efda53b89b30e1fcb08f9de

SHA256
35c0fea7f2124bca3e319aee838c5ab342f863d0d9fa3485404b24dd9b1bf5eb

SHA512
031f2cbb2e25f3e837114bcebf8d0bb02fabae6f2fbaa153c3c414819e71e4fe7c84a1fb6a1ae8edab9f76652c3297012786969b7e1a3f70f93fb2087ee2ee09

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a5b76944cb16dfcaec9b6b63f6212c06

SHA1
a543e466f961009e8f7f01b2859d0483980c0b83

SHA256
ecfa8bbcba4f9226cc7353aa424eaaf1473f3f7fdc1e9d35564c2c48584d1a05

SHA512
90bd4d3e6457cf0b26e47f1da72a7b9bec6ff51ca445f0213e90ca9b991fddae09e58b7f6483d9611695b59195ab998dd873f6176ee8c20e588cebd26c302825

Download Submit
memory/316-437-0x0000000000340000-0x000000000052A000-memory.dmp

Filesize
1.9MB

Download
memory/316-438-0x0000000002150000-0x00000000021A6000-memory.dmp

Filesize
344KB

Download
memory/840-327-0x00000000007F0000-0x0000000000802000-memory.dmp

Filesize
72KB

Download
memory/840-258-0x0000000000E30000-0x000000000101A000-memory.dmp

Filesize
1.9MB

Download
memory/952-424-0x0000000001110000-0x00000000012FA000-memory.dmp

Filesize
1.9MB

Download
memory/952-425-0x0000000000A80000-0x0000000000A92000-memory.dmp

Filesize
72KB

Download
memory/984-352-0x0000000000CE0000-0x0000000000D36000-memory.dmp

Filesize
344KB

Download
memory/1044-364-0x00000000010F0000-0x00000000012DA000-memory.dmp

Filesize
1.9MB

Download
memory/1860-400-0x00000000002E0000-0x00000000004CA000-memory.dmp

Filesize
1.9MB

Download
memory/1892-256-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/1892-260-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/2364-412-0x0000000000EB0000-0x000000000109A000-memory.dmp

Filesize
1.9MB

Download
memory/2872-5-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download
memory/2872-4-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download
memory/2872-12-0x0000000000530000-0x0000000000542000-memory.dmp

Filesize
72KB

Download
memory/2872-10-0x0000000000520000-0x0000000000528000-memory.dmp

Filesize
32KB

Download
memory/2872-8-0x00000000004C0000-0x0000000000516000-memory.dmp

Filesize
344KB

Download
memory/2872-13-0x0000000000950000-0x000000000095C000-memory.dmp

Filesize
48KB

Download
memory/2872-0-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2872-3-0x0000000000450000-0x000000000046C000-memory.dmp

Filesize
112KB

Download
memory/2872-6-0x0000000000480000-0x0000000000496000-memory.dmp

Filesize
88KB

Download
memory/2872-18-0x0000000002350000-0x000000000235C000-memory.dmp

Filesize
48KB

Download
memory/2872-7-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2872-207-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2872-17-0x0000000002340000-0x000000000234C000-memory.dmp

Filesize
48KB

Download
memory/2872-2-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2872-257-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2872-232-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2872-9-0x0000000000510000-0x000000000051C000-memory.dmp

Filesize
48KB

Download
memory/2872-14-0x0000000002310000-0x000000000231A000-memory.dmp

Filesize
40KB

Download
memory/2872-1-0x0000000000960000-0x0000000000B4A000-memory.dmp

Filesize
1.9MB

Download
memory/2872-15-0x0000000002320000-0x000000000232E000-memory.dmp

Filesize
56KB

Download
memory/2872-16-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download
memory/3032-376-0x0000000000A90000-0x0000000000AA2000-memory.dmp

Filesize
72KB

Download