400c24bdb9b7dabfcd9a8a2f137550f338014d833d169c6e6f4252910fb95feb

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a31ba0b291554684b4a097371669bc4c.exe
Size

1.9MB
MD5

a31ba0b291554684b4a097371669bc4c
SHA1

0a5034d116b71c1a99879ef632962026b5b774aa
SHA256

0bfce2cf34dbbf853a1171acf4ac9e2802d3e67285222bcf8d43dffec50b6593
SHA512

8d8c96ad82f63aa8f7f3345d3905f5eff42cc3d8b50822036e128b9f886777cf475962161c3c308ee4867b05a5ef05b52d68be3e317b6a9505029c4f03547c67
SSDEEP

24576:0z4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:0OMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6048	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5276	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5708	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5452	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5300	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	2972	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	2972	schtasks.exe	89

UAC bypass 3 TTPs 24 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4780	powershell.exe
5972	powershell.exe
224	powershell.exe
1960	powershell.exe
4500	powershell.exe
5412	powershell.exe
6060	powershell.exe
3060	powershell.exe
4540	powershell.exe
5668	powershell.exe
4592	powershell.exe
4544	powershell.exe
4784	powershell.exe
6068	powershell.exe
268	powershell.exe
3788	powershell.exe
2948	powershell.exe
2292	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	a31ba0b291554684b4a097371669bc4c.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	a31ba0b291554684b4a097371669bc4c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 7 IoCs

pid	Process
764	fontdrvhost.exe
3132	fontdrvhost.exe
3096	fontdrvhost.exe
2536	fontdrvhost.exe
4440	fontdrvhost.exe
2988	fontdrvhost.exe
3976	fontdrvhost.exe

Checks whether UAC is enabled 1 TTPs 16 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\69ddcba757bf72	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files\edge_BITS_4596_316599628\RCXB35B.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXBE32.tmp	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files\edge_BITS_4596_316599628\services.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files\Google\Chrome\Application\dllhost.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files\Google\Chrome\Application\5940a34987c991	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXB99A.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXBA18.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\smss.exe	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXBE33.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\dllhost.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files\edge_BITS_4596_316599628\c5b4cb5e9653cc	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Program Files\Windows Multimedia Platform\smss.exe	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files\edge_BITS_4596_316599628\RCXB2DD.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Program Files\edge_BITS_4596_316599628\services.exe	a31ba0b291554684b4a097371669bc4c.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCXBC1E.tmp	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Windows\SoftwareDistribution\DataStore\Logs\5b884080fd4f94	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Windows\Prefetch\ReadyBoot\6203df4a6bafc7	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\RCXAEB3.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCXBC1D.tmp	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\lsass.exe	a31ba0b291554684b4a097371669bc4c.exe
File created	C:\Windows\Prefetch\ReadyBoot\lsass.exe	a31ba0b291554684b4a097371669bc4c.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\RCXAEB4.tmp	a31ba0b291554684b4a097371669bc4c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	a31ba0b291554684b4a097371669bc4c.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	fontdrvhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4688	schtasks.exe
4940	schtasks.exe
5080	schtasks.exe
4676	schtasks.exe
1092	schtasks.exe
5104	schtasks.exe
4892	schtasks.exe
4512	schtasks.exe
4260	schtasks.exe
5452	schtasks.exe
1292	schtasks.exe
4856	schtasks.exe
932	schtasks.exe
1964	schtasks.exe
5708	schtasks.exe
944	schtasks.exe
552	schtasks.exe
2256	schtasks.exe
3656	schtasks.exe
4748	schtasks.exe
1044	schtasks.exe
2244	schtasks.exe
5072	schtasks.exe
4376	schtasks.exe
4732	schtasks.exe
4832	schtasks.exe
4992	schtasks.exe
3404	schtasks.exe
848	schtasks.exe
3140	schtasks.exe
4116	schtasks.exe
3752	schtasks.exe
4904	schtasks.exe
4788	schtasks.exe
3744	schtasks.exe
5036	schtasks.exe
6048	schtasks.exe
5088	schtasks.exe
3700	schtasks.exe
4772	schtasks.exe
2568	schtasks.exe
1644	schtasks.exe
3228	schtasks.exe
5300	schtasks.exe
4944	schtasks.exe
2248	schtasks.exe
4976	schtasks.exe
3780	schtasks.exe
5276	schtasks.exe
1140	schtasks.exe
4888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
3440	a31ba0b291554684b4a097371669bc4c.exe
4592	powershell.exe
4592	powershell.exe
5972	powershell.exe
5972	powershell.exe
2292	powershell.exe
2292	powershell.exe
4544	powershell.exe
4544	powershell.exe
3060	powershell.exe
3060	powershell.exe
224	powershell.exe
224	powershell.exe
4500	powershell.exe
4500	powershell.exe
4780	powershell.exe
4780	powershell.exe
4540	powershell.exe
4540	powershell.exe
5668	powershell.exe
5668	powershell.exe
6060	powershell.exe
6060	powershell.exe
5412	powershell.exe
5412	powershell.exe
6068	powershell.exe
6068	powershell.exe
1960	powershell.exe
1960	powershell.exe
268	powershell.exe
268	powershell.exe
2948	powershell.exe
2948	powershell.exe
3788	powershell.exe
3788	powershell.exe
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
4592	powershell.exe
4592	powershell.exe
3060	powershell.exe
3060	powershell.exe
4500	powershell.exe
4500	powershell.exe
224	powershell.exe
224	powershell.exe
4544	powershell.exe
4544	powershell.exe
5972	powershell.exe
5972	powershell.exe
6060	powershell.exe
5412	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	a31ba0b291554684b4a097371669bc4c.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	5972	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	5668	powershell.exe
Token: SeDebugPrivilege	6060	powershell.exe
Token: SeDebugPrivilege	5412	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	268	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	764	fontdrvhost.exe
Token: SeDebugPrivilege	3132	fontdrvhost.exe
Token: SeDebugPrivilege	3096	fontdrvhost.exe
Token: SeDebugPrivilege	2536	fontdrvhost.exe
Token: SeDebugPrivilege	4440	fontdrvhost.exe
Token: SeDebugPrivilege	2988	fontdrvhost.exe
Token: SeDebugPrivilege	3976	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4544	3440	a31ba0b291554684b4a097371669bc4c.exe	144
PID 3440 wrote to memory of 4544	3440	a31ba0b291554684b4a097371669bc4c.exe	144
PID 3440 wrote to memory of 4592	3440	a31ba0b291554684b4a097371669bc4c.exe	145
PID 3440 wrote to memory of 4592	3440	a31ba0b291554684b4a097371669bc4c.exe	145
PID 3440 wrote to memory of 4540	3440	a31ba0b291554684b4a097371669bc4c.exe	146
PID 3440 wrote to memory of 4540	3440	a31ba0b291554684b4a097371669bc4c.exe	146
PID 3440 wrote to memory of 2292	3440	a31ba0b291554684b4a097371669bc4c.exe	148
PID 3440 wrote to memory of 2292	3440	a31ba0b291554684b4a097371669bc4c.exe	148
PID 3440 wrote to memory of 4500	3440	a31ba0b291554684b4a097371669bc4c.exe	149
PID 3440 wrote to memory of 4500	3440	a31ba0b291554684b4a097371669bc4c.exe	149
PID 3440 wrote to memory of 2948	3440	a31ba0b291554684b4a097371669bc4c.exe	150
PID 3440 wrote to memory of 2948	3440	a31ba0b291554684b4a097371669bc4c.exe	150
PID 3440 wrote to memory of 3060	3440	a31ba0b291554684b4a097371669bc4c.exe	152
PID 3440 wrote to memory of 3060	3440	a31ba0b291554684b4a097371669bc4c.exe	152
PID 3440 wrote to memory of 3788	3440	a31ba0b291554684b4a097371669bc4c.exe	153
PID 3440 wrote to memory of 3788	3440	a31ba0b291554684b4a097371669bc4c.exe	153
PID 3440 wrote to memory of 1960	3440	a31ba0b291554684b4a097371669bc4c.exe	155
PID 3440 wrote to memory of 1960	3440	a31ba0b291554684b4a097371669bc4c.exe	155
PID 3440 wrote to memory of 6060	3440	a31ba0b291554684b4a097371669bc4c.exe	156
PID 3440 wrote to memory of 6060	3440	a31ba0b291554684b4a097371669bc4c.exe	156
PID 3440 wrote to memory of 224	3440	a31ba0b291554684b4a097371669bc4c.exe	158
PID 3440 wrote to memory of 224	3440	a31ba0b291554684b4a097371669bc4c.exe	158
PID 3440 wrote to memory of 268	3440	a31ba0b291554684b4a097371669bc4c.exe	159
PID 3440 wrote to memory of 268	3440	a31ba0b291554684b4a097371669bc4c.exe	159
PID 3440 wrote to memory of 5412	3440	a31ba0b291554684b4a097371669bc4c.exe	160
PID 3440 wrote to memory of 5412	3440	a31ba0b291554684b4a097371669bc4c.exe	160
PID 3440 wrote to memory of 5972	3440	a31ba0b291554684b4a097371669bc4c.exe	161
PID 3440 wrote to memory of 5972	3440	a31ba0b291554684b4a097371669bc4c.exe	161
PID 3440 wrote to memory of 5668	3440	a31ba0b291554684b4a097371669bc4c.exe	163
PID 3440 wrote to memory of 5668	3440	a31ba0b291554684b4a097371669bc4c.exe	163
PID 3440 wrote to memory of 6068	3440	a31ba0b291554684b4a097371669bc4c.exe	166
PID 3440 wrote to memory of 6068	3440	a31ba0b291554684b4a097371669bc4c.exe	166
PID 3440 wrote to memory of 4784	3440	a31ba0b291554684b4a097371669bc4c.exe	167
PID 3440 wrote to memory of 4784	3440	a31ba0b291554684b4a097371669bc4c.exe	167
PID 3440 wrote to memory of 4780	3440	a31ba0b291554684b4a097371669bc4c.exe	168
PID 3440 wrote to memory of 4780	3440	a31ba0b291554684b4a097371669bc4c.exe	168
PID 3440 wrote to memory of 764	3440	a31ba0b291554684b4a097371669bc4c.exe	181
PID 3440 wrote to memory of 764	3440	a31ba0b291554684b4a097371669bc4c.exe	181
PID 764 wrote to memory of 5164	764	fontdrvhost.exe	183
PID 764 wrote to memory of 5164	764	fontdrvhost.exe	183
PID 764 wrote to memory of 5688	764	fontdrvhost.exe	184
PID 764 wrote to memory of 5688	764	fontdrvhost.exe	184
PID 5164 wrote to memory of 3132	5164	WScript.exe	187
PID 5164 wrote to memory of 3132	5164	WScript.exe	187
PID 3132 wrote to memory of 3324	3132	fontdrvhost.exe	188
PID 3132 wrote to memory of 3324	3132	fontdrvhost.exe	188
PID 3132 wrote to memory of 5608	3132	fontdrvhost.exe	189
PID 3132 wrote to memory of 5608	3132	fontdrvhost.exe	189
PID 3324 wrote to memory of 3096	3324	WScript.exe	194
PID 3324 wrote to memory of 3096	3324	WScript.exe	194
PID 3096 wrote to memory of 3784	3096	fontdrvhost.exe	195
PID 3096 wrote to memory of 3784	3096	fontdrvhost.exe	195
PID 3096 wrote to memory of 5464	3096	fontdrvhost.exe	196
PID 3096 wrote to memory of 5464	3096	fontdrvhost.exe	196
PID 3784 wrote to memory of 2536	3784	WScript.exe	200
PID 3784 wrote to memory of 2536	3784	WScript.exe	200
PID 2536 wrote to memory of 1608	2536	fontdrvhost.exe	201
PID 2536 wrote to memory of 1608	2536	fontdrvhost.exe	201
PID 2536 wrote to memory of 776	2536	fontdrvhost.exe	202
PID 2536 wrote to memory of 776	2536	fontdrvhost.exe	202
PID 1608 wrote to memory of 4440	1608	WScript.exe	204
PID 1608 wrote to memory of 4440	1608	WScript.exe	204
PID 4440 wrote to memory of 1308	4440	fontdrvhost.exe	205
PID 4440 wrote to memory of 1308	4440	fontdrvhost.exe	205

System policy modification 1 TTPs 24 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a31ba0b291554684b4a097371669bc4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a31ba0b291554684b4a097371669bc4c.exe
"C:\Users\Admin\AppData\Local\Temp\a31ba0b291554684b4a097371669bc4c.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a31ba0b291554684b4a097371669bc4c.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Local Settings\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d25f591a00514bc9ba8441\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d25f591a00514bc9ba8441\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d25f591a00514bc9ba8441\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\d25f591a00514bc9ba8441\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4596_316599628\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Pictures\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\7e20f84d5244aba7145631d4073af8\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
  "C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:764
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0c793fd-eea8-415e-b125-0f7625e6c28a.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
      C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3132
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d290c958-820b-45f3-9d5d-3025a704875b.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3324
      - C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
        
        C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30f0f654-b1a2-46c8-a2a2-ebedcea0bd24.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
        
        C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e32cd8b3-a67f-48c3-9e31-fc150c1b3ca5.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
        
        C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a44982d2-5449-4aaf-aed8-870990d473ef.vbs"
        11⤵
        
        PID:1308
        
        C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
        
        C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e55142e0-aefd-4e7c-bb5e-288dbb10f6c5.vbs"
        13⤵
        
        PID:1204
        
        C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
        
        C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64185405-e87e-451d-b832-4ed3f582382b.vbs"
        15⤵
        
        PID:1364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f6b9b162-172e-4589-8216-f5206506a979.vbs"
        15⤵
        
        PID:4792
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2411b1fe-e527-44c5-9b98-45bec771ce71.vbs"
        13⤵
        
        PID:4564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0d07775-b418-4abd-a8a4-7fa315a1f60b.vbs"
        11⤵
        
        PID:4480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac5791d7-7e50-40f7-afcd-bee2764faa12.vbs"
        9⤵
        
        PID:776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13040e2f-b873-4a4c-850b-f3dc28ff7306.vbs"
        7⤵
        
        PID:5464
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\584f614b-9162-4051-b5d2-32ea4879eb05.vbs"
        5⤵
        
        PID:5608
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c5d8cea-8fe1-45e9-becb-179d2845c3ed.vbs"
    3⤵
    PID:5688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Desktop\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\Desktop\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Desktop\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Local Settings\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Local Settings\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\7e20f84d5244aba7145631d4073af8\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\d25f591a00514bc9ba8441\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\d25f591a00514bc9ba8441\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\d25f591a00514bc9ba8441\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\d25f591a00514bc9ba8441\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\d25f591a00514bc9ba8441\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\d25f591a00514bc9ba8441\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Public\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Public\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\d25f591a00514bc9ba8441\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\d25f591a00514bc9ba8441\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\d25f591a00514bc9ba8441\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\d25f591a00514bc9ba8441\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\d25f591a00514bc9ba8441\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\d25f591a00514bc9ba8441\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\edge_BITS_4596_316599628\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4596_316599628\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\edge_BITS_4596_316599628\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Pictures\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\Pictures\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Pictures\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\7e20f84d5244aba7145631d4073af8\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\7e20f84d5244aba7145631d4073af8\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\7e20f84d5244aba7145631d4073af8\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\Prefetch\ReadyBoot\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Prefetch\ReadyBoot\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Multimedia Platform\smss.exe

Filesize
1.9MB

MD5
cf2abe80b262b63b4bf10d22a12a0df3

SHA1
f8c2bb11a9c9ef255b6e98d548fb6e0f99221a8b

SHA256
1808ee817521ee73cc3e7d507135c5fa1fccbde30f2363d687b4fa461254ef1e

SHA512
8956be3d7e0bd06ed0e2e735100d51d79f511f899962da365af03dd69f917e127dfbcebda01a83dc772597eb7081bd96d480dd054edb3c40ade4f9094571fba6

Download Submit
C:\Program Files\edge_BITS_4596_316599628\services.exe

Filesize
1.9MB

MD5
7bc132a12a1a0b2b8925c1463975a4ad

SHA1
77d7725ac58ba8208a6353f90c7cccb35c90ea98

SHA256
c6bdadbe2f3eda8f21b12269fac0434705ddc6af8fd7329c7907633a77fef1a7

SHA512
9bba8a9e02d48eb15a152a84c9dca29a8494943eca72c440872eefe42e91ebfb2bc6559ce823ed9acf002f09313da015b1c845080c4f3f407e47f5702138c38b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Filesize
1KB

MD5
364147c1feef3565925ea5b4ac701a01

SHA1
9a46393ac3ffad3bb3c8f0e074b65d68d75e21ef

SHA256
38cf1ab1146ad24e88763fc0508c2a99478d8428b453ba8c8b830d2883a4562b

SHA512
bfec1d3f22abd5668def189259deb4d919ceb4d51ac965d0baf9b6cf8bea0db680d49a2b8d0b75524cc04c7803cdfd91e484b31dc8ddc3ff47d1e5c59a9e35cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61c5e5652b1157365c7698665230f99c

SHA1
d128376d2856dff53452ee26f098fb490ee47fd5

SHA256
18780691720f3aeaf2365ba59345061e776938c2b19b2e4f1ef6d6c3e5d839e2

SHA512
5f6089bc38a3d734822e6f7f718b8b23d15829a1cc98b73f634bd34318b3ce0cb7170cb7e15f7782fa24c9c89ac860e883311bfbe3c6384647e6e5e7158da7ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
400965c5c8206c7b519873fb3aa3aebf

SHA1
0764aa4c62cc242ede7ec00e36539c20e17e5565

SHA256
e8a339e9d5f5699e83419d2fb336577a101a4cd31df7ddd8c71a88dec1593b04

SHA512
32b7c0f5745c3cbb291642e96ce907d0d71f986f0fb1f55f2c5f56dd76d9243d8ca936a7e81c0ef3962d5daf25d51bd93c5de77cdf9c3ed74101e3056e510369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
92b2deffd5900b3c60f9e6737bc5b67d

SHA1
6ce9b13b44a2d7f5635f909b0bb177ea60dd8d06

SHA256
780876a6d4beab15e3264f97a68092540e927c1a24250a03068c4374d57d0906

SHA512
4658231390e04649f6b393abb54d0b2a68771731ef3780207139d0a66a73e866f70dc4e6a0bc9a92e7e78ea01667c68263a001a0f275087a403afd11a80ee27d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
03f50c7070ba1f54782f4ab1969e4753

SHA1
49d81d10c39e5262e0c5ede717d158928dfa8db7

SHA256
6f43b688400511d37e3df0415a140030ccd0b972bd91c364ac036d0ccb798613

SHA512
55e4849066cac0acef3a56183b1083ae594fcda62f3697a8300029a1db7f535b2df911fb67abfce881349c5fc66d3fc08e345ceb3e368dc9f1bd3e5541ad7941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a822dfe702436e366414e8ddb6fb41d0

SHA1
db35e49e01a1baf69d51d52375fb26da32b12ddf

SHA256
929a0a2762a94d0f949b0bec034d141a00c1653d8dec84ff994d32e6e115a3b2

SHA512
67d023275898ba86b0f1bc67b0868b0a31038ce366b1ade6e433c1785d4150c8b630462afd2af2479d2268351d1e7dd5a6e99042020cfbfa1490d04420bd296c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0cf7dcc8e715a3adb60273e2d687ec14

SHA1
153e79121708a67a619762b6ead0991d321667ac

SHA256
df09c90760a7d935978206d29a0cd22bf2454f1e73d862d339af43503c6e93f2

SHA512
6e057853c247186574cde2bd8c5c085311ab2a24e85ed16078c869f82379d702b8b7f35400f3430aba03b6103529e6042fe9d6f517b08f9ee1c365d0d3fbec24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a1e48b8d7963bbbb73f442cd864dca3

SHA1
7f71e6af810a734d5f6a0c3ba90c171442e7e334

SHA256
33f70a94f53d11ebf2ea52debe0eb6afd7b30a095b31e784b0d4a0fb42b708e9

SHA512
26599ce4722f735e1b19f8b68d82318978d577245530e23f5445330dbccb395ffff4e6c4020cdeada5b179b94b557a3e093c2dbe5606b1b6956c1f73a91f637e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
15521808f89b47330dc44e0debfb369c

SHA1
f9ff45265173980d8f5ba51c3a68d1b36987db91

SHA256
287b79804eb7d558e133160a42beac75c8fcc49558f883adce9b0da42e2fc18f

SHA512
9479b6c6e58d08183bd968b22c07b0c640c15514f0a6b18d8befead8cb984e23939abcb9ecf69c068cf8105edbe6d9844c402e0b766887d90aa861da8ba2f79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\30f0f654-b1a2-46c8-a2a2-ebedcea0bd24.vbs

Filesize
738B

MD5
4b632550255a0540dc00d615fbb5ebfe

SHA1
e28c1a4e33c229f737e86beab777d275a891beae

SHA256
e3e288f4e49fbf72d7b09247dd36292799f85db641860b907288920b13fbace8

SHA512
6ba1d29c17a7da71e1e949b93e0804d2d2e4ebb1cc34efea29b016111ef0443de547841ff0e12b967751195943f412f803aaadb448b170d66bcf9e701905217b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3c5d8cea-8fe1-45e9-becb-179d2845c3ed.vbs

Filesize
514B

MD5
83f66114855f02c81a0b5568421fa893

SHA1
59e1180e34e72e1ce962ae5834b36957d4c66b56

SHA256
b2a4b17ce5276c7e609b9950585423a634ceb9856fe75b77e0e90143eb67c23e

SHA512
459b078423118338952afaf75e96f1fed445cce242e451edf507e755712d5c3159acf44ed5483dd068e62b96ab7278e8a5cd5d5710045fe312ef4b902b2c9e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\64185405-e87e-451d-b832-4ed3f582382b.vbs

Filesize
738B

MD5
3d51127c5f10fb4648f3a2fd9e7eb647

SHA1
42878058556c4ed520909f28773943b34f072157

SHA256
7861d8b69b68e3ce8d0315fbf690f68f7fbb0f9f10212bd15815935e72b03a6d

SHA512
3452446f0ec60f87a2fee16a418159009f4ceb3997fc9f6a0291fff3176e80777acfb12046ff7e61e8e646cd3a29e7d2f55316439c29d040450f1cf40ca71f7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gv44kjjw.5j4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a44982d2-5449-4aaf-aed8-870990d473ef.vbs

Filesize
738B

MD5
e0af06de87fd3a6793cb562e90ace070

SHA1
d807b85e6ec42b4725fb046b453238300273cbd9

SHA256
6f623e2ada9916f243ffe6a1c902f76e61268f81d9bb5e89e64e913e9c380959

SHA512
a3df7b3bb7d4c34c5821ad2708069a0f7cab568b0e425575789f65603ffb8d99e64739247f75df8732d01bfce32a61322c9fb5f8e3acd109645a07a79e534218

Download Submit
C:\Users\Admin\AppData\Local\Temp\c0c793fd-eea8-415e-b125-0f7625e6c28a.vbs

Filesize
737B

MD5
1610dd7f81ee5ae56c92b6e41122dc89

SHA1
25ac547ed9b9bab6a2e5f4cc614a1dfc855ec4d0

SHA256
1a6d0226bdb8b71fd4e0454905bdae3bb7241d4112c52f6d8b811e69d9e32a16

SHA512
161ca6bee2db78ace81d9b3116cadc9fe0551b577f6b10e6ee10d46e09ca77e0935a28747f7918483451ce889ff8ffac3a747682327a7064790c2fd3fec3a7d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\d290c958-820b-45f3-9d5d-3025a704875b.vbs

Filesize
738B

MD5
0e0c1222e3882ea116a9bf86cb7fcdc1

SHA1
b80c407c88b47f4fa190a2438bd385a458cf9da2

SHA256
9363932b885ece4a24ef1ac4dff361e9d032dc1cb5d0b9b69ea8e6c501775ebd

SHA512
f804148638da8f152630389a6e66183aec0cc009ee93286b267d3792a5ae4b040520e3713102bf4613cc8f2ebaacbc4aa159e197629e000baff96d9c0950129a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e32cd8b3-a67f-48c3-9e31-fc150c1b3ca5.vbs

Filesize
738B

MD5
17da809be6d896e49c1d351ee39e1eb6

SHA1
f2e42102b07b947301b209bbfd69d37758a55e1f

SHA256
5a20026e4b16a2851db8423394032b43ee737d5a4c6e577e8c99b47a9510b979

SHA512
3acd76b2516aea94abf4aa89ecac6e5325726922372bd05405e78569b1eeb627c26acea3b216aa9db9357c4f172d8fc6877564fc97cb381b2b57f68a5757b7f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\e55142e0-aefd-4e7c-bb5e-288dbb10f6c5.vbs

Filesize
738B

MD5
669511242ed3cf107e57027dc91ff524

SHA1
677a9f3b99ad19843285e5f75414f1ccf6c859bc

SHA256
850ffd4dd6e863a3f3466095977617bb684ea26e227b5b2fda0d2bc69cceb8dd

SHA512
22f1a2fc8648be826cb80aebde1f13897838b8b933e1df395f31639ded90ae600453a2e5d76515dec4fb618f208f075264dd5ac30a999103c9486fa4213aecfb

Download Submit
C:\d25f591a00514bc9ba8441\RuntimeBroker.exe

Filesize
1.9MB

MD5
a31ba0b291554684b4a097371669bc4c

SHA1
0a5034d116b71c1a99879ef632962026b5b774aa

SHA256
0bfce2cf34dbbf853a1171acf4ac9e2802d3e67285222bcf8d43dffec50b6593

SHA512
8d8c96ad82f63aa8f7f3345d3905f5eff42cc3d8b50822036e128b9f886777cf475962161c3c308ee4867b05a5ef05b52d68be3e317b6a9505029c4f03547c67

Download Submit
memory/764-487-0x00000000024F0000-0x0000000002546000-memory.dmp

Filesize
344KB

Download
memory/2536-560-0x000000001BB30000-0x000000001BB86000-memory.dmp

Filesize
344KB

Download
memory/3096-548-0x000000001B700000-0x000000001B712000-memory.dmp

Filesize
72KB

Download
memory/3440-11-0x000000001BA30000-0x000000001BA38000-memory.dmp

Filesize
32KB

Download
memory/3440-1-0x0000000000A30000-0x0000000000C1A000-memory.dmp

Filesize
1.9MB

Download
memory/3440-486-0x00007FFC0C2A0000-0x00007FFC0CD61000-memory.dmp

Filesize
10.8MB

Download
memory/3440-9-0x00000000030B0000-0x0000000003106000-memory.dmp

Filesize
344KB

Download
memory/3440-6-0x0000000002F50000-0x0000000002F60000-memory.dmp

Filesize
64KB

Download
memory/3440-238-0x00007FFC0C2A0000-0x00007FFC0CD61000-memory.dmp

Filesize
10.8MB

Download
memory/3440-214-0x00007FFC0C2A3000-0x00007FFC0C2A5000-memory.dmp

Filesize
8KB

Download
memory/3440-8-0x00000000030A0000-0x00000000030AA000-memory.dmp

Filesize
40KB

Download
memory/3440-3-0x0000000002F30000-0x0000000002F4C000-memory.dmp

Filesize
112KB

Download
memory/3440-4-0x000000001B9D0000-0x000000001BA20000-memory.dmp

Filesize
320KB

Download
memory/3440-14-0x000000001CAF0000-0x000000001D018000-memory.dmp

Filesize
5.2MB

Download
memory/3440-13-0x000000001BA40000-0x000000001BA52000-memory.dmp

Filesize
72KB

Download
memory/3440-15-0x000000001BA70000-0x000000001BA7C000-memory.dmp

Filesize
48KB

Download
memory/3440-16-0x000000001BA80000-0x000000001BA8A000-memory.dmp

Filesize
40KB

Download
memory/3440-2-0x00007FFC0C2A0000-0x00007FFC0CD61000-memory.dmp

Filesize
10.8MB

Download
memory/3440-0-0x00007FFC0C2A3000-0x00007FFC0C2A5000-memory.dmp

Filesize
8KB

Download
memory/3440-17-0x000000001BA90000-0x000000001BA9E000-memory.dmp

Filesize
56KB

Download
memory/3440-18-0x000000001C160000-0x000000001C168000-memory.dmp

Filesize
32KB

Download
memory/3440-19-0x000000001C170000-0x000000001C17C000-memory.dmp

Filesize
48KB

Download
memory/3440-20-0x000000001C180000-0x000000001C18C000-memory.dmp

Filesize
48KB

Download
memory/3440-5-0x0000000001670000-0x0000000001678000-memory.dmp

Filesize
32KB

Download
memory/3440-7-0x0000000002F60000-0x0000000002F76000-memory.dmp

Filesize
88KB

Download
memory/3440-10-0x000000001BA20000-0x000000001BA2C000-memory.dmp

Filesize
48KB

Download
memory/4592-321-0x0000025BCDA50000-0x0000025BCDA72000-memory.dmp

Filesize
136KB

Download