400c24bdb9b7dabfcd9a8a2f137550f338014d833d169c6e6f4252910fb95feb

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a277e4ef1921464c0cfaec6401b3189e.exe
Size

1.9MB
MD5

a277e4ef1921464c0cfaec6401b3189e
SHA1

9799231c048b98a296f50ed54f8e476d494243f1
SHA256

d50231e7365521c9292cc1a1a08f7f5a3931097ee03607fb2f7e1a6ca6ed1643
SHA512

e539ea5e9c36227b18ca8196290d50d898a9e1dcc242a590f57ccf3d534fc137fc88174f47348b0098f392c19280e10f79af4e453ffca344ca8dcc4f9afa3aa4
SSDEEP

24576:0z4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:0OMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2852	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	2852	schtasks.exe	31

UAC bypass 3 TTPs 27 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a277e4ef1921464c0cfaec6401b3189e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a277e4ef1921464c0cfaec6401b3189e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a277e4ef1921464c0cfaec6401b3189e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1820	powershell.exe
2596	powershell.exe
1356	powershell.exe
2376	powershell.exe
1876	powershell.exe
548	powershell.exe
1388	powershell.exe
2096	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	a277e4ef1921464c0cfaec6401b3189e.exe

Executes dropped EXE 8 IoCs

pid	Process
3060	explorer.exe
2112	explorer.exe
2248	explorer.exe
2600	explorer.exe
2808	explorer.exe
2640	explorer.exe
896	explorer.exe
960	explorer.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a277e4ef1921464c0cfaec6401b3189e.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a277e4ef1921464c0cfaec6401b3189e.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Multiplayer\101b941d020240	a277e4ef1921464c0cfaec6401b3189e.exe
File created	C:\Program Files\Windows Mail\de-DE\f3b6ecef712a24	a277e4ef1921464c0cfaec6401b3189e.exe
File created	C:\Program Files\VideoLAN\VLC\smss.exe	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\RCXD695.tmp	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\RCXD696.tmp	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\Windows Mail\de-DE\RCXD89A.tmp	a277e4ef1921464c0cfaec6401b3189e.exe
File created	C:\Program Files\Java\OSPPSVC.exe	a277e4ef1921464c0cfaec6401b3189e.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\lsm.exe	a277e4ef1921464c0cfaec6401b3189e.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\lsass.exe	a277e4ef1921464c0cfaec6401b3189e.exe
File created	C:\Program Files\VideoLAN\VLC\69ddcba757bf72	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\Windows Mail\de-DE\spoolsv.exe	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXE272.tmp	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\smss.exe	a277e4ef1921464c0cfaec6401b3189e.exe
File created	C:\Program Files\Windows Mail\de-DE\spoolsv.exe	a277e4ef1921464c0cfaec6401b3189e.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\6203df4a6bafc7	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\lsm.exe	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\Windows Mail\de-DE\RCXD899.tmp	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\RCXDB0B.tmp	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXE204.tmp	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\Java\RCXD490.tmp	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\Java\RCXD491.tmp	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\RCXDB0C.tmp	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\lsass.exe	a277e4ef1921464c0cfaec6401b3189e.exe
File opened for modification	C:\Program Files\Java\OSPPSVC.exe	a277e4ef1921464c0cfaec6401b3189e.exe
File created	C:\Program Files\Java\1610b97d3ab4a7	a277e4ef1921464c0cfaec6401b3189e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2620	schtasks.exe
2828	schtasks.exe
2724	schtasks.exe
2320	schtasks.exe
1304	schtasks.exe
1668	schtasks.exe
2636	schtasks.exe
2484	schtasks.exe
2964	schtasks.exe
1212	schtasks.exe
2736	schtasks.exe
2988	schtasks.exe
2688	schtasks.exe
2932	schtasks.exe
1364	schtasks.exe
2796	schtasks.exe
2668	schtasks.exe
2664	schtasks.exe
2608	schtasks.exe
1224	schtasks.exe
2432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1704	a277e4ef1921464c0cfaec6401b3189e.exe
1704	a277e4ef1921464c0cfaec6401b3189e.exe
1704	a277e4ef1921464c0cfaec6401b3189e.exe
1704	a277e4ef1921464c0cfaec6401b3189e.exe
1704	a277e4ef1921464c0cfaec6401b3189e.exe
1704	a277e4ef1921464c0cfaec6401b3189e.exe
1704	a277e4ef1921464c0cfaec6401b3189e.exe
1704	a277e4ef1921464c0cfaec6401b3189e.exe
1704	a277e4ef1921464c0cfaec6401b3189e.exe
1876	powershell.exe
548	powershell.exe
1820	powershell.exe
2596	powershell.exe
2376	powershell.exe
1356	powershell.exe
2096	powershell.exe
1388	powershell.exe
3060	explorer.exe
2112	explorer.exe
2248	explorer.exe
2600	explorer.exe
2808	explorer.exe
2640	explorer.exe
896	explorer.exe
960	explorer.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	a277e4ef1921464c0cfaec6401b3189e.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	3060	explorer.exe
Token: SeDebugPrivilege	2112	explorer.exe
Token: SeDebugPrivilege	2248	explorer.exe
Token: SeDebugPrivilege	2600	explorer.exe
Token: SeDebugPrivilege	2808	explorer.exe
Token: SeDebugPrivilege	2640	explorer.exe
Token: SeDebugPrivilege	896	explorer.exe
Token: SeDebugPrivilege	960	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1820	1704	a277e4ef1921464c0cfaec6401b3189e.exe	53
PID 1704 wrote to memory of 1820	1704	a277e4ef1921464c0cfaec6401b3189e.exe	53
PID 1704 wrote to memory of 1820	1704	a277e4ef1921464c0cfaec6401b3189e.exe	53
PID 1704 wrote to memory of 1876	1704	a277e4ef1921464c0cfaec6401b3189e.exe	54
PID 1704 wrote to memory of 1876	1704	a277e4ef1921464c0cfaec6401b3189e.exe	54
PID 1704 wrote to memory of 1876	1704	a277e4ef1921464c0cfaec6401b3189e.exe	54
PID 1704 wrote to memory of 2596	1704	a277e4ef1921464c0cfaec6401b3189e.exe	55
PID 1704 wrote to memory of 2596	1704	a277e4ef1921464c0cfaec6401b3189e.exe	55
PID 1704 wrote to memory of 2596	1704	a277e4ef1921464c0cfaec6401b3189e.exe	55
PID 1704 wrote to memory of 2376	1704	a277e4ef1921464c0cfaec6401b3189e.exe	56
PID 1704 wrote to memory of 2376	1704	a277e4ef1921464c0cfaec6401b3189e.exe	56
PID 1704 wrote to memory of 2376	1704	a277e4ef1921464c0cfaec6401b3189e.exe	56
PID 1704 wrote to memory of 1356	1704	a277e4ef1921464c0cfaec6401b3189e.exe	58
PID 1704 wrote to memory of 1356	1704	a277e4ef1921464c0cfaec6401b3189e.exe	58
PID 1704 wrote to memory of 1356	1704	a277e4ef1921464c0cfaec6401b3189e.exe	58
PID 1704 wrote to memory of 2096	1704	a277e4ef1921464c0cfaec6401b3189e.exe	59
PID 1704 wrote to memory of 2096	1704	a277e4ef1921464c0cfaec6401b3189e.exe	59
PID 1704 wrote to memory of 2096	1704	a277e4ef1921464c0cfaec6401b3189e.exe	59
PID 1704 wrote to memory of 1388	1704	a277e4ef1921464c0cfaec6401b3189e.exe	61
PID 1704 wrote to memory of 1388	1704	a277e4ef1921464c0cfaec6401b3189e.exe	61
PID 1704 wrote to memory of 1388	1704	a277e4ef1921464c0cfaec6401b3189e.exe	61
PID 1704 wrote to memory of 548	1704	a277e4ef1921464c0cfaec6401b3189e.exe	66
PID 1704 wrote to memory of 548	1704	a277e4ef1921464c0cfaec6401b3189e.exe	66
PID 1704 wrote to memory of 548	1704	a277e4ef1921464c0cfaec6401b3189e.exe	66
PID 1704 wrote to memory of 3060	1704	a277e4ef1921464c0cfaec6401b3189e.exe	69
PID 1704 wrote to memory of 3060	1704	a277e4ef1921464c0cfaec6401b3189e.exe	69
PID 1704 wrote to memory of 3060	1704	a277e4ef1921464c0cfaec6401b3189e.exe	69
PID 3060 wrote to memory of 2620	3060	explorer.exe	70
PID 3060 wrote to memory of 2620	3060	explorer.exe	70
PID 3060 wrote to memory of 2620	3060	explorer.exe	70
PID 3060 wrote to memory of 2868	3060	explorer.exe	71
PID 3060 wrote to memory of 2868	3060	explorer.exe	71
PID 3060 wrote to memory of 2868	3060	explorer.exe	71
PID 2620 wrote to memory of 2112	2620	WScript.exe	72
PID 2620 wrote to memory of 2112	2620	WScript.exe	72
PID 2620 wrote to memory of 2112	2620	WScript.exe	72
PID 2112 wrote to memory of 1180	2112	explorer.exe	73
PID 2112 wrote to memory of 1180	2112	explorer.exe	73
PID 2112 wrote to memory of 1180	2112	explorer.exe	73
PID 2112 wrote to memory of 1508	2112	explorer.exe	74
PID 2112 wrote to memory of 1508	2112	explorer.exe	74
PID 2112 wrote to memory of 1508	2112	explorer.exe	74
PID 1180 wrote to memory of 2248	1180	WScript.exe	75
PID 1180 wrote to memory of 2248	1180	WScript.exe	75
PID 1180 wrote to memory of 2248	1180	WScript.exe	75
PID 2248 wrote to memory of 2648	2248	explorer.exe	76
PID 2248 wrote to memory of 2648	2248	explorer.exe	76
PID 2248 wrote to memory of 2648	2248	explorer.exe	76
PID 2248 wrote to memory of 2536	2248	explorer.exe	77
PID 2248 wrote to memory of 2536	2248	explorer.exe	77
PID 2248 wrote to memory of 2536	2248	explorer.exe	77
PID 2648 wrote to memory of 2600	2648	WScript.exe	78
PID 2648 wrote to memory of 2600	2648	WScript.exe	78
PID 2648 wrote to memory of 2600	2648	WScript.exe	78
PID 2600 wrote to memory of 1084	2600	explorer.exe	79
PID 2600 wrote to memory of 1084	2600	explorer.exe	79
PID 2600 wrote to memory of 1084	2600	explorer.exe	79
PID 2600 wrote to memory of 2672	2600	explorer.exe	80
PID 2600 wrote to memory of 2672	2600	explorer.exe	80
PID 2600 wrote to memory of 2672	2600	explorer.exe	80
PID 1084 wrote to memory of 2808	1084	WScript.exe	81
PID 1084 wrote to memory of 2808	1084	WScript.exe	81
PID 1084 wrote to memory of 2808	1084	WScript.exe	81
PID 2808 wrote to memory of 2928	2808	explorer.exe	82

System policy modification 1 TTPs 27 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a277e4ef1921464c0cfaec6401b3189e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a277e4ef1921464c0cfaec6401b3189e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a277e4ef1921464c0cfaec6401b3189e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a277e4ef1921464c0cfaec6401b3189e.exe
"C:\Users\Admin\AppData\Local\Temp\a277e4ef1921464c0cfaec6401b3189e.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a277e4ef1921464c0cfaec6401b3189e.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Multiplayer\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\de-DE\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\SendTo\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Users\Admin\SendTo\explorer.exe
  "C:\Users\Admin\SendTo\explorer.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3060
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b2ebe8d-9daa-4b50-aed7-690473e0047c.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Users\Admin\SendTo\explorer.exe
      C:\Users\Admin\SendTo\explorer.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2112
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d4309185-9e9a-438d-a662-77d14dc6e85b.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1180
      - C:\Users\Admin\SendTo\explorer.exe
        
        C:\Users\Admin\SendTo\explorer.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2248
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfeca3c2-b4ed-4365-a453-67fca73c59f1.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Users\Admin\SendTo\explorer.exe
        
        C:\Users\Admin\SendTo\explorer.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c3bfc6b-93c1-4db2-93c7-6a13f1e40bef.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Users\Admin\SendTo\explorer.exe
        
        C:\Users\Admin\SendTo\explorer.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73e1225e-6ad4-48d2-883c-b67e6186880c.vbs"
        11⤵
        
        PID:2928
        
        C:\Users\Admin\SendTo\explorer.exe
        
        C:\Users\Admin\SendTo\explorer.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a1dbdc5-333c-47b9-9b3c-8828258355f4.vbs"
        13⤵
        
        PID:2560
        
        C:\Users\Admin\SendTo\explorer.exe
        
        C:\Users\Admin\SendTo\explorer.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5180542d-2357-4339-b11e-26e7d51ca722.vbs"
        15⤵
        
        PID:2804
        
        C:\Users\Admin\SendTo\explorer.exe
        
        C:\Users\Admin\SendTo\explorer.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:960
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1fe718d4-9fe1-46eb-bc85-c18649f20054.vbs"
        17⤵
        
        PID:1624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1e42e03-15ef-4bf1-aef3-23f7a9f4288d.vbs"
        17⤵
        
        PID:1780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9a76d32-d25a-467a-bfda-e150e010a4e5.vbs"
        15⤵
        
        PID:2568
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52bda94b-6639-4576-aba2-47d5f6a14b0b.vbs"
        13⤵
        
        PID:2172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21bd827f-3d90-442c-b39c-fcb68d5c7f54.vbs"
        11⤵
        
        PID:3056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6eb2295f-3f75-4421-976e-e9d0e00e0059.vbs"
        9⤵
        
        PID:2672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49f148b8-c51e-40ce-a17e-6db20f9a0d80.vbs"
        7⤵
        
        PID:2536
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c11471df-c4c6-4a2a-806e-fe9e91368ee5.vbs"
        5⤵
        
        PID:1508
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fba3cf5e-da5a-4f00-947b-631587e0ac1b.vbs"
    3⤵
    PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\OSPPSVC.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Java\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Games\Multiplayer\lsm.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Multiplayer\lsm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Games\Multiplayer\lsm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\de-DE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\SendTo\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\SendTo\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\lsass.exe

Filesize
1.9MB

MD5
a277e4ef1921464c0cfaec6401b3189e

SHA1
9799231c048b98a296f50ed54f8e476d494243f1

SHA256
d50231e7365521c9292cc1a1a08f7f5a3931097ee03607fb2f7e1a6ca6ed1643

SHA512
e539ea5e9c36227b18ca8196290d50d898a9e1dcc242a590f57ccf3d534fc137fc88174f47348b0098f392c19280e10f79af4e453ffca344ca8dcc4f9afa3aa4

Download Submit
C:\MSOCache\All Users\lsass.exe

Filesize
1.9MB

MD5
c9e527cf2b24cafe96e30b8b27b4c998

SHA1
cedf97c56793cff1c41c1805a72fd610486fc87c

SHA256
944557a4f009920b9189c97f643b714f970cd85a498b334ce9ec1e9c05c1321d

SHA512
1eb8594dd7a09bb1bf242907e5b924f9267e917aa488837985f5420144cbec235d204a25e9a5aab02006eceef56c855022eb937bf9a3e2d1d0fa8836c2467629

Download Submit
C:\Program Files\VideoLAN\VLC\smss.exe

Filesize
1.9MB

MD5
6a5d49a0bb1a7123f4c4f21d3e05df7b

SHA1
4c3c688ebc5aa96f413c0a8acffe82bf59476ca4

SHA256
3afead1f3d5ec7d4b53ee094ea0a71b99b97de5ba436b5f0306cf49bce06eb96

SHA512
fc7479b15bf0064baea6738d2abc3059b320d6411c9e6ebd4253b07b84eca2e2cae66e25ccd76feab69e07d041bfdfd80ccb7952af387d81498372091b5de94c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1fe718d4-9fe1-46eb-bc85-c18649f20054.vbs

Filesize
709B

MD5
6cc27cd7ae141d20e394940aab795ca8

SHA1
7a2e46bbbfc0a7e1d7affa2a7e61f68780fba7ed

SHA256
7aafcb4402a8b1e1a5d706e71bd555b7bc86437c3785f97ea5f05ed8b0557a10

SHA512
6a72964926dfb9419a92f2619f621529f69029a4562b0e605ae623f0fa4fe6469f85fcb16314a0ec1c94eb87df434f1c65c89e8e4da616e16ed27087aac8f73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5180542d-2357-4339-b11e-26e7d51ca722.vbs

Filesize
709B

MD5
402dacd63ac19205e4de11fe292551fb

SHA1
6b0712c71e3525ccf05d8628e82a91fb170fe769

SHA256
7d8b7f92f774983362c69dcc96718533994d380429d5ef82d402e854dce888e2

SHA512
4c39dfce428eb53c62db9c32f3e6f00f34424e89ef642a272d6463241a166cda7a4f80e5ecad4461b52e6420d35710f8075d582adbc6730017700c6150dcd1b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\73e1225e-6ad4-48d2-883c-b67e6186880c.vbs

Filesize
710B

MD5
dd521efcbb613527f06bec99f18a97ee

SHA1
439b3d17c027e7f0cbc22f4cd8e12a62aa78e79b

SHA256
dc62d78bac70cba2e3300723a8d54dc768ffd5996be445f4956b513721b1594f

SHA512
b30997aea142f4011d7c5f65234db1ea024d82940ec093fb80b0323b2802f04ed91afebcaa2faed0a11d691d6df9e3a5f1927248ccbecc5da98dbd5fde499a44

Download Submit
C:\Users\Admin\AppData\Local\Temp\7b2ebe8d-9daa-4b50-aed7-690473e0047c.vbs

Filesize
710B

MD5
751eaec0200f95d758e64eac9cf9d0b3

SHA1
56e35a18b91653a18e2fa37b41f82c16db944760

SHA256
00523ca4204f4c90abe63fa038ee7977bc7db08eee345c6ff30efe1ff48995cb

SHA512
1dec912baab025658feac8866aa6f585329f8e2ec755fb6d4919ddb2b308255923b8a220f9517a2e4e6a475f78685afeb286e4464618c716232b4e64d7f253f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\8a1dbdc5-333c-47b9-9b3c-8828258355f4.vbs

Filesize
710B

MD5
4cec2ca2acdaff0b186f9d71523aa10e

SHA1
c1221f68bc6c0a94d5e4bb821e44ac8bdc834618

SHA256
72a3d2697a8df8b662fcdeb40092d4ea33b9cf7b43347fccf6cede22d2aef918

SHA512
e6b45ef3f289fc8b40ea183dfd9624901f3dcebf3a2e74ecea7bd7dc550bfcd7fa34dfd3de810c46bb2afe6f4381e9c771326145bbe164a74b0031a62524e49d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9c3bfc6b-93c1-4db2-93c7-6a13f1e40bef.vbs

Filesize
710B

MD5
96fb68501f6c338025b88d7aa5634c35

SHA1
f01e9e12202c5d6b197938f55ed401342e3e7c04

SHA256
f9f0286be354af578e1f60b252dbe77db1a9fc01ec0e3c5de6e4daa15221b4da

SHA512
bc600f3e57e8296c0dcfa3c89ba35ce094b9134bfe3113acd13e1b86d5ee82498d396ffb337a583c9b11c327d6122f27c1d8477d0315cc1fe400c62b33ad3510

Download Submit
C:\Users\Admin\AppData\Local\Temp\d4309185-9e9a-438d-a662-77d14dc6e85b.vbs

Filesize
710B

MD5
15375fcb52cccee0ffa411ace9b8ee32

SHA1
188f4aaf92e2c184fc9175e9c6b489cd84138bae

SHA256
32bcb76677e08ae2a39e26055d35b08e3a99b67651ba619e25a3318c2f1bb15b

SHA512
429c28135d0445715a03fe74ef5695f3a7fd84d9466fd980a17a4456510af033edf6fe437b0ff58072c8f8def5e840def0b6347388b3def63efe787dbbc07ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\dfeca3c2-b4ed-4365-a453-67fca73c59f1.vbs

Filesize
710B

MD5
b3164183f33439142000b02896d30d81

SHA1
65da5f71a5361b9cf73f15bbf1562175be95dc67

SHA256
700412aeb6c9028653495fffe6b6ecf3d9fe0a42a71b80e1d9594a45d7fd0af6

SHA512
4b3db4f128c6b408adf9ea1132c620da707253d4b9b2f0f8444c9fd467e38689495b6d3031ace85bc5e2c0a16325027e8729e64da5b5a8401d34ba221a7aa8a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\fba3cf5e-da5a-4f00-947b-631587e0ac1b.vbs

Filesize
486B

MD5
e30a361ae6c68de0ee315624e88cf6ec

SHA1
65bdf1dec0fdaa8c6ee8e9e3ac6240742d048811

SHA256
31419cd1ad1164f0146537c62e6e6b3e86ccd286b24a02fcee441c18cf393f78

SHA512
a17cd0fcc75577be0771f5f1d40c6f396d1db4b5ae2254f4326ae3facf9a5af39c6425cf491d7a207920cc828f2f9a707c7e10213c91490ca318142a3c83e9de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
10cd22cadcc3b8fd0a410f4b3fc2a1c9

SHA1
7db31a79bb33a61ecdaf4d94b7168878f8009d9a

SHA256
9318aa7029a7caaed0665bb534ad9eb6fc713cb0c3ed1c28bde553b8cfcd99e8

SHA512
ef75f9611f7cb5b93649115e535c3f89545ed89c20fbb770f4c2581f783e8d7ac94b7f9d63fca992a83c9ec05aad4c9dcb783f96a65fdb686fc60d2cbcf90b95

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\explorer.exe

Filesize
1.9MB

MD5
85eab18d380c19dc67c45b1c67415f8e

SHA1
52fafdda02747e64f1a88f3924987da875d94870

SHA256
ee6d178825131f33eb605a5f85fb244c1f4713f5fd6c325e7be6e80f6d7a8114

SHA512
643656ccabf4e9f7839d05125529608bf94c14cb49918a20bf10a56b72972ba8db32aa32ddd3866d4e73a701206ec717fbcd8aeabd7852b0eafa580981672fc2

Download Submit
memory/896-243-0x0000000001100000-0x00000000012EA000-memory.dmp

Filesize
1.9MB

Download
memory/1704-9-0x00000000020A0000-0x00000000020AC000-memory.dmp

Filesize
48KB

Download
memory/1704-1-0x00000000009B0000-0x0000000000B9A000-memory.dmp

Filesize
1.9MB

Download
memory/1704-18-0x00000000023F0000-0x00000000023FC000-memory.dmp

Filesize
48KB

Download
memory/1704-13-0x00000000020F0000-0x00000000020FC000-memory.dmp

Filesize
48KB

Download
memory/1704-12-0x00000000020C0000-0x00000000020D2000-memory.dmp

Filesize
72KB

Download
memory/1704-15-0x0000000002230000-0x000000000223E000-memory.dmp

Filesize
56KB

Download
memory/1704-10-0x00000000020B0000-0x00000000020B8000-memory.dmp

Filesize
32KB

Download
memory/1704-0-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

Filesize
4KB

Download
memory/1704-17-0x0000000002250000-0x000000000225C000-memory.dmp

Filesize
48KB

Download
memory/1704-8-0x0000000000960000-0x00000000009B6000-memory.dmp

Filesize
344KB

Download
memory/1704-2-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/1704-169-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/1704-16-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/1704-3-0x0000000000240000-0x000000000025C000-memory.dmp

Filesize
112KB

Download
memory/1704-14-0x0000000002220000-0x000000000222A000-memory.dmp

Filesize
40KB

Download
memory/1704-7-0x0000000000950000-0x000000000095A000-memory.dmp

Filesize
40KB

Download
memory/1704-4-0x00000000004D0000-0x00000000004D8000-memory.dmp

Filesize
32KB

Download
memory/1704-5-0x00000000004E0000-0x00000000004F0000-memory.dmp

Filesize
64KB

Download
memory/1704-6-0x0000000000930000-0x0000000000946000-memory.dmp

Filesize
88KB

Download
memory/1876-130-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/1876-146-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2112-182-0x0000000000DF0000-0x0000000000FDA000-memory.dmp

Filesize
1.9MB

Download
memory/2112-183-0x0000000000DA0000-0x0000000000DF6000-memory.dmp

Filesize
344KB

Download
memory/2248-195-0x0000000000F60000-0x000000000114A000-memory.dmp

Filesize
1.9MB

Download
memory/2600-207-0x00000000012F0000-0x00000000014DA000-memory.dmp

Filesize
1.9MB

Download
memory/2640-230-0x0000000000060000-0x000000000024A000-memory.dmp

Filesize
1.9MB

Download
memory/2640-231-0x0000000002000000-0x0000000002012000-memory.dmp

Filesize
72KB

Download
memory/3060-171-0x0000000000A00000-0x0000000000A12000-memory.dmp

Filesize
72KB

Download
memory/3060-170-0x0000000002260000-0x00000000022B6000-memory.dmp

Filesize
344KB

Download
memory/3060-168-0x0000000000A10000-0x0000000000BFA000-memory.dmp

Filesize
1.9MB

Download