8d8e41660f84eb4398b38608490f14c1657457096b2b12e2d4fd4f78109f5bdf

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SrvDesk.exe
Size 1.4MB
Sample261029-yk4tmscc83
SHA256 8d8e41660f84eb4398b38608490f14c1657457096b2b12e2d4fd4f78109f5bdf
MD5 56c2a0ba111a8283472aa35a3d9cb10b
SHA1 e050c0af5e456212dd61c85e9cd9fc715932a18e
SHA512 3500c5e428de4f9217a170b9f39b01764eadbb178cf83baf0fb510e86b7c3ca917374a2a891498a712fd027cb4b2317e1faa3c945b8fb0337bc4d85dfa800fb3
SSDEEP 12288:X7buSorFfYaUJbrFMXC695xufjkbwGJGmL9oPI5tmitEePGcr5D9BbFLF8HmNwWh:X7ro9YaUJN6ncjkkGL9oPOrtne0FXRh
TLSH
T1DC65E74027F81A09F2FF1F75AAB514554F7ABC6AAA75D78D095260EE08B1F90CC60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SrvDesk.exe

Modifies boot configuration data using bcdedit 4 IoCs

pid	Process
3412	bcdedit.exe
5872	bcdedit.exe
5960	bcdedit.exe
1924	bcdedit.exe

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3408	powercfg.exe
1808	powercfg.exe
4288	powercfg.exe
2496	powercfg.exe
572	powercfg.exe
1616	powercfg.exe
2104	powercfg.exe
2064	powercfg.exe
2476	powercfg.exe
3116	powercfg.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SrvDesk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SrvDesk.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5848	powershell.exe
224	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SrvDesk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SrvDesk.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SrvDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SrvDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SrvDesk.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
3892	SrvDesk.exe
5848	powershell.exe
5848	powershell.exe
5848	powershell.exe
224	powershell.exe
224	powershell.exe
224	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	SrvDesk.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeShutdownPrivilege	3408	powercfg.exe
Token: SeCreatePagefilePrivilege	3408	powercfg.exe
Token: SeShutdownPrivilege	2104	powercfg.exe
Token: SeCreatePagefilePrivilege	2104	powercfg.exe
Token: SeShutdownPrivilege	2064	powercfg.exe
Token: SeCreatePagefilePrivilege	2064	powercfg.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeIncreaseQuotaPrivilege	224	powershell.exe
Token: SeSecurityPrivilege	224	powershell.exe
Token: SeTakeOwnershipPrivilege	224	powershell.exe
Token: SeLoadDriverPrivilege	224	powershell.exe
Token: SeSystemProfilePrivilege	224	powershell.exe
Token: SeSystemtimePrivilege	224	powershell.exe
Token: SeProfSingleProcessPrivilege	224	powershell.exe
Token: SeIncBasePriorityPrivilege	224	powershell.exe
Token: SeCreatePagefilePrivilege	224	powershell.exe
Token: SeBackupPrivilege	224	powershell.exe
Token: SeRestorePrivilege	224	powershell.exe
Token: SeShutdownPrivilege	224	powershell.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeSystemEnvironmentPrivilege	224	powershell.exe
Token: SeRemoteShutdownPrivilege	224	powershell.exe
Token: SeUndockPrivilege	224	powershell.exe
Token: SeManageVolumePrivilege	224	powershell.exe
Token: 33	224	powershell.exe
Token: 34	224	powershell.exe
Token: 35	224	powershell.exe
Token: 36	224	powershell.exe
Token: SeShutdownPrivilege	2476	powercfg.exe
Token: SeCreatePagefilePrivilege	2476	powercfg.exe
Token: SeShutdownPrivilege	1808	powercfg.exe
Token: SeCreatePagefilePrivilege	1808	powercfg.exe
Token: SeShutdownPrivilege	4288	powercfg.exe
Token: SeCreatePagefilePrivilege	4288	powercfg.exe
Token: SeShutdownPrivilege	2496	powercfg.exe
Token: SeCreatePagefilePrivilege	2496	powercfg.exe
Token: SeShutdownPrivilege	572	powercfg.exe
Token: SeCreatePagefilePrivilege	572	powercfg.exe
Token: SeShutdownPrivilege	1616	powercfg.exe
Token: SeCreatePagefilePrivilege	1616	powercfg.exe
Token: SeShutdownPrivilege	3116	powercfg.exe
Token: SeCreatePagefilePrivilege	3116	powercfg.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3892	SrvDesk.exe
3892	SrvDesk.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3892	SrvDesk.exe
3892	SrvDesk.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 5848	3892	SrvDesk.exe	92
PID 3892 wrote to memory of 4236	3892	SrvDesk.exe	93
PID 3892 wrote to memory of 4756	3892	SrvDesk.exe	94
PID 4236 wrote to memory of 4384	4236	net.exe	98
PID 3892 wrote to memory of 700	3892	SrvDesk.exe	100
PID 700 wrote to memory of 3828	700	net.exe	102
PID 3892 wrote to memory of 5296	3892	SrvDesk.exe	103
PID 3892 wrote to memory of 4824	3892	SrvDesk.exe	105
PID 3892 wrote to memory of 1508	3892	SrvDesk.exe	106
PID 3892 wrote to memory of 3408	3892	SrvDesk.exe	109
PID 3892 wrote to memory of 2104	3892	SrvDesk.exe	111
PID 3892 wrote to memory of 2064	3892	SrvDesk.exe	113
PID 3892 wrote to memory of 4200	3892	SrvDesk.exe	115
PID 3892 wrote to memory of 5320	3892	SrvDesk.exe	117
PID 3892 wrote to memory of 4872	3892	SrvDesk.exe	119
PID 3892 wrote to memory of 224	3892	SrvDesk.exe	121
PID 3892 wrote to memory of 3412	3892	SrvDesk.exe	123
PID 3892 wrote to memory of 4544	3892	SrvDesk.exe	125
PID 3892 wrote to memory of 5216	3892	SrvDesk.exe	127
PID 3892 wrote to memory of 5872	3892	SrvDesk.exe	129
PID 3892 wrote to memory of 2192	3892	SrvDesk.exe	172
PID 3892 wrote to memory of 2476	3892	SrvDesk.exe	133
PID 3892 wrote to memory of 1808	3892	SrvDesk.exe	135
PID 3892 wrote to memory of 1820	3892	SrvDesk.exe	137
PID 1820 wrote to memory of 4820	1820	net.exe	139
PID 3892 wrote to memory of 2360	3892	SrvDesk.exe	140
PID 2360 wrote to memory of 6100	2360	net.exe	142
PID 3892 wrote to memory of 3684	3892	SrvDesk.exe	143
PID 3892 wrote to memory of 5512	3892	SrvDesk.exe	145
PID 3892 wrote to memory of 4288	3892	SrvDesk.exe	147
PID 3892 wrote to memory of 2496	3892	SrvDesk.exe	149
PID 3892 wrote to memory of 572	3892	SrvDesk.exe	151
PID 3892 wrote to memory of 2864	3892	SrvDesk.exe	153
PID 3892 wrote to memory of 6092	3892	SrvDesk.exe	155
PID 6092 wrote to memory of 5084	6092	dism.exe	157
PID 3892 wrote to memory of 2304	3892	SrvDesk.exe	158
PID 2304 wrote to memory of 4448	2304	dism.exe	160
PID 3892 wrote to memory of 6136	3892	SrvDesk.exe	161
PID 6136 wrote to memory of 3516	6136	dism.exe	163
PID 3892 wrote to memory of 4792	3892	SrvDesk.exe	164
PID 4792 wrote to memory of 944	4792	dism.exe	166
PID 3892 wrote to memory of 2540	3892	SrvDesk.exe	167
PID 2540 wrote to memory of 5248	2540	dism.exe	169
PID 3892 wrote to memory of 4848	3892	SrvDesk.exe	170
PID 4848 wrote to memory of 2192	4848	dism.exe	172
PID 3892 wrote to memory of 2064	3892	SrvDesk.exe	173
PID 2064 wrote to memory of 4388	2064	dism.exe	175
PID 3892 wrote to memory of 1656	3892	SrvDesk.exe	176
PID 1656 wrote to memory of 2764	1656	dism.exe	178
PID 3892 wrote to memory of 2636	3892	SrvDesk.exe	179
PID 2636 wrote to memory of 1744	2636	dism.exe	181
PID 3892 wrote to memory of 3084	3892	SrvDesk.exe	182
PID 3892 wrote to memory of 5660	3892	SrvDesk.exe	184
PID 3892 wrote to memory of 5960	3892	SrvDesk.exe	186
PID 3892 wrote to memory of 3772	3892	SrvDesk.exe	188
PID 3892 wrote to memory of 5972	3892	SrvDesk.exe	190
PID 3892 wrote to memory of 1924	3892	SrvDesk.exe	192
PID 3892 wrote to memory of 5404	3892	SrvDesk.exe	194
PID 3892 wrote to memory of 1616	3892	SrvDesk.exe	196
PID 3892 wrote to memory of 3116	3892	SrvDesk.exe	198

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SrvDesk.exe
"C:\Users\Admin\AppData\Local\Temp\SrvDesk.exe"
1⤵
- Checks whether UAC is enabled
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "(Get-AppxPackage -Name Microsoft.DesktopAppInstaller | Select-Object -First 1 -ExpandProperty InstallLocation)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5848
- C:\Windows\SYSTEM32\net.exe
  "net.exe" accounts
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts
    3⤵
    PID:4384
- C:\Windows\SYSTEM32\where.exe
  "where.exe" scoop.cmd
  2⤵
  PID:4756
- C:\Windows\SYSTEM32\net.exe
  "net.exe" accounts
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts
    3⤵
    PID:3828
- C:\Windows\SYSTEM32\secedit.exe
  "secedit.exe" /export /cfg "C:\Users\Admin\AppData\Local\Temp\SrvDesk-secpol-read.inf"
  2⤵
  PID:5296
- C:\Windows\SYSTEM32\secedit.exe
  "secedit.exe" /export /cfg "C:\Users\Admin\AppData\Local\Temp\SrvDesk-secpol-read.inf"
  2⤵
  PID:4824
- C:\Windows\SYSTEM32\where.exe
  "where.exe" winget.exe
  2⤵
  PID:1508
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg.exe" /query SCHEME_CURRENT SUB_VIDEO VIDEOIDLE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3408
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg.exe" /query SCHEME_CURRENT SUB_SLEEP STANDBYIDLE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg.exe" /query SCHEME_CURRENT SUB_SLEEP HIBERNATEIDLE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" int tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4200
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" int tcp show supplemental
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5320
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" int tcp show supplemental
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "$m=Get-MMAgent; '{0},{1},{2}' -f $m.MemoryCompression,$m.ApplicationPreLaunch,$m.PageCombining"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3412
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface teredo show state
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4544
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil.exe" behavior query disablelastaccess
  2⤵
  PID:5216
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5872
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /FO LIST /V
  2⤵
  PID:2192
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\SYSTEM32\net.exe
  "net.exe" accounts
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts
    3⤵
    PID:4820
- C:\Windows\SYSTEM32\net.exe
  "net.exe" accounts
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts
    3⤵
    PID:6100
- C:\Windows\SYSTEM32\secedit.exe
  "secedit.exe" /export /cfg "C:\Users\Admin\AppData\Local\Temp\SrvDesk-secpol-read.inf"
  2⤵
  PID:3684
- C:\Windows\SYSTEM32\secedit.exe
  "secedit.exe" /export /cfg "C:\Users\Admin\AppData\Local\Temp\SrvDesk-secpol-read.inf"
  2⤵
  PID:5512
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg.exe" /query SCHEME_CURRENT SUB_VIDEO VIDEOIDLE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg.exe" /query SCHEME_CURRENT SUB_SLEEP STANDBYIDLE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg.exe" /query SCHEME_CURRENT SUB_SLEEP HIBERNATEIDLE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" int tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2864
- C:\Windows\SYSTEM32\dism.exe
  "dism.exe" /online /Get-FeatureInfo /FeatureName:SearchEngine
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {CAD86722-A559-4488-867D-779B66CE8056}
    3⤵
    - Drops file in Windows directory
    PID:5084
- C:\Windows\SYSTEM32\dism.exe
  "dism.exe" /online /Get-FeatureInfo /FeatureName:Server-Media-Foundation
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {507DF727-54C7-463B-A5BB-73D64AE8BA82}
    3⤵
    - Drops file in Windows directory
    PID:4448
- C:\Windows\SYSTEM32\dism.exe
  "dism.exe" /online /Get-FeatureInfo /FeatureName:DirectPlay
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {8523FD04-3579-49A6-A8CA-00D6AD58F521}
    3⤵
    - Drops file in Windows directory
    PID:3516
- C:\Windows\SYSTEM32\dism.exe
  "dism.exe" /online /Get-FeatureInfo /FeatureName:Wireless-Networking
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {00424D33-B3FB-43B7-AE78-654FC64098AD}
    3⤵
    - Drops file in Windows directory
    PID:944
- C:\Windows\SYSTEM32\dism.exe
  "dism.exe" /online /Get-FeatureInfo /FeatureName:MediaFoundation
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {50585F1B-E4DD-45AD-AA87-D679655CA2CF}
    3⤵
    - Drops file in Windows directory
    PID:5248
- C:\Windows\SYSTEM32\dism.exe
  "dism.exe" /online /Get-FeatureInfo /FeatureName:SystemDataArchiver
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {B966BE87-9F85-4AED-BEB5-8DAEEFB1FF87}
    3⤵
    - Drops file in Windows directory
    PID:2192
- C:\Windows\SYSTEM32\dism.exe
  "dism.exe" /online /Get-FeatureInfo /FeatureName:WindowsAdminCenterSetup
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {96F1CF1A-2AED-460E-98CE-DA795ACF463E}
    3⤵
    - Drops file in Windows directory
    PID:4388
- C:\Windows\SYSTEM32\dism.exe
  "dism.exe" /online /Get-FeatureInfo /FeatureName:AzureArcSetup
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {1A5A9696-3321-45AC-A47E-32262395842D}
    3⤵
    - Drops file in Windows directory
    PID:2764
- C:\Windows\SYSTEM32\dism.exe
  "dism.exe" /online /Get-Features /Format:List
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {992831C1-DAD9-4771-890F-3D7E97BAE479}
    3⤵
    - Drops file in Windows directory
    PID:1744
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" int tcp show supplemental
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3084
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" int tcp show supplemental
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5660
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5960
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" interface teredo show state
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3772
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil.exe" behavior query disablelastaccess
  2⤵
  PID:5972
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1924
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Query /TN "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /FO LIST /V
  2⤵
  PID:5404
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3116

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Password Policy Discovery

T1201

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 05ab2c5ba21f0a5983c3751153c015efc6e696bde4179f1fbe21e4dce7d01b08
MD5 6ac91863e0646fa9bde32f9d968d9325
SHA1 1b94234b90d14c9a3d8c24b3c130acd1505cbe9c
SHA512 57c15b90d0d7a4340ae8e6441bb9e29c7c159c0dff1fdf97ebc33a26b05ad3d96940c52a8aa6acf96fe98d97cf1ad180772db7f703a7f08f0dbaaa5dd5f25b1c
TLSH
T13D41EB67B3CC8AABD55414365C9EAD1132F6CEDB405ACED73B84CD1CE02FA848B66294
MD5 SHA1 SHA512 TLSH

Submit Download

index.json

Path C:\Users\Admin\AppData\Local\SrvDesk\user-plans\index.json
Size 30B
SHA256 1e0e56d8532819958bfe2d2340ca6c3bc275691389d1e32f7c901e3699ae1a4f
MD5 1540d36c91ac9903f9fa8cc8f6d91d76
SHA1 e9e3bc811b0d1f9589851ac57910d09790885e5f
SHA512 e8085506114694fc5ec76e7f1bd705183627159d4d1d443db9f5434fda504de4f49c989e32ed09b187155a305cddd26b8d539343c0e389fa489a405698380008
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_3evypsxe.f4h.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3evypsxe.f4h.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sce13450.tmp

Path C:\Users\Admin\AppData\Local\Temp\sce13450.tmp
Size 12KB
SHA256 556e294b0e630dedf376f4abfbae0f9cd30ae636d79ec09d99e29a9dd088840a
MD5 6af3d1236ffcec5ddfac04cc201f112e
SHA1 bc128377ffe1354450732b3e81686030c77de970
SHA512 3f2f8c9a295799d757e2493d0e605faec419deaff1a2419e78cc0b6921b34ecadb0c47179118df4eee26d2bb74c0d6e210d5484b0c8e2eb8eadb3fee74298f38
SSDEEP 96:rprc6mOr9+gkz2TNGUfSVj1OuScDcWcocGcvcecjcHc/cLcscAcqcsc9TVc7c7c9:hc9Brzx/1Ou3TMTGg
TLSH
T1C8527B1297F90908F7F70F95AEBE99694A37FDB20E19C59C0168428E44B2F55CA32337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui-prefs.json

Path C:\Users\Admin\AppData\Local\Temp\ui-prefs.json
Size 454B
SHA256 a5642efbf58ee10049947f380463f528d089633380a8c2821cb1dfa87ead6f08
MD5 de9d87164e9dfb6526521c565cce6863
SHA1 c3ef6cec03ded00f275053317cc06e262c023901
SHA512 f4e04859c6dda08350597f6eec7adf0037ab5cee7cf45c142032c66aef4e4f15039c4f40e451c8c6f57ec917ae04bd089952e1c8f41169e17bc51853dee2ee9b
TLSH
T13EF0A33474A03CF1C1F6D574D1271F020768687E3685B411935E041CD8F74555736F53
MD5 SHA1 SHA512 TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 285KB
SHA256 6b35b44ffeed17e223d98abc02cf7b843794c3d7febba20d92d947ff8cbd7082
MD5 847e2bc0783477e70ac48996eb0b0f92
SHA1 0e5bce4dc96d0233f55ddf3b62c28ef80d255b59
SHA512 2e65be3536175c22a66619fe5f12b5b46b44bc8a83398a91e0dadb8d1069be89f7e963b4e5bf8b76dd602e2153afa66c3a24ff24db2357927bd2920a6974ca9e
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn94:9vmgspsPAK5+lMAEM3
TLSH
T1F454DE1E67EB0D31A189848372719BFD219771A3A6C8F3147A3FD22AE7C69CD4B5B140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 288KB
SHA256 ff6cd8df786b2a9c15bd037bb10eca69027a31b4249129c30710f9633edd736a
MD5 195cf35a6370725af56dfabef5e46729
SHA1 bcff84d9b5b12c0d57e8ecf637bc36b01a917ef4
SHA512 654de4bfe6eef3a714ada40db3731149f5f15894c2314c8e097d8683e07902034405f1f4d1e86319721dd81481d23104b2207c40d660e0df260c4106418f0480
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9V:9vmgspsPAK5+lMAEMk
TLSH
T19754DE1E67EB0D31A189848372719BFD219771A3A6C8F3147A3FD22AE7C69CD4B5B140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 292KB
SHA256 232e75d67b36962895b8f0898303003e2e6e9c5a7b2575bcb69eaec805e1c564
MD5 8fc600da7c9c31718bc752b33eb50031
SHA1 0fc3bf127fded557b482aef0aa0431210184cae6
SHA512 f2afaf06f8a4e74e2ecb41ca7c46f5eea561548867f6d496e1588732fc3635304206518b170b96b6ab73f1c97b61c692912089be170a06027f8b8a1cbcc04364
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9s:9vmgspsPAK5+lMAEM7
TLSH
T17654DF1E67EB0D31A189844372719BFD219771A3A6C8F3147A3FD22AE7C69CD4B5B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 298KB
SHA256 d0d6e43c880be418cc3cb9bb3e25d7f9d50e774dccd2a6ce00600691465220f8
MD5 da480daad6240ced70e79cba5c5b7f8b
SHA1 1aad9449756877933ad79e76d845dde0149c66d6
SHA512 03bc1cb33aee1035479eec5412ff04af2ca66b6692fde9a8b1676a2f4a5602f221b8479a1088ba5c836055e3bbdb0b0436ff16699d5c1190c5b6da14a2859b4b
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9d:9vmgspsPAK5+lMAEMm
TLSH
T1E054DF1E67EB0D31A189844372719BFD219771A3A6C8F3147A3FD22AE7C69CD4B5B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 300KB
SHA256 46649a96ab4b8518365da7c2ec833dd3e395cdb8e800d37cd80b24cac6f9fa33
MD5 1a158be941fca013c98c3f5153d74a5e
SHA1 7323b5d2b0d927fa4189ccb3f3dbf6c487c62899
SHA512 c2b7f59ae4c51ac013830931ee61aa9103553cee071e5fec13c9fcb6a0cb497c54aab999625ea472d935a79ea80f6a9df541d6382569ba8ece52d7cadb0f1ff3
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9b:9vmgspsPAK5+lMAEM8
TLSH
T11D64DF1E67EB0D31A189844372719BFD219771A3A6C8F3147A3FD22AE7C69CD4B5B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 304KB
SHA256 8f7da69f365869cf6a61fa8d124b5302a5191277f3514558e3af5af295e16aa9
MD5 968b8e5bf76b93975e55ce400803c005
SHA1 2fea5df7491e20798ae3124127865481f4ba6df2
SHA512 b45cfa40b728812cd7a942b8b1b5619ab02c764960b865cc6ea9899d346108735cadaabca922dcaa3e940110ba4ca03d5991a7dbe213b26260a81bbae54fa6b6
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9W:9vmgspsPAK5+lMAEMj
TLSH
T1FE64DF1E67EB0D31A189844372719BFD22977193A6C8F3147A3FD22AE7C69CD4B5B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 312KB
SHA256 cef2fc8527ca9ec1134238fe17a0ebfd1048792fda3a0a3c259be78da1241339
MD5 2d6b118375a3294dc0ec8eb23a888fc1
SHA1 c285c2375c906769e00b7ef72d7d12c684b97823
SHA512 182d52f1cc2371436ce2a53989efbd7121107cb3f1e98d3ed2c12ca2ac20ddab2563110ac0e8f5a586c2e29e187ea45d4bf4083adbed56a5af445f92617d72ce
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9/:9vmgspsPAK5+lMAEMC
TLSH
T1E764E01E67EB0D71A189844372719BFD21977193A6C8F3147A3FD22AE7C29CD4B5B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 314KB
SHA256 e742b12390910b18da2f9a17beb85122e533eb56d422760903b0d1615b1ae227
MD5 d1cfca714030d533db7141d3664b931f
SHA1 48334fad110ce5fc02ccb1c6eb59367926ff9dde
SHA512 a94c06e4de07d2929055dabf97742233fa7281a497aade5e7ac57a17fb6b19e2d2789b6f72b9029845c0cb2c460f5a763f562949a9b5c113491e40d4db7b7888
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9l:9vmgspsPAK5+lMAEMs
TLSH
T10E64E01E67EB0D71A189844372719BFD21977193A6C8F3147A3FD22AE7C29CD4B5B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 317KB
SHA256 4c3bf25ed1c3d7a0a3ee0335552494dc64cc6c8550c90e9c834bcf33897ff177
MD5 fa34922d1cdf49f33f7d5d7ff14ba8c8
SHA1 3633702c9a815ac3e5134ddb7c8c2ace8eed8367
SHA512 9e31ada6778dfeb27b1a1a06dadff8d5b3551fb0d854b235eab837c266aa6ca3f1ffe0b9b1789418bdea1d72d360b85e3939b90d935539da121b85e4d20fc60a
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9W:9vmgspsPAK5+lMAEM/
TLSH
T1F764E01E67EB0D71A189844372719BFD21977193A6C8F3147A3FD22AE7C29CD4B5B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 320KB
SHA256 889f444facb8388a2837020542d44b41aa61460390a3ef782863278c7af85056
MD5 7e8957475d532bf40e50f4267af7f4c8
SHA1 733b925c93bb35bb52e69c18fc074d35958b693b
SHA512 53bcbf0ac7d0615a5dd97a32406d9ef6bf1eee92dcab23fc0680bd23f62959a31a6a772c6a3893d0026b4393549bba2e6c61cc5272224a99e470b409584c64d0
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9J:9vmgspsPAK5+lMAEMM
TLSH
T16164F01E27EB0D71A189844372719BFD21977193B6C8F3147A3FD22AE7C69C94B5B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 325KB
SHA256 6a73f7eb8da65df8ea67c741114bf4c7341ed773d710d7be1eac1e219e17d3c6
MD5 6861c0af0002162ed3b6ce08ab5500dc
SHA1 081dbe3d0a90271f947607b3285b826f7ab54652
SHA512 e0073a52def483d7c077320a28b393ce9cf160035fa580da1adb66da2c8b34a36b1e0d1ca51f690e2d2b11bdc5a76cb0bc46f8e72477c5f154a39a8edf0d4884
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9I:9vmgspsPAK5+lMAEMt
TLSH
T16864F01E67EB0D71B189844372719BFD21977193A6C8F3147A3FD22AE7C69C94B1B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 331KB
SHA256 c8b99632f0106bca839e405d30164efd78859ca2edac2d41db4f3a8e16e507eb
MD5 d24b46f5cafa8d656207ee00681270cc
SHA1 ee2bc2e9c136ab3d6bb32f24f5deaaba74ed961f
SHA512 a56c25d60ffda60f328bdf5e38c6a37e4ac6cc7f2af9b47507c9880b973cb4c30a37d9ad2143e67046caa278db8801ebc373ceeacbee5c3d12b7aff39df939f0
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9P:9vmgspsPAK5+lMAEMo
TLSH
T17674E11E67EB0D71B189844372719BFD21977193A6C8F3147A3FD22AE7C69C94B1B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 332KB
SHA256 c43f25f001572f10bd81fb22b180ed38ee194b7ffeef3c1880230639a3687878
MD5 1c58bc4b3c6cd71cd2182663c8286a9e
SHA1 be266bece7a1ed7414cad11ff71691a0458170d9
SHA512 0595a789e8797b97a13004e7b8bad6de443d72b809a9311698e50c61a998126601d90786755c6297f906f28951876138b160efcc17e68264c003fa54caae089d
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn92:9vmgspsPAK5+lMAEMT
TLSH
T14074E11E67EB0D71B189844372719BFD21977193A6C8F3147A3FD22AE7C69C94B1B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 336KB
SHA256 f3f43a7def5517ee54362ad5e13bc3c9d84b094323268c4642367750a28f3866
MD5 c9b6294b65c9b174798ea5b65dd989bd
SHA1 521e15297000aacb5c9f3b26c4c86e4f4a7a0145
SHA512 2bb683a9b9b2cc75773943d51ade9af89a666074c7ebf9153270b88d395ed575e7348348206ba5d25a1cc3cf8907c7071780c400431070a8fdd187dd2c69b0bc
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9k:9vmgspsPAK5+lMAEMN
TLSH
T18074E11E67EB0D71B189844372719BFD21977193A6C8F3147A3FD22AE7C69C94B1B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 340KB
SHA256 12dabb4d3058233e04af65af72ff369b1f17b327c6c9b34c84b541f7a1ab704e
MD5 371e1451c35e95cd5184fd509cc530ec
SHA1 cea32c685958f1ec3255be06ffc1e4d4d6c67bc0
SHA512 d60f089ef78022e826323aa333eb123c4482f02558c899fd3641ca7a3d06bc08b6a2f5c53374c1fc12016c6a0d038c93c015c5bb3a5cec15416c18280c3de9dc
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9e:9vmgspsPAK5+lMAEMl
TLSH
T1D974E11E67EB0D71B189844372719BFD21977193A6C8F3147A3FD22AE7C69C94B1B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 344KB
SHA256 d45310df8a49008dd49b0b8237dc531ca89a1eabc1da4910499d0455cd9692d5
MD5 8093e5ef3e16228f0660dffe5e59e384
SHA1 8396a57120a6250609ecc951b32ba16058395628
SHA512 5c359f001b9d3cc1c241c8f7be4c09f5e0c5924706dbc426fedba1599ff260f370b7821116c6b808e13de15840bab27e52b1a65daf2deca8fa23dc2610d09270
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9J:9vmgspsPAK5+lMAEMw
TLSH
T14874E11D67EB0D71B189844372719BFD21977193A6C8F3147A3FD22AE7C69C98B1B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 349KB
SHA256 d27676a4577e53cae1890208b3f6bdeb7f3d2636416bb38fc703afad113a86bc
MD5 f4fc5bdc45936bda0195b22e6cbbe0b3
SHA1 fe6014a74b7fc52b7bb7d8991fbf93e57a2a9334
SHA512 18c778b0fad5fccf5dbefcaee7b7a750d7824ba91760d285ecb0320bb1343c4c3eff4206b86a8f10f082a361b4e03e15efd476e65d71b47c0ec36bcf032c2574
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9m:9vmgspsPAK5+lMAEMH
TLSH
T1C074E01E27EB0D71B149844372759BFD21977193A6C8F3147A3FD22AE7C69C98B1B280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-116-0x000001D8D1340000-0x000001D8D1CE4000-memory.dmp

Download

memory/224-114-0x000001D8E9EF0000-0x000001D8E9F0E000-memory.dmp

Download

memory/224-113-0x000001D8D1E70000-0x000001D8D1E7A000-memory.dmp

Download

memory/3892-32-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-10-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-1-0x0000012E38660000-0x0000012E387C6000-memory.dmp

Download

memory/3892-3-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-4-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-5-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-6-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-7-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-8-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-9-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-63-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-12-0x0000012E57A60000-0x0000012E57A9C000-memory.dmp

Download

memory/3892-11-0x0000012E57A00000-0x0000012E57A12000-memory.dmp

Download

memory/3892-666-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-49-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-48-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-33-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/3892-0-0x00007FFB180CF000-0x00007FFB180D0000-memory.dmp

Download

memory/3892-31-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp

Download

memory/5848-52-0x00000211771C0000-0x00000211771E2000-memory.dmp

Download

memory/5848-56-0x0000021177400000-0x00000211774B2000-memory.dmp

Download

memory/5848-55-0x00000211773E0000-0x00000211773FE000-memory.dmp

Download

memory/5848-58-0x00000211774C0000-0x00000211774DA000-memory.dmp

Download

memory/5848-57-0x0000021177AD0000-0x0000021177CD4000-memory.dmp

Download

memory/5848-87-0x000002115E6B0000-0x000002115F054000-memory.dmp

Download

memory/5848-76-0x0000021177520000-0x0000021177546000-memory.dmp

Download

memory/5848-67-0x00000211774E0000-0x00000211774E8000-memory.dmp

Download

memory/5848-61-0x00000211778F0000-0x000002117791A000-memory.dmp

Download

memory/5848-65-0x00000211773F0000-0x00000211773FA000-memory.dmp

Download

memory/5848-62-0x00000211773D0000-0x00000211773D8000-memory.dmp

Download

memory/5848-64-0x00000211773E0000-0x00000211773E6000-memory.dmp

Download