dcrat | f5fb3ae5ca25c16f178ca10c99aa7b4af70dc38fd806aef46d662c6ab40aab78

Analysis

max time kernel
45s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEGALOADER.exe
Size

1.7MB
MD5

ac4c9d6cd24a44a660c69bf7b55f17b0
SHA1

e41107db8aad88bb26d1879db7aed31e91942644
SHA256

f5fb3ae5ca25c16f178ca10c99aa7b4af70dc38fd806aef46d662c6ab40aab78
SHA512

0b1ee2a0c3a1c73d9ce53111df250c2c36d4dcc38ac9426bede09c8eb9a274aadb671e86018073c62abd7c09726ff878ccf1001240754e9bef3948e0a2130c4f
SSDEEP

24576:O2G/nvxW3Wir0g0bcg1vqd25Gl35KcbOwGqq+AZbPxtDSk5/FX5vDlIXNQdSR:ObA3dogGy/3dSnEYFJvxSN

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3180	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	4588	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	4588	schtasks.exe

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

OfficeClickToRun.execontainerPerf.exeOfficeClickToRun.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe

DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
rat

Processes:

resource yara_rule

C:\DriverSavessessionbroker\containerPerf.exe dcrat
behavioral2/memory/1580-13-0x0000000000560000-0x00000000006B6000-memory.dmp dcrat

resource	yara_rule
C:\DriverSavessessionbroker\containerPerf.exe	dcrat
behavioral2/memory/1580-13-0x0000000000560000-0x00000000006B6000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4796	powershell.exe
2000	powershell.exe
1004	powershell.exe
1380	powershell.exe
1376	powershell.exe
2332	powershell.exe
1384	powershell.exe
3300	powershell.exe
716	powershell.exe
1612	powershell.exe
4552	powershell.exe
1332	powershell.exe
5024	powershell.exe
4496	powershell.exe
3860	powershell.exe
3128	powershell.exe
2608	powershell.exe
3132	powershell.exe
1604	powershell.exe
2232	powershell.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OfficeClickToRun.exeMEGALOADER.exeWScript.execontainerPerf.exeOfficeClickToRun.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	MEGALOADER.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	containerPerf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	OfficeClickToRun.exe

Executes dropped EXE 6 IoCs

Processes:

containerPerf.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeClickToRun.exe

pid process

1580 containerPerf.exe
2436 OfficeClickToRun.exe
5148 OfficeClickToRun.exe
4088 OfficeClickToRun.exe
6036 OfficeClickToRun.exe
3588 OfficeClickToRun.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

OfficeClickToRun.execontainerPerf.exeOfficeClickToRun.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	containerPerf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

33 pastebin.com
34 pastebin.com
44 pastebin.com

flow	ioc
33	pastebin.com
34	pastebin.com
44	pastebin.com

Drops file in Program Files directory 14 IoCs

Processes:

containerPerf.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe	containerPerf.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\9e8d7a4ca61bd9	containerPerf.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe	containerPerf.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe	containerPerf.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\StartMenuExperienceHost.exe	containerPerf.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\55b276f4edf653	containerPerf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\upfc.exe	containerPerf.exe
File created	C:\Program Files (x86)\Windows Media Player\Icons\StartMenuExperienceHost.exe	containerPerf.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\886983d96e3d3e	containerPerf.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\66fc9ff0ee96c2	containerPerf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\ea1d8f6d871115	containerPerf.exe
File created	C:\Program Files\Common Files\System\fr-FR\conhost.exe	containerPerf.exe
File created	C:\Program Files\Common Files\System\fr-FR\088424020bedd6	containerPerf.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\sihost.exe	containerPerf.exe

Drops file in Windows directory 4 IoCs

Processes:

containerPerf.exe

description	ioc	process
File created	C:\Windows\Downloaded Program Files\OfficeClickToRun.exe	containerPerf.exe
File created	C:\Windows\Downloaded Program Files\e6c9b481da804f	containerPerf.exe
File created	C:\Windows\Media\Raga\RuntimeBroker.exe	containerPerf.exe
File created	C:\Windows\Media\Raga\9e8d7a4ca61bd9	containerPerf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

MEGALOADER.execontainerPerf.exeOfficeClickToRun.exeOfficeClickToRun.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	MEGALOADER.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	containerPerf.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	OfficeClickToRun.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

5268 reg.exe

pid	process
5268	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
4888	schtasks.exe
4952	schtasks.exe
1220	schtasks.exe
4440	schtasks.exe
1000	schtasks.exe
3500	schtasks.exe
2844	schtasks.exe
304	schtasks.exe
992	schtasks.exe
5072	schtasks.exe
3552	schtasks.exe
4564	schtasks.exe
1752	schtasks.exe
4088	schtasks.exe
1996	schtasks.exe
1464	schtasks.exe
4212	schtasks.exe
3912	schtasks.exe
388	schtasks.exe
4424	schtasks.exe
2272	schtasks.exe
3580	schtasks.exe
1064	schtasks.exe
3724	schtasks.exe
4572	schtasks.exe
3520	schtasks.exe
1780	schtasks.exe
4716	schtasks.exe
1832	schtasks.exe
1384	schtasks.exe
1860	schtasks.exe
3524	schtasks.exe
2952	schtasks.exe
3752	schtasks.exe
1116	schtasks.exe
1904	schtasks.exe
3920	schtasks.exe
1052	schtasks.exe
4388	schtasks.exe
3180	schtasks.exe
1604	schtasks.exe
4848	schtasks.exe
4596	schtasks.exe
5048	schtasks.exe
4540	schtasks.exe
4156	schtasks.exe
3672	schtasks.exe
5056	schtasks.exe
1348	schtasks.exe
1852	schtasks.exe
1748	schtasks.exe
1984	schtasks.exe
2540	schtasks.exe
4288	schtasks.exe
1836	schtasks.exe
1288	schtasks.exe
3532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

containerPerf.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
1580	containerPerf.exe
2608	powershell.exe
2608	powershell.exe
3300	powershell.exe
3300	powershell.exe
2332	powershell.exe
2332	powershell.exe
1376	powershell.exe
1376	powershell.exe
4496	powershell.exe
4496	powershell.exe
1004	powershell.exe
1004	powershell.exe
5024	powershell.exe
1332	powershell.exe
5024	powershell.exe
1332	powershell.exe
1384	powershell.exe
1384	powershell.exe
3860	powershell.exe
3860	powershell.exe
3128	powershell.exe
3128	powershell.exe
4552	powershell.exe
4552	powershell.exe
4796	powershell.exe
4796	powershell.exe
2232	powershell.exe
2232	powershell.exe
716	powershell.exe
716	powershell.exe
1380	powershell.exe
1380	powershell.exe
2332	powershell.exe
2332	powershell.exe
3132	powershell.exe
3132	powershell.exe
1612	powershell.exe
1612	powershell.exe
2000	powershell.exe
2000	powershell.exe
1604	powershell.exe
1604	powershell.exe
1380	powershell.exe
3300	powershell.exe
3300	powershell.exe
2608	powershell.exe
2608	powershell.exe
5024	powershell.exe
4496	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	1580	containerPerf.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	2436	OfficeClickToRun.exe
Token: SeDebugPrivilege	5148	OfficeClickToRun.exe
Token: SeDebugPrivilege	4088	OfficeClickToRun.exe
Token: SeDebugPrivilege	6036	OfficeClickToRun.exe
Token: SeDebugPrivilege	3588	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MEGALOADER.exeWScript.execmd.execontainerPerf.execmd.exeOfficeClickToRun.execmd.exe

description	pid	process	target process
PID 4636 wrote to memory of 1544	4636	MEGALOADER.exe	WScript.exe
PID 4636 wrote to memory of 1544	4636	MEGALOADER.exe	WScript.exe
PID 4636 wrote to memory of 1544	4636	MEGALOADER.exe	WScript.exe
PID 1544 wrote to memory of 3980	1544	WScript.exe	cmd.exe
PID 1544 wrote to memory of 3980	1544	WScript.exe	cmd.exe
PID 1544 wrote to memory of 3980	1544	WScript.exe	cmd.exe
PID 3980 wrote to memory of 1580	3980	cmd.exe	containerPerf.exe
PID 3980 wrote to memory of 1580	3980	cmd.exe	containerPerf.exe
PID 1580 wrote to memory of 1612	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1612	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 4552	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 4552	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 2232	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 2232	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 716	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 716	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 3132	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 3132	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 4496	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 4496	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1332	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1332	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 4796	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 4796	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 3300	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 3300	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 5024	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 5024	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 2608	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 2608	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 3128	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 3128	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1604	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1604	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1384	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1384	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 3860	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 3860	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 2332	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 2332	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1376	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1376	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1380	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1380	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1004	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1004	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 2000	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 2000	1580	containerPerf.exe	powershell.exe
PID 1580 wrote to memory of 1288	1580	containerPerf.exe	cmd.exe
PID 1580 wrote to memory of 1288	1580	containerPerf.exe	cmd.exe
PID 3980 wrote to memory of 5268	3980	cmd.exe	reg.exe
PID 3980 wrote to memory of 5268	3980	cmd.exe	reg.exe
PID 3980 wrote to memory of 5268	3980	cmd.exe	reg.exe
PID 1288 wrote to memory of 5548	1288	cmd.exe	w32tm.exe
PID 1288 wrote to memory of 5548	1288	cmd.exe	w32tm.exe
PID 1288 wrote to memory of 2436	1288	cmd.exe	OfficeClickToRun.exe
PID 1288 wrote to memory of 2436	1288	cmd.exe	OfficeClickToRun.exe
PID 2436 wrote to memory of 4352	2436	OfficeClickToRun.exe	WScript.exe
PID 2436 wrote to memory of 4352	2436	OfficeClickToRun.exe	WScript.exe
PID 2436 wrote to memory of 5272	2436	OfficeClickToRun.exe	WScript.exe
PID 2436 wrote to memory of 5272	2436	OfficeClickToRun.exe	WScript.exe
PID 2436 wrote to memory of 4012	2436	OfficeClickToRun.exe	cmd.exe
PID 2436 wrote to memory of 4012	2436	OfficeClickToRun.exe	cmd.exe
PID 4012 wrote to memory of 5072	4012	cmd.exe	w32tm.exe

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

Processes:

OfficeClickToRun.exeOfficeClickToRun.execontainerPerf.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OfficeClickToRun.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MEGALOADER.exe
"C:\Users\Admin\AppData\Local\Temp\MEGALOADER.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\DriverSavessessionbroker\xFrhwR4IIWv.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\DriverSavessessionbroker\BB4HCuNIVdx078g7AY04mw7MSmeo.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:3980

C:\DriverSavessessionbroker\containerPerf.exe
"C:\DriverSavessessionbroker\containerPerf.exe"
4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1580

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriverSavessessionbroker\containerPerf.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\OfficeClickToRun.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\StartMenuExperienceHost.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\regid.1991-06.com.microsoft\System.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\PrintHood\spoolsv.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Documents\My Videos\dwm.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriverSavessessionbroker\SppExtComObj.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriverSavessessionbroker\Idle.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\System\fr-FR\conhost.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriverSavessessionbroker\services.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Visualizations\sihost.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriverSavessessionbroker\backgroundTaskHost.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\cmd.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\upfc.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\Raga\RuntimeBroker.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nvJGM0jGlP.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:5548

C:\Windows\Downloaded Program Files\OfficeClickToRun.exe
"C:\Windows\Downloaded Program Files\OfficeClickToRun.exe"
6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2436

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c89a7503-d3d2-4d6a-9e6d-4720a6d26861.vbs"
7⤵
PID:4352

C:\Windows\Downloaded Program Files\OfficeClickToRun.exe
"C:\Windows\Downloaded Program Files\OfficeClickToRun.exe"
8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5148

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31a123a8-1c8c-415e-904e-8c4c50886590.vbs"
9⤵
PID:1588

C:\Windows\Downloaded Program Files\OfficeClickToRun.exe
"C:\Windows\Downloaded Program Files\OfficeClickToRun.exe"
10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6036

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47110523-2c01-418b-9813-832786b1bcbf.vbs"
9⤵
PID:1928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat"
9⤵
PID:364

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
10⤵
PID:2248

C:\Windows\Downloaded Program Files\OfficeClickToRun.exe
"C:\Windows\Downloaded Program Files\OfficeClickToRun.exe"
10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1bc9a74b-9632-4043-9266-1757ac117b76.vbs"
7⤵
PID:5272

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KmPq9HzxB6.bat"
7⤵
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:5072

C:\Windows\Downloaded Program Files\OfficeClickToRun.exe
"C:\Windows\Downloaded Program Files\OfficeClickToRun.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
4⤵
- Modifies registry key
PID:5268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Windows\Downloaded Program Files\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows\Downloaded Program Files\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\PrintHood\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\PrintHood\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\My Videos\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Videos\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Documents\My Videos\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\DriverSavessessionbroker\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\DriverSavessessionbroker\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\DriverSavessessionbroker\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\DriverSavessessionbroker\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\DriverSavessessionbroker\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\DriverSavessessionbroker\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\System\fr-FR\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\fr-FR\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\System\fr-FR\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\DriverSavessessionbroker\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\DriverSavessessionbroker\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\DriverSavessessionbroker\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\DriverSavessessionbroker\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\DriverSavessessionbroker\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\DriverSavessessionbroker\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Gadgets\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\Media\Raga\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Media\Raga\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\Raga\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5300

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DriverSavessessionbroker\BB4HCuNIVdx078g7AY04mw7MSmeo.bat
Filesize
159B

MD5
d55b68123f0af3b57b68ce8498b9a56c

SHA1
c78f936b3b86ba733a704494c95356f931b283ac

SHA256
2a265dc6e087fca3bb14db7a48fbc93e8b5d3b1a77ab2c39b316d6843b71af3c

SHA512
a2a2cda2032c010deef8e3addcdca6b6c3f2b1d81941724c45bd8d8d2f81d777e23dc7c4f59481f590cfc633167ed3161baf65f135e1154e1b767920cf34afde

Download Submit
C:\DriverSavessessionbroker\containerPerf.exe
Filesize
1.3MB

MD5
48c2137034bee9bdfc2c9df1e71e9e04

SHA1
573e8453bc08e2b4e8e65b8560d81b150a9acdd8

SHA256
54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88

SHA512
5c854bfa2b963039db83cf764ea0ddb513c612896c325acdd944bbb115858153cac15addbf18da208cf8753b60f774e7a61e0540fd82445f29f9d47a31c2b247

Download Submit
C:\DriverSavessessionbroker\xFrhwR4IIWv.vbe
Filesize
229B

MD5
dc6d3bc19c948df2fda4cf8dbfcf3733

SHA1
a7def52ce2b412ded4ec6d92f33017b39e32398c

SHA256
4f493dc39aaeb060106380100db44268cb35b7638bf345e4e31f0b62aca8d01c

SHA512
a0ceed57ffcee59907042323f37eda2e8d2382fdd6440e70f5ffa7fad969c0be79946b871004423e78e336299920927470858c9712eaf8e7fca31ebd01201cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OfficeClickToRun.exe.log
Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1bc9a74b-9632-4043-9266-1757ac117b76.vbs
Filesize
508B

MD5
d0464a070b5b435864b0adde76537c54

SHA1
bc2d0853fb6b58b545630334a2febdb4fdd831e4

SHA256
7dc2800a7ac53be3c5cdfee989e747381984ea1db1a8875c527422d0c4517c48

SHA512
42853fb0af87292b38c70679717c8c07b9a1c9934f1d854dabe0f2344f9db8aa8f252306a4e380e9260d6a61118929f5d7253155a9d9c2aef10d17fc01a98b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\31a123a8-1c8c-415e-904e-8c4c50886590.vbs
Filesize
732B

MD5
f83ee9690914eacd8a834c91b5bb1270

SHA1
976778af714bf593b49f859cb59037481d2aff6b

SHA256
719d1d91c4d331c9eeccce214194f80e1588a6a0f1d1a3500f972bd62acf591b

SHA512
6b1f92b50b1e263e27b1d94cb008633da97250c5a08b31fca8d847390b79292291d7f16166377f58064c50d1067a4926226775e4241fa80e2806994da82b1787

Download Submit
C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat
Filesize
221B

MD5
2416fcc0e8d3c779e6127988f5b0236a

SHA1
28b82000c6cd608795101d019e6da9c99b6d2333

SHA256
39d83dca6d4979a42f674dc5114232fe1fbae13abbda97e5399670309883c176

SHA512
82883b0cf39fe8c46b4074f43b666d6d0198cb69a0b4d0142e303254f437e491eb53d1004cd746ddb2c8618011b0a00e2491ed4738260582e8942f06bbbc64a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\KmPq9HzxB6.bat
Filesize
221B

MD5
f708777cec639d9e6000ca7cee056df2

SHA1
ee97a7d4489a2236a3943a909a001c198131efeb

SHA256
54a7d1cc2d22c52109dbc94afec93f5ba244743e2e7a418ddd0b7d0a4fad2921

SHA512
5d014f92899a4b84fbf2b2889e066efb5b9f2b1ed0d8edb91da863d445c55b52c5eda4312e11c0c2dc22e0c1e47c4132f7bf3cf8885610a5e6f13ab7ce818041

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n5qqn4au.hbp.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c89a7503-d3d2-4d6a-9e6d-4720a6d26861.vbs
Filesize
732B

MD5
279e0d2271b4ad2a6f1cad4f340ae997

SHA1
182d71ed34f7e18693e8582a6c1b53a437f2870d

SHA256
a103b5fcd866a0f9d4c32300ee5998c7efd5f01177ca931c07bcef1584d34eac

SHA512
fa1a9aafa85f4db606c80cc885e929fe9cc88fcab4a1ae67d9f85f7113577d98f42887452ed7e901f84b93bdae3c39cd1cb71385bc380e0209a09af42b27b18d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nvJGM0jGlP.bat
Filesize
221B

MD5
e7dbed2713c406d60b2be689a919d8d5

SHA1
2a9965ca9b5e5908d8e252137dbd15ec3aacb3f4

SHA256
41ab15611c28fac8e5f9f268ff60b66fd0bd6d14b7ad25ddea581b25f384f5e7

SHA512
c636534272f1115ec76a3e515f39b73744d7e16ae7356a5b3525a098f6f5901e8ff62cef9f1f384c9d16e0595c631f47f6c11be2a0a441086068b802e24b1a39

Download Submit
memory/1580-22-0x000000001B490000-0x000000001B49A000-memory.dmp

Filesize
40KB

Download
memory/1580-23-0x000000001B4A0000-0x000000001B4AC000-memory.dmp

Filesize
48KB

Download
memory/1580-21-0x000000001B320000-0x000000001B32E000-memory.dmp

Filesize
56KB

Download
memory/1580-20-0x000000001B310000-0x000000001B31E000-memory.dmp

Filesize
56KB

Download
memory/1580-19-0x000000001B300000-0x000000001B30A000-memory.dmp

Filesize
40KB

Download
memory/1580-18-0x000000001B2F0000-0x000000001B2FC000-memory.dmp

Filesize
48KB

Download
memory/1580-17-0x000000001B2E0000-0x000000001B2EA000-memory.dmp

Filesize
40KB

Download
memory/1580-16-0x000000001B2D0000-0x000000001B2D8000-memory.dmp

Filesize
32KB

Download
memory/1580-15-0x000000001B440000-0x000000001B490000-memory.dmp

Filesize
320KB

Download
memory/1580-14-0x0000000002790000-0x00000000027AC000-memory.dmp

Filesize
112KB

Download
memory/1580-13-0x0000000000560000-0x00000000006B6000-memory.dmp

Filesize
1.3MB

Download
memory/1580-12-0x00007FFDA9753000-0x00007FFDA9755000-memory.dmp

Filesize
8KB

Download
memory/3300-72-0x000002C49B4A0000-0x000002C49B4C2000-memory.dmp

Filesize
136KB

Download