Analysis
-
max time kernel
42s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 02:10
Behavioral task
behavioral1
Sample
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Resource
win10v2004-20240508-en
General
-
Target
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
-
Size
1.7MB
-
MD5
6a8dc0383ff9426d3cd10e686ea8af6e
-
SHA1
bee7864ec1d04b30f37d46da8e7ec5fe240ae3fc
-
SHA256
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa
-
SHA512
f0d96a682995d5d8e965aea6efc041ea26d57b50de7e8d8c36d03a5b74c68321574ac955a7be70d1436cdeba94dacee41e0269308e799770aa064a0d7d29ddfa
-
SSDEEP
24576:WwtlgjpoyMl1W9Rl/3XF9R95g9f53Lv+6gJUHGHhuf9QkGuW+4HcWb1JB4nS:xtyotW9RN+f53i1JUHG4xGuDkcY1JB
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 18 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\", \"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\", \"C:\\Users\\All Users\\Adobe\\Setup\\sihost.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Users\\Admin\\Desktop\\fontdrvhost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\", \"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\", \"C:\\Users\\All Users\\Adobe\\Setup\\sihost.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Users\\Admin\\Desktop\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\Music\\smss.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\", \"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\", \"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\", \"C:\\Users\\All Users\\Adobe\\Setup\\sihost.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Users\\Admin\\Desktop\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\Music\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\winlogon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\", \"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\", \"C:\\Users\\All Users\\Adobe\\Setup\\sihost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\", \"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\", \"C:\\Users\\All Users\\Adobe\\Setup\\sihost.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Users\\Admin\\Desktop\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\", \"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\", \"C:\\Users\\All Users\\Adobe\\Setup\\sihost.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Users\\Admin\\Desktop\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\Music\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\", \"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\", \"C:\\Users\\All Users\\Adobe\\Setup\\sihost.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Users\\Admin\\Desktop\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\Music\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\Users\\Admin\\Local Settings\\explorer.exe\", \"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\", \"C:\\Program Files\\Common Files\\explorer.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\", \"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\", \"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\", \"C:\\Users\\All Users\\Adobe\\Setup\\sihost.exe\", \"C:\\Users\\All Users\\System.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Process spawned unexpected child process 54 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1192 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4232 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2308 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3004 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1900 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4248 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3424 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4536 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3552 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 440 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5008 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1824 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 892 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4704 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3812 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4708 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1828 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2920 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2248 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1848 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 552 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4696 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3588 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 528 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4484 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1808 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3592 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3472 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1176 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3904 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4728 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1456 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3728 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3168 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3600 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2188 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1708 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1248 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2392 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2892 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2364 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1012 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 888 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5064 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 452 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4972 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4756 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3992 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5084 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4520 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3164 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3492 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3292 3188 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3280 3188 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/956-1-0x0000000000270000-0x0000000000422000-memory.dmp dcrat C:\Program Files\Common Files\explorer.exe dcrat C:\Program Files\Internet Explorer\it-IT\smss.exe dcrat C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCX6E2B.tmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1356 powershell.exe 4952 powershell.exe 3768 powershell.exe 2952 powershell.exe 4352 powershell.exe 4368 powershell.exe 4564 powershell.exe 1240 powershell.exe 4164 powershell.exe 4420 powershell.exe 4556 powershell.exe 4476 powershell.exe 3084 powershell.exe 2968 powershell.exe 4988 powershell.exe 4472 powershell.exe 4308 powershell.exe 3204 powershell.exe 4592 powershell.exe -
Drops file in Drivers directory 1 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Executes dropped EXE 1 IoCs
Processes:
taskhostw.exepid process 868 taskhostw.exe -
Adds Run key to start application 2 TTPs 36 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Common Files\\explorer.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Admin\\Desktop\\fontdrvhost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\All Users\\Adobe\\Setup\\sihost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\All Users\\Adobe\\Setup\\sihost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\System.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\winlogon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default User\\winlogon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Common Files\\explorer.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Windows NT\\TableTextService\\en-US\\System.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\Music\\smss.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default User\\winlogon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\System.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\Music\\smss.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\winlogon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Internet Explorer\\it-IT\\smss.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\upfc.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Provisioning\\Cosa\\Idle.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Admin\\Desktop\\fontdrvhost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\Local Settings\\explorer.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\Local Settings\\explorer.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\csrss.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\Downloaded Program Files\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Drops file in Program Files directory 26 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process File opened for modification C:\Program Files\Windows NT\TableTextService\en-US\System.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\Windows NT\TableTextService\en-US\RCX4D85.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Internet Explorer\it-IT\smss.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\ModifiableWindowsApps\Registry.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\RCX540F.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\Common Files\RCX5691.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Windows NT\TableTextService\en-US\System.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Windows NT\TableTextService\en-US\27d1bcfc3c54e0 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Common Files\7a0fd90576e088 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\csrss.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\upfc.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCX6E2B.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Common Files\explorer.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\csrss.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\9e8d7a4ca61bd9 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\Common Files\explorer.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Internet Explorer\it-IT\69ddcba757bf72 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\upfc.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\ModifiableWindowsApps\StartMenuExperienceHost.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX5896.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\ea1d8f6d871115 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\886983d96e3d3e 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\smss.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\RCX5F21.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Drops file in Windows directory 8 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process File created C:\Windows\Downloaded Program Files\ea9f0e6c9e2dcd 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Windows\Provisioning\Cosa\RCX5A9A.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Windows\Provisioning\Cosa\Idle.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Windows\Downloaded Program Files\RCX6125.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Windows\Downloaded Program Files\taskhostw.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Windows\Provisioning\Cosa\Idle.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Windows\Provisioning\Cosa\6ccacd8608530f 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Windows\Downloaded Program Files\taskhostw.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3004 schtasks.exe 1900 schtasks.exe 3552 schtasks.exe 552 schtasks.exe 3292 schtasks.exe 2308 schtasks.exe 4248 schtasks.exe 892 schtasks.exe 4696 schtasks.exe 1176 schtasks.exe 1848 schtasks.exe 3592 schtasks.exe 2892 schtasks.exe 4520 schtasks.exe 4708 schtasks.exe 5064 schtasks.exe 1248 schtasks.exe 2392 schtasks.exe 5084 schtasks.exe 3164 schtasks.exe 528 schtasks.exe 4728 schtasks.exe 1456 schtasks.exe 3600 schtasks.exe 3992 schtasks.exe 3812 schtasks.exe 1828 schtasks.exe 3280 schtasks.exe 4232 schtasks.exe 5008 schtasks.exe 2188 schtasks.exe 2364 schtasks.exe 1012 schtasks.exe 4972 schtasks.exe 4536 schtasks.exe 4704 schtasks.exe 4484 schtasks.exe 1192 schtasks.exe 2920 schtasks.exe 2248 schtasks.exe 3472 schtasks.exe 452 schtasks.exe 1824 schtasks.exe 3168 schtasks.exe 4756 schtasks.exe 3424 schtasks.exe 440 schtasks.exe 3904 schtasks.exe 888 schtasks.exe 3588 schtasks.exe 1808 schtasks.exe 3728 schtasks.exe 1708 schtasks.exe 3492 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exepowershell.exepid process 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4352 powershell.exe 4352 powershell.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetaskhostw.exedescription pid process Token: SeDebugPrivilege 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Token: SeDebugPrivilege 4352 powershell.exe Token: SeDebugPrivilege 2968 powershell.exe Token: SeDebugPrivilege 4952 powershell.exe Token: SeDebugPrivilege 4420 powershell.exe Token: SeDebugPrivilege 3204 powershell.exe Token: SeDebugPrivilege 4592 powershell.exe Token: SeDebugPrivilege 3768 powershell.exe Token: SeDebugPrivilege 4472 powershell.exe Token: SeDebugPrivilege 1240 powershell.exe Token: SeDebugPrivilege 4556 powershell.exe Token: SeDebugPrivilege 4368 powershell.exe Token: SeDebugPrivilege 4564 powershell.exe Token: SeDebugPrivilege 4164 powershell.exe Token: SeDebugPrivilege 4476 powershell.exe Token: SeDebugPrivilege 2952 powershell.exe Token: SeDebugPrivilege 3084 powershell.exe Token: SeDebugPrivilege 4308 powershell.exe Token: SeDebugPrivilege 4988 powershell.exe Token: SeDebugPrivilege 868 taskhostw.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription pid process target process PID 956 wrote to memory of 1356 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 1356 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4368 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4368 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4420 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4420 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4592 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4592 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4352 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4352 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 3204 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 3204 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 2952 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 2952 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4988 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4988 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 2968 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 2968 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 3084 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 3084 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4164 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4164 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 3768 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 3768 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 1240 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 1240 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4476 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4476 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4952 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4952 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4308 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4308 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4472 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4472 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4564 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4564 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4556 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 4556 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 956 wrote to memory of 868 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe taskhostw.exe PID 956 wrote to memory of 868 956 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe taskhostw.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe"C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe'2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\en-US\System.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Local Settings\explorer.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\it-IT\smss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\explorer.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\upfc.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Cosa\Idle.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\csrss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\taskhostw.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Setup\sihost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\System.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\fontdrvhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\smss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\winlogon.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Downloaded Program Files\taskhostw.exe"C:\Windows\Downloaded Program Files\taskhostw.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Local Settings\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Local Settings\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\it-IT\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\it-IT\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Common Files\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Provisioning\Cosa\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Provisioning\Cosa\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\Provisioning\Cosa\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Windows\Downloaded Program Files\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\Downloaded Program Files\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Adobe\Setup\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Adobe\Setup\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Desktop\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Desktop\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Music\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Music\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RCX6E2B.tmpFilesize
1.7MB
MD53dde559436e76dc5ec99d76c629f1a03
SHA1fc964c60ff695bc6ef0dc844af6458ccbccbb97a
SHA256627276c9579fd26c1e049ffdae58f60790db903fb67f0db7185c18e32265d702
SHA512a0ab1bfd305eb1bb130b7ea14db354a9c07c9cfa33f5217094c1be2a7f530a507ed8c094d864d327594697433e50ae690be316ca1e912979f92b11be8fcce489
-
C:\Program Files\Common Files\explorer.exeFilesize
1.7MB
MD56a8dc0383ff9426d3cd10e686ea8af6e
SHA1bee7864ec1d04b30f37d46da8e7ec5fe240ae3fc
SHA256258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa
SHA512f0d96a682995d5d8e965aea6efc041ea26d57b50de7e8d8c36d03a5b74c68321574ac955a7be70d1436cdeba94dacee41e0269308e799770aa064a0d7d29ddfa
-
C:\Program Files\Internet Explorer\it-IT\smss.exeFilesize
1.7MB
MD5fd636ba16c73d4a718e5d9aa19acbd26
SHA1e611e6b298635e3b6591d1aeb13411c6095a7e33
SHA2564291064e4a0b90bd51ba9ee651c843f2f5f924d495496be950de540e93ce0693
SHA5124cf053703663eeb2446e924110f74404f9250204cd64329745b4ba6adb4bc13d77943b81d1f5181e827e3375f9889c0b238f8e225be7ba305eaef7154246ec29
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
610B
MD5f337baaad1b6e581181b6283cf4d71b4
SHA155fa1ce9c6fa75dfb5b2b20362a01f1b30c71e99
SHA256179e09b29314cc5e881e52d8eb475906ea3f47574c3429609068d7dceaf84360
SHA512d280fe1dae97fe90d82ebaff896a8233a73b7199e8d9cd46cd2f4fb3e76695ba87c1ab7164fe6c516ecb82a5219b232a43ba1b5eeaa2a82fb6fcf1a6af9cd0ea
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_upmdfp3s.4rm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/956-10-0x00000000026D0000-0x00000000026D8000-memory.dmpFilesize
32KB
-
memory/956-13-0x00000000026F0000-0x00000000026FC000-memory.dmpFilesize
48KB
-
memory/956-18-0x000000001B110000-0x000000001B11C000-memory.dmpFilesize
48KB
-
memory/956-16-0x000000001B0F0000-0x000000001B0F8000-memory.dmpFilesize
32KB
-
memory/956-9-0x00000000026C0000-0x00000000026CC000-memory.dmpFilesize
48KB
-
memory/956-7-0x0000000002690000-0x00000000026A0000-memory.dmpFilesize
64KB
-
memory/956-6-0x0000000002680000-0x0000000002688000-memory.dmpFilesize
32KB
-
memory/956-5-0x000000001B740000-0x000000001B790000-memory.dmpFilesize
320KB
-
memory/956-4-0x0000000002660000-0x000000000267C000-memory.dmpFilesize
112KB
-
memory/956-22-0x00007FF9A8010000-0x00007FF9A8AD1000-memory.dmpFilesize
10.8MB
-
memory/956-21-0x00007FF9A8010000-0x00007FF9A8AD1000-memory.dmpFilesize
10.8MB
-
memory/956-0-0x00007FF9A8013000-0x00007FF9A8015000-memory.dmpFilesize
8KB
-
memory/956-17-0x000000001B100000-0x000000001B10E000-memory.dmpFilesize
56KB
-
memory/956-391-0x00007FF9A8010000-0x00007FF9A8AD1000-memory.dmpFilesize
10.8MB
-
memory/956-1-0x0000000000270000-0x0000000000422000-memory.dmpFilesize
1.7MB
-
memory/956-14-0x0000000002700000-0x000000000270C000-memory.dmpFilesize
48KB
-
memory/956-15-0x000000001B9C0000-0x000000001B9CE000-memory.dmpFilesize
56KB
-
memory/956-12-0x00000000026E0000-0x00000000026EC000-memory.dmpFilesize
48KB
-
memory/956-8-0x00000000026A0000-0x00000000026B6000-memory.dmpFilesize
88KB
-
memory/956-3-0x0000000000D90000-0x0000000000D9E000-memory.dmpFilesize
56KB
-
memory/956-2-0x00007FF9A8010000-0x00007FF9A8AD1000-memory.dmpFilesize
10.8MB
-
memory/4952-222-0x000001A12D120000-0x000001A12D142000-memory.dmpFilesize
136KB