Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 20:46
Behavioral task
behavioral1
Sample
09cacacf6eef86e62b26d5d1ca217c8e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
09cacacf6eef86e62b26d5d1ca217c8e.exe
Resource
win10v2004-20230220-en
General
-
Target
09cacacf6eef86e62b26d5d1ca217c8e.exe
-
Size
2.6MB
-
MD5
09cacacf6eef86e62b26d5d1ca217c8e
-
SHA1
21520171163005980651861cea13fc6edc82d2da
-
SHA256
abee8542dc156b695a019d34a7bf3734d2e63b648e4affb3209b151ab0f8e6ac
-
SHA512
fc90917fa408769cef02c977ff4a0f30a6b14e0fe0731a7ccd573c63da9523e48d58914c5a26b4f5d3d8faee47ea3d32ccbf5e462e802dd7b3cc23e6ad6fd4c6
-
SSDEEP
49152:ubA3jlSSI+tkWr2mvKSq32s+FBf4HrypMFQtwfRKSSutCn0:ubcSbWr2mLHyC8LSut1
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 64 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1628 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1240 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 888 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 760 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 828 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 272 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1924 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1864 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2008 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1512 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 696 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2028 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2036 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 584 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1112 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 884 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 572 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1656 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 284 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 804 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1248 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2012 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1428 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1488 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1760 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 524 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2008 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 896 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1948 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1140 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1288 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1328 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1112 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1064 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1656 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1748 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 980 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1596 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 684 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1088 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1168 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 920 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1600 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 384 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 852 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 272 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1080 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2044 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 668 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1248 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 384 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1064 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1300 796 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 284 796 schtasks.exe -
Processes:
resource yara_rule \hyperchainagent\Surrogaterefnet.exe dcrat C:\hyperchainagent\Surrogaterefnet.exe dcrat \hyperchainagent\Surrogaterefnet.exe dcrat C:\hyperchainagent\Surrogaterefnet.exe dcrat behavioral1/memory/564-67-0x00000000003B0000-0x0000000000602000-memory.dmp dcrat C:\Users\Public\Libraries\lsass.exe dcrat C:\hyperchainagent\Surrogaterefnet.exe dcrat behavioral1/memory/1112-121-0x0000000000070000-0x00000000002C2000-memory.dmp dcrat C:\Users\Default User\System.exe dcrat C:\Users\Default\System.exe dcrat behavioral1/memory/760-168-0x0000000000A80000-0x0000000000CD2000-memory.dmp dcrat behavioral1/memory/760-169-0x000000001AF70000-0x000000001AFF0000-memory.dmp dcrat behavioral1/memory/760-170-0x000000001AF70000-0x000000001AFF0000-memory.dmp dcrat -
Executes dropped EXE 3 IoCs
Processes:
Surrogaterefnet.exeSurrogaterefnet.exeSystem.exepid process 564 Surrogaterefnet.exe 1112 Surrogaterefnet.exe 760 System.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1912 cmd.exe 1912 cmd.exe -
Drops file in Program Files directory 20 IoCs
Processes:
Surrogaterefnet.exeSurrogaterefnet.exedescription ioc process File created C:\Program Files (x86)\Internet Explorer\SIGNUP\cmd.exe Surrogaterefnet.exe File created C:\Program Files\VideoLAN\VLC\plugins\explorer.exe Surrogaterefnet.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe Surrogaterefnet.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe Surrogaterefnet.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\27d1bcfc3c54e0 Surrogaterefnet.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\spoolsv.exe Surrogaterefnet.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\ebf1f9fa8afd6d Surrogaterefnet.exe File created C:\Program Files\Common Files\Services\wininit.exe Surrogaterefnet.exe File created C:\Program Files (x86)\Windows Defender\de-DE\lsass.exe Surrogaterefnet.exe File opened for modification C:\Program Files (x86)\Windows Defender\de-DE\lsass.exe Surrogaterefnet.exe File created C:\Program Files\7-Zip\Lang\System.exe Surrogaterefnet.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\7a0fd90576e088 Surrogaterefnet.exe File created C:\Program Files (x86)\Windows Defender\de-DE\6203df4a6bafc7 Surrogaterefnet.exe File created C:\Program Files\7-Zip\Lang\27d1bcfc3c54e0 Surrogaterefnet.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\886983d96e3d3e Surrogaterefnet.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\explorer.exe Surrogaterefnet.exe File created C:\Program Files\VideoLAN\VLC\plugins\7a0fd90576e088 Surrogaterefnet.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\7a0fd90576e088 Surrogaterefnet.exe File created C:\Program Files\Common Files\Services\56085415360792 Surrogaterefnet.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe Surrogaterefnet.exe -
Drops file in Windows directory 5 IoCs
Processes:
Surrogaterefnet.exedescription ioc process File opened for modification C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\WMIADAP.exe Surrogaterefnet.exe File created C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\75a57c1bdf437c Surrogaterefnet.exe File created C:\Windows\debug\WIA\System.exe Surrogaterefnet.exe File created C:\Windows\debug\WIA\27d1bcfc3c54e0 Surrogaterefnet.exe File created C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\WMIADAP.exe Surrogaterefnet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 888 schtasks.exe 1760 schtasks.exe 1600 schtasks.exe 668 schtasks.exe 1240 schtasks.exe 884 schtasks.exe 2008 schtasks.exe 272 schtasks.exe 556 schtasks.exe 2012 schtasks.exe 1656 schtasks.exe 684 schtasks.exe 920 schtasks.exe 548 schtasks.exe 1656 schtasks.exe 868 schtasks.exe 284 schtasks.exe 384 schtasks.exe 1988 schtasks.exe 1564 schtasks.exe 760 schtasks.exe 696 schtasks.exe 1948 schtasks.exe 1088 schtasks.exe 520 schtasks.exe 804 schtasks.exe 1248 schtasks.exe 852 schtasks.exe 1732 schtasks.exe 1960 schtasks.exe 1864 schtasks.exe 1508 schtasks.exe 1988 schtasks.exe 1428 schtasks.exe 1168 schtasks.exe 1064 schtasks.exe 548 schtasks.exe 1140 schtasks.exe 1480 schtasks.exe 1632 schtasks.exe 1112 schtasks.exe 1064 schtasks.exe 2036 schtasks.exe 760 schtasks.exe 2044 schtasks.exe 1300 schtasks.exe 1960 schtasks.exe 1704 schtasks.exe 1864 schtasks.exe 1960 schtasks.exe 1544 schtasks.exe 1300 schtasks.exe 1488 schtasks.exe 524 schtasks.exe 852 schtasks.exe 828 schtasks.exe 272 schtasks.exe 284 schtasks.exe 1132 schtasks.exe 564 schtasks.exe 1764 schtasks.exe 1820 schtasks.exe 272 schtasks.exe 868 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
Surrogaterefnet.exeSurrogaterefnet.exeSystem.exepid process 564 Surrogaterefnet.exe 564 Surrogaterefnet.exe 564 Surrogaterefnet.exe 1112 Surrogaterefnet.exe 760 System.exe 760 System.exe 760 System.exe 760 System.exe 760 System.exe 760 System.exe 760 System.exe 760 System.exe 760 System.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
System.exepid process 760 System.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Surrogaterefnet.exeSurrogaterefnet.exeSystem.exedescription pid process Token: SeDebugPrivilege 564 Surrogaterefnet.exe Token: SeDebugPrivilege 1112 Surrogaterefnet.exe Token: SeDebugPrivilege 760 System.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
09cacacf6eef86e62b26d5d1ca217c8e.exeWScript.execmd.exeSurrogaterefnet.execmd.exeSurrogaterefnet.execmd.exedescription pid process target process PID 1728 wrote to memory of 868 1728 09cacacf6eef86e62b26d5d1ca217c8e.exe WScript.exe PID 1728 wrote to memory of 868 1728 09cacacf6eef86e62b26d5d1ca217c8e.exe WScript.exe PID 1728 wrote to memory of 868 1728 09cacacf6eef86e62b26d5d1ca217c8e.exe WScript.exe PID 1728 wrote to memory of 868 1728 09cacacf6eef86e62b26d5d1ca217c8e.exe WScript.exe PID 868 wrote to memory of 1912 868 WScript.exe cmd.exe PID 868 wrote to memory of 1912 868 WScript.exe cmd.exe PID 868 wrote to memory of 1912 868 WScript.exe cmd.exe PID 868 wrote to memory of 1912 868 WScript.exe cmd.exe PID 1912 wrote to memory of 564 1912 cmd.exe Surrogaterefnet.exe PID 1912 wrote to memory of 564 1912 cmd.exe Surrogaterefnet.exe PID 1912 wrote to memory of 564 1912 cmd.exe Surrogaterefnet.exe PID 1912 wrote to memory of 564 1912 cmd.exe Surrogaterefnet.exe PID 564 wrote to memory of 1100 564 Surrogaterefnet.exe cmd.exe PID 564 wrote to memory of 1100 564 Surrogaterefnet.exe cmd.exe PID 564 wrote to memory of 1100 564 Surrogaterefnet.exe cmd.exe PID 1100 wrote to memory of 772 1100 cmd.exe w32tm.exe PID 1100 wrote to memory of 772 1100 cmd.exe w32tm.exe PID 1100 wrote to memory of 772 1100 cmd.exe w32tm.exe PID 1100 wrote to memory of 1112 1100 cmd.exe Surrogaterefnet.exe PID 1100 wrote to memory of 1112 1100 cmd.exe Surrogaterefnet.exe PID 1100 wrote to memory of 1112 1100 cmd.exe Surrogaterefnet.exe PID 1112 wrote to memory of 1544 1112 Surrogaterefnet.exe cmd.exe PID 1112 wrote to memory of 1544 1112 Surrogaterefnet.exe cmd.exe PID 1112 wrote to memory of 1544 1112 Surrogaterefnet.exe cmd.exe PID 1544 wrote to memory of 764 1544 cmd.exe w32tm.exe PID 1544 wrote to memory of 764 1544 cmd.exe w32tm.exe PID 1544 wrote to memory of 764 1544 cmd.exe w32tm.exe PID 1544 wrote to memory of 760 1544 cmd.exe System.exe PID 1544 wrote to memory of 760 1544 cmd.exe System.exe PID 1544 wrote to memory of 760 1544 cmd.exe System.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\09cacacf6eef86e62b26d5d1ca217c8e.exe"C:\Users\Admin\AppData\Local\Temp\09cacacf6eef86e62b26d5d1ca217c8e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\hyperchainagent\hVasfh5Xz1.vbe"2⤵
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\hyperchainagent\DMBt2834kk6smlkgJa5RvPFxYK.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\hyperchainagent\Surrogaterefnet.exe"C:\hyperchainagent\Surrogaterefnet.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dmgGBD5MVd.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:772
-
-
C:\hyperchainagent\Surrogaterefnet.exe"C:\hyperchainagent\Surrogaterefnet.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cT8QmSmRPm.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:764
-
-
C:\Users\Default User\System.exe"C:\Users\Default User\System.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\WMIADAP.exe'" /f1⤵
- Process spawned unexpected child process
PID:1628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\GAC_64\napcrypt\6.1.0.0__31bf3856ad364e35\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\lsass.exe'" /f1⤵
- Process spawned unexpected child process
PID:1924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\Libraries\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\csrss.exe'" /f1⤵
- Process spawned unexpected child process
PID:1512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\cmd.exe'" /f1⤵
- Process spawned unexpected child process
PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\hyperchainagent\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\hyperchainagent\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\hyperchainagent\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\lsm.exe'" /f1⤵
- Process spawned unexpected child process
PID:1656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\hyperchainagent\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\hyperchainagent\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\hyperchainagent\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\hyperchainagent\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\hyperchainagent\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\hyperchainagent\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\plugins\explorer.exe'" /f1⤵
- Process spawned unexpected child process
PID:1112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\plugins\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\debug\WIA\System.exe'" /f1⤵
- Process spawned unexpected child process
PID:1748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\debug\WIA\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\debug\WIA\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /f1⤵
- Process spawned unexpected child process
PID:980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\Services\wininit.exe'" /f1⤵
- Process spawned unexpected child process
PID:1196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\Services\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1168
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Default\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\conhost.exe'" /f1⤵
- Process spawned unexpected child process
PID:1080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:2044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\lsass.exe'" /f1⤵
- Process spawned unexpected child process
PID:668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
PID:1248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Downloads\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\Downloads\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Downloads\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WMIADAP.exe'" /f1⤵
- Process spawned unexpected child process
PID:284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WMIADAP.exe'" /rl HIGHEST /f1⤵PID:836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WMIADAP.exe'" /rl HIGHEST /f1⤵PID:1140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /f1⤵
- Creates scheduled task(s)
PID:1820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f1⤵PID:1364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f1⤵PID:2032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\hyperchainagent\services.exe'" /f1⤵
- Creates scheduled task(s)
PID:272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\hyperchainagent\services.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\hyperchainagent\services.exe'" /rl HIGHEST /f1⤵PID:944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\hyperchainagent\dwm.exe'" /f1⤵
- Creates scheduled task(s)
PID:868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\hyperchainagent\dwm.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\hyperchainagent\dwm.exe'" /rl HIGHEST /f1⤵PID:1156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Pictures\services.exe'" /f1⤵
- Creates scheduled task(s)
PID:1732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Pictures\services.exe'" /rl HIGHEST /f1⤵PID:1916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Pictures\services.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /f1⤵PID:1760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\csrss.exe'" /f1⤵PID:1748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /f1⤵
- Creates scheduled task(s)
PID:2012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /f1⤵PID:1036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /rl HIGHEST /f1⤵PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\System.exe'" /f1⤵
- Creates scheduled task(s)
PID:1988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe'" /f1⤵PID:1496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\csrss.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:2044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\hyperchainagent\lsass.exe'" /f1⤵PID:1824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\hyperchainagent\lsass.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\hyperchainagent\lsass.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WmiPrvSE.exe'" /f1⤵PID:1780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WmiPrvSE.exe'" /rl HIGHEST /f1⤵PID:1820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /f1⤵
- Creates scheduled task(s)
PID:1300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f1⤵PID:2008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\Sample Music\WmiPrvSE.exe'" /f1⤵
- Creates scheduled task(s)
PID:1988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:1656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Music\Sample Music\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\spoolsv.exe'" /f1⤵PID:1628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Downloads\spoolsv.exe'" /rl HIGHEST /f1⤵PID:1480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\spoolsv.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /f1⤵
- Creates scheduled task(s)
PID:1632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /rl HIGHEST /f1⤵PID:1012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Recovery\cfd8e0a2-b1a3-11ed-adb5-cee1c2fbb193\lsm.exe'" /rl HIGHEST /f1⤵
- Creates scheduled task(s)
PID:668
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197B
MD5593eec2b2fd75ca03ba1f3baafbe1542
SHA1dabfa9171189a3b363087a2c4d47fc6a08ed5511
SHA256457350f00be24daae144b8e904b9922f86fab40ee141eb5b949841b6fcdfa97d
SHA51254c7cefee0cc642193a2d85124a51a913979c210988223860545b6b13c1f6d007c3ca9ac1eb91327e385f1575b19af7ecb0953dac0aeace54c318255c904c1a4
-
Filesize
203B
MD5510d74172da1be1165dc29d8aec119b4
SHA10b130ccee6fd842cca895a0c6d6efe00084166c2
SHA2567e926da8ea04f6c88b65abeac9c7257113541723f591dec883b3a1f2063d86a3
SHA512b55edf2ee0ab3de93dc66768cbf19345474bd981b90aebaca08e3bb3f9cc6c4663c33f7368f649f2752c976afef2b014fc840188c8f7204e491fbaf4fa0ed100
-
Filesize
2.3MB
MD5dbf705ce9641d7783c9e867a15d463dc
SHA1e14b23c79cdc102ef10cb35ce78e84a50e725549
SHA256ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3
SHA5124ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81
-
Filesize
2.3MB
MD5dbf705ce9641d7783c9e867a15d463dc
SHA1e14b23c79cdc102ef10cb35ce78e84a50e725549
SHA256ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3
SHA5124ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81
-
Filesize
2.3MB
MD5dbf705ce9641d7783c9e867a15d463dc
SHA1e14b23c79cdc102ef10cb35ce78e84a50e725549
SHA256ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3
SHA5124ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81
-
Filesize
40B
MD59cbc6ed294d7df3d71188be1778d1e84
SHA149ea3428916b3fbbb817df9f40bd7fd3385dfb1e
SHA25691bb54ba35c1ac167d6eedccd1b18f9178426f21aefcf14ac488e09dbb798af8
SHA5127303ae61150beb18504db411371d2d6e0383f2f3e7a7e3f5f7e7feffa5cbce4fc9b1225474f57050c99f32d3adcbff7f8cab41e4f9edd78a5c26c15e95dea06a
-
Filesize
2.3MB
MD5dbf705ce9641d7783c9e867a15d463dc
SHA1e14b23c79cdc102ef10cb35ce78e84a50e725549
SHA256ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3
SHA5124ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81
-
Filesize
2.3MB
MD5dbf705ce9641d7783c9e867a15d463dc
SHA1e14b23c79cdc102ef10cb35ce78e84a50e725549
SHA256ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3
SHA5124ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81
-
Filesize
2.3MB
MD5dbf705ce9641d7783c9e867a15d463dc
SHA1e14b23c79cdc102ef10cb35ce78e84a50e725549
SHA256ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3
SHA5124ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81
-
Filesize
218B
MD516389aa806a3fd9a2322e3fbcddacede
SHA103c06c620f9717650013b8d2c30ca4a67d4e1939
SHA256f2e9cef08cce338bbc9d5eea18059a3df236f4ca5a050bce564a94347dbc1742
SHA5129d04db24f78c9a947510e32196d31380db479425cf52752231e1b0df44da43356c7e010f3dd9c79a446b05ca61ec35fbb2de5762f221b7aa1d9555d71555ea91
-
Filesize
2.3MB
MD5dbf705ce9641d7783c9e867a15d463dc
SHA1e14b23c79cdc102ef10cb35ce78e84a50e725549
SHA256ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3
SHA5124ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81
-
Filesize
2.3MB
MD5dbf705ce9641d7783c9e867a15d463dc
SHA1e14b23c79cdc102ef10cb35ce78e84a50e725549
SHA256ca84510c38b5daf4723dd0f87379b68eb26a7192ed5f86f1ad21fead4c56c8b3
SHA5124ad6c5f92a2e9630bd95c3a08d259ba1f3605067ed5c60b3ccc3568b4d4ff5a0a25856000bf73cdad6e1ff3afcea6bf6e468cf9948755c4427f6feef7b2e8c81