zgrat | 747abbc9dd92fa2162a0eee074374963938357f40e1b2de464e613fe3c03e5a9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d6496f71fd24be93348c354faf7dfa6.exe
Size 1.6MB
Sample240511-jsqvesfa51
SHA256 747abbc9dd92fa2162a0eee074374963938357f40e1b2de464e613fe3c03e5a9
MD5 0d6496f71fd24be93348c354faf7dfa6
SHA1 47f195a3996d4e3bd051d54e879d1ae68d2ed9a0
SHA512 0d755fb0bea2edf4a92a013a06ce3274f05f1d8fc01a25de320a2f566ec8055922e8fa0f34196c1263292ab45455e4b612f467757a0e211ba2edc066090b6a7c
SSDEEP 49152:TGJ95iN4KodXZCQRBHt268KDDljKrTrv:iJ9Z3dXLrHt2nYDKX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat execution persistence rat

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/memory/1616-1-0x0000000000C20000-0x0000000000DCC000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0007000000023267-23.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\msedge.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\msedge.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\0d6496f71fd24be93348c354faf7dfa6.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	1124	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	1124	schtasks.exe	91

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4400	powershell.exe
4672	powershell.exe
1484	powershell.exe
4912	powershell.exe
5012	powershell.exe
2008	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	0d6496f71fd24be93348c354faf7dfa6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe

Executes dropped EXE 14 IoCs

pid	Process
1516	StartMenuExperienceHost.exe
1644	StartMenuExperienceHost.exe
4912	StartMenuExperienceHost.exe
3824	msedge.exe
2596	StartMenuExperienceHost.exe
400	StartMenuExperienceHost.exe
800	StartMenuExperienceHost.exe
4464	StartMenuExperienceHost.exe
4424	StartMenuExperienceHost.exe
3176	StartMenuExperienceHost.exe
4460	StartMenuExperienceHost.exe
2440	StartMenuExperienceHost.exe
2752	StartMenuExperienceHost.exe
4692	StartMenuExperienceHost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows Mail\\System.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0d6496f71fd24be93348c354faf7dfa6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0d6496f71fd24be93348c354faf7dfa6.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0d6496f71fd24be93348c354faf7dfa6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0d6496f71fd24be93348c354faf7dfa6.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Windows Mail\\System.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\SppExtComObj.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\msedge.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\msedge.exe\""	0d6496f71fd24be93348c354faf7dfa6.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\_iyiwy.exe	csc.exe
File created	\??\c:\Windows\System32\CSC9F3F7EB18EDD401D876017D0368E5E70.TMP	csc.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\55b276f4edf653	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\e1ef82546f0b02	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files (x86)\Windows Mail\27d1bcfc3c54e0	0d6496f71fd24be93348c354faf7dfa6.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCF8AA3DACC7974BACA0987477A49A29BE.TMP	csc.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\61a52ddc9dd915	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe	0d6496f71fd24be93348c354faf7dfa6.exe
File created	C:\Program Files (x86)\Windows Mail\System.exe	0d6496f71fd24be93348c354faf7dfa6.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1200	schtasks.exe
3392	schtasks.exe
3308	schtasks.exe
4184	schtasks.exe
3772	schtasks.exe
3760	schtasks.exe
4340	schtasks.exe
1376	schtasks.exe
3332	schtasks.exe
3096	schtasks.exe
3148	schtasks.exe
2204	schtasks.exe
3256	schtasks.exe
2284	schtasks.exe
3900	schtasks.exe
2156	schtasks.exe
3984	schtasks.exe
1928	schtasks.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	0d6496f71fd24be93348c354faf7dfa6.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	StartMenuExperienceHost.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
3808	PING.EXE
4900	PING.EXE
536	PING.EXE
848	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
1616	0d6496f71fd24be93348c354faf7dfa6.exe
2008	powershell.exe
2008	powershell.exe
5012	powershell.exe
5012	powershell.exe
1484	powershell.exe
1484	powershell.exe
4912	powershell.exe
4912	powershell.exe
4672	powershell.exe
4672	powershell.exe
4400	powershell.exe
4400	powershell.exe
2008	powershell.exe
4672	powershell.exe
5012	powershell.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	0d6496f71fd24be93348c354faf7dfa6.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	1516	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	1644	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4912	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2596	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	400	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	800	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4464	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4424	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3176	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4460	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2440	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2752	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4692	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4124	1616	0d6496f71fd24be93348c354faf7dfa6.exe	95
PID 1616 wrote to memory of 4124	1616	0d6496f71fd24be93348c354faf7dfa6.exe	95
PID 4124 wrote to memory of 1400	4124	csc.exe	100
PID 4124 wrote to memory of 1400	4124	csc.exe	100
PID 1616 wrote to memory of 3740	1616	0d6496f71fd24be93348c354faf7dfa6.exe	101
PID 1616 wrote to memory of 3740	1616	0d6496f71fd24be93348c354faf7dfa6.exe	101
PID 3740 wrote to memory of 2560	3740	csc.exe	103
PID 3740 wrote to memory of 2560	3740	csc.exe	103
PID 1616 wrote to memory of 4400	1616	0d6496f71fd24be93348c354faf7dfa6.exe	119
PID 1616 wrote to memory of 4400	1616	0d6496f71fd24be93348c354faf7dfa6.exe	119
PID 1616 wrote to memory of 2008	1616	0d6496f71fd24be93348c354faf7dfa6.exe	120
PID 1616 wrote to memory of 2008	1616	0d6496f71fd24be93348c354faf7dfa6.exe	120
PID 1616 wrote to memory of 4672	1616	0d6496f71fd24be93348c354faf7dfa6.exe	121
PID 1616 wrote to memory of 4672	1616	0d6496f71fd24be93348c354faf7dfa6.exe	121
PID 1616 wrote to memory of 5012	1616	0d6496f71fd24be93348c354faf7dfa6.exe	123
PID 1616 wrote to memory of 5012	1616	0d6496f71fd24be93348c354faf7dfa6.exe	123
PID 1616 wrote to memory of 1484	1616	0d6496f71fd24be93348c354faf7dfa6.exe	124
PID 1616 wrote to memory of 1484	1616	0d6496f71fd24be93348c354faf7dfa6.exe	124
PID 1616 wrote to memory of 4912	1616	0d6496f71fd24be93348c354faf7dfa6.exe	127
PID 1616 wrote to memory of 4912	1616	0d6496f71fd24be93348c354faf7dfa6.exe	127
PID 1616 wrote to memory of 3232	1616	0d6496f71fd24be93348c354faf7dfa6.exe	132
PID 1616 wrote to memory of 3232	1616	0d6496f71fd24be93348c354faf7dfa6.exe	132
PID 3232 wrote to memory of 4396	3232	cmd.exe	134
PID 3232 wrote to memory of 4396	3232	cmd.exe	134
PID 3232 wrote to memory of 3204	3232	cmd.exe	137
PID 3232 wrote to memory of 3204	3232	cmd.exe	137
PID 3232 wrote to memory of 1516	3232	cmd.exe	138
PID 3232 wrote to memory of 1516	3232	cmd.exe	138
PID 1516 wrote to memory of 824	1516	StartMenuExperienceHost.exe	139
PID 1516 wrote to memory of 824	1516	StartMenuExperienceHost.exe	139
PID 824 wrote to memory of 2432	824	cmd.exe	141
PID 824 wrote to memory of 2432	824	cmd.exe	141
PID 824 wrote to memory of 1704	824	cmd.exe	142
PID 824 wrote to memory of 1704	824	cmd.exe	142
PID 824 wrote to memory of 1644	824	cmd.exe	144
PID 824 wrote to memory of 1644	824	cmd.exe	144
PID 1644 wrote to memory of 1392	1644	StartMenuExperienceHost.exe	145
PID 1644 wrote to memory of 1392	1644	StartMenuExperienceHost.exe	145
PID 1392 wrote to memory of 3192	1392	cmd.exe	147
PID 1392 wrote to memory of 3192	1392	cmd.exe	147
PID 1392 wrote to memory of 4564	1392	cmd.exe	148
PID 1392 wrote to memory of 4564	1392	cmd.exe	148
PID 1392 wrote to memory of 4912	1392	cmd.exe	149
PID 1392 wrote to memory of 4912	1392	cmd.exe	149
PID 4912 wrote to memory of 2488	4912	StartMenuExperienceHost.exe	150
PID 4912 wrote to memory of 2488	4912	StartMenuExperienceHost.exe	150
PID 2488 wrote to memory of 4632	2488	cmd.exe	152
PID 2488 wrote to memory of 4632	2488	cmd.exe	152
PID 2488 wrote to memory of 536	2488	cmd.exe	153
PID 2488 wrote to memory of 536	2488	cmd.exe	153
PID 2488 wrote to memory of 2596	2488	cmd.exe	155
PID 2488 wrote to memory of 2596	2488	cmd.exe	155
PID 2596 wrote to memory of 5092	2596	StartMenuExperienceHost.exe	156
PID 2596 wrote to memory of 5092	2596	StartMenuExperienceHost.exe	156
PID 5092 wrote to memory of 2304	5092	cmd.exe	158
PID 5092 wrote to memory of 2304	5092	cmd.exe	158
PID 5092 wrote to memory of 848	5092	cmd.exe	159
PID 5092 wrote to memory of 848	5092	cmd.exe	159
PID 5092 wrote to memory of 400	5092	cmd.exe	160
PID 5092 wrote to memory of 400	5092	cmd.exe	160
PID 400 wrote to memory of 5068	400	StartMenuExperienceHost.exe	161
PID 400 wrote to memory of 5068	400	StartMenuExperienceHost.exe	161
PID 5068 wrote to memory of 2120	5068	cmd.exe	163
PID 5068 wrote to memory of 2120	5068	cmd.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe
"C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4psogkzy\4psogkzy.cmdline"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E2F.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCF8AA3DACC7974BACA0987477A49A29BE.TMP"
    3⤵
    PID:1400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4s5fgzft\4s5fgzft.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3042.tmp" "c:\Windows\System32\CSC9F3F7EB18EDD401D876017D0368E5E70.TMP"
    3⤵
    PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M7bMjtNPYm.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4396
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3204
- - C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
    "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sOnG1wexym.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:824
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2432
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1704
    - - C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kJRy2Wx8TR.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3192
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4564
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5CZTOTC2vN.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4632
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:536
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gbxaZFyaug.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2304
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:848
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5cqYlxHIW.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2120
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1532
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\O4lRoaYFUn.bat"
        14⤵
        
        PID:2484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:1644
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2440
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GzP9pAsQzT.bat"
        16⤵
        
        PID:3516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:2240
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3476
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ItcmNmazXC.bat"
        18⤵
        
        PID:2960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3348
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\usSWzSdfMb.bat"
        20⤵
        
        PID:3472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4004
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        Runs ping.exe
        
        PID:3808
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\usSWzSdfMb.bat"
        22⤵
        
        PID:3828
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4124
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:4900
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tI0tYXMWWV.bat"
        24⤵
        
        PID:336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1496
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FlZ1LPsZoY.bat"
        26⤵
        
        PID:1812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:3672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4212
        
        C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe
        
        "C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RKW7EBQnZE.bat"
        28⤵
        
        PID:1852
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:1388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0d6496f71fd24be93348c354faf7dfa60" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0d6496f71fd24be93348c354faf7dfa6" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "0d6496f71fd24be93348c354faf7dfa60" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\0d6496f71fd24be93348c354faf7dfa6.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
- Executes dropped EXE
PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4KB
SHA256 0a04420fca4d6acfa297d5e08c2bc6a1063a423003f649c2fc732b414748b038
MD5 78539497603566c40e21d970b650b13d
SHA1 aa2a44e8946ab5310225bfc762a398cd99f18fb5
SHA512 5b3633ba01bff743a7a0f3af9f1b0871d53ad7b47b0e176230162a4aae4034df9068e37e9a9268c1de2d5c2514a7b26534ae7f163c5ac8b61ba90554f19916c9
SSDEEP 48:6kmJtjuxZ8RxeOAkFJOcV4MKe28dEdERaZvqBHzuulB+hnqXSfbNtm:y9xvxVx9zIvklTkZzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.exe

Path C:\Program Files (x86)\Windows Mail\System.exe
Size 1.6MB
SHA256 747abbc9dd92fa2162a0eee074374963938357f40e1b2de464e613fe3c03e5a9
MD5 0d6496f71fd24be93348c354faf7dfa6
SHA1 47f195a3996d4e3bd051d54e879d1ae68d2ed9a0
SHA512 0d755fb0bea2edf4a92a013a06ce3274f05f1d8fc01a25de320a2f566ec8055922e8fa0f34196c1263292ab45455e4b612f467757a0e211ba2edc066090b6a7c
SSDEEP 49152:TGJ95iN4KodXZCQRBHt268KDDljKrTrv:iJ9Z3dXLrHt2nYDKX
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartMenuExperienceHost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\StartMenuExperienceHost.exe.log
Size 1KB
SHA256 e778ec777a79a1a9c9a3b605ab9681558395d2f3ef46f6c34dca1e00dcd771fd
MD5 11aa02596ceccef38b448c52a899f470
SHA1 6da94dc9579e969d39d5e65c066af3a5251e39b4
SHA512 5de4fd51ae76cce8de25c5257ee873a71668acdf407bc3351410f9f840a9b074099d4c018657d2cc8f33273e6fd03e4365165e4834ba12c052d735212bf5d0d3
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43a303fed06d5928800280cb0bf716790d9f886c87f26faf9fbdfa59b55e9c0d
MD5 0e3b2fb1305afa355fb0585c068cdbbd
SHA1 b4e9457bfdc38337f64e3b2606aa34861aa6b4ed
SHA512 6a754dbb33c549ace5f71e169511422284f688c9df1c1e5fac8a633feac24312ba39fa4c682bdc9fe1d1162e2a3bd6190013652e567909417579db4b8791554d
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40
MD5 22fbec4acba323d04079a263526cef3c
SHA1 eb8dd0042c6a3f20087a7d2391eaf48121f98740
SHA512 fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0
MD5 17fbfbe3f04595e251287a6bfcdc35de
SHA1 b576aabfd5e6d5799d487011506ed1ae70688987
SHA512 449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
MD5 e8ce785f8ccc6d202d56fefc59764945
SHA1 ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA512 66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

5CZTOTC2vN.bat

Path C:\Users\Admin\AppData\Local\Temp\5CZTOTC2vN.bat
Size 203B
SHA256 50ccdf2d4fcd9ea5336982228ba8e39c2efb8bb5ccfd720a246227fc8fa46e9b
MD5 e8ab8e300d5c1d8ce4e23b30207c61d0
SHA1 7f84d3ded6e42c3caada16e680c92671d814f5b8
SHA512 05fd6384cedec762d67c50e1e98117bbf686f62f1435181d22072b25f65ed51a4bf0b80ca22dd31f1296cf6519c9bb453f312f0540e3ad742d5e3d83d7dccd38
MD5 SHA1 SHA512

Submit Download

FlZ1LPsZoY.bat

Path C:\Users\Admin\AppData\Local\Temp\FlZ1LPsZoY.bat
Size 251B
SHA256 aa8617a8206c56f06d10c1156a59fbb32a27f4557ac43e5f048cd64ce3c826ed
MD5 0dbec08f21c37781ec1a7300ae00d9f0
SHA1 c3fe5c93746f3e556b9e1e1ec5c7e061c45c3381
SHA512 8de4662ff2db585b07d3c5c3c000fb8ee8768af6f1ed2ec69c1562f700288e62a8ed7fad858d873c58cf9b205638b2039818d3e918b6d3b2ffdd7723618592f1
MD5 SHA1 SHA512

Submit Download

GzP9pAsQzT.bat

Path C:\Users\Admin\AppData\Local\Temp\GzP9pAsQzT.bat
Size 251B
SHA256 71d0133ab82198ba1c016e3e117d323985e3c8acd286a66d5eea3256308ed200
MD5 20c3f0a3eeb42bdf79c6c278d0fb08e9
SHA1 8f852dac2c6499a886b09147178d931559a1eb9e
SHA512 dd989e82f697e039c8179ca20ba02f5035785261e318ed709bc927bfe51851c656a987000fa9023945e7c53cf4be7587b289e7099d7f5e4cf01435ccb8e4e22a
MD5 SHA1 SHA512

Submit Download

ItcmNmazXC.bat

Path C:\Users\Admin\AppData\Local\Temp\ItcmNmazXC.bat
Size 251B
SHA256 1b58bc03cb24938da034f128892d9bc9d7056f14757734703dc3a036ea263ced
MD5 9269e16170eae2a9a7d885d4e20926fe
SHA1 9d0a9b988e4750daf67f377a022ab6b4b5b2f29d
SHA512 7bb99ca555e2a45842e1218350aa0a91ff71f04da45788d66bf46f56afff246df4b9f42a1cedbeb793f1089e06fbad4ce99b7f813fdda24efbb3ac386e16e384
MD5 SHA1 SHA512

Submit Download

M7bMjtNPYm.bat

Path C:\Users\Admin\AppData\Local\Temp\M7bMjtNPYm.bat
Size 251B
SHA256 f1152bff9004d837875305dbc1b88f02e08d06bc7d4782d995e1ef4cb8f9bbbd
MD5 cbb22b8d02a05e539bfae7198f762d5b
SHA1 0cb984b62783204f6eae3a6d1984a0e814ebd238
SHA512 7b79262277acb55e032b57ce59ed02ce2bc6d90581a72e350f9c65a5937f5124c7b78e9c1757d729ae624cd73e4bd89a69993c923cba6ffd87feb57f628dfff4
MD5 SHA1 SHA512

Submit Download

O4lRoaYFUn.bat

Path C:\Users\Admin\AppData\Local\Temp\O4lRoaYFUn.bat
Size 251B
SHA256 57049e19181e0e9e0084b4705f8c4d1aadabe8a5d9f5df679dcb138e2a7f75d1
MD5 1ee8fa9776b5ddec2a1ac3abbaa0932a
SHA1 cb9052f9c7a311e26993d7a79d5c026ce46de49b
SHA512 8633811f1ad6df6e02b1627ec968ba8472dff2752bbca55fa9042b6398c91f2b7b6c51533be1ed112a81e39a029a632f06372d511c3903a024bd157453d92ebe
MD5 SHA1 SHA512

Submit Download

RES2E2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2E2F.tmp
Size 1KB
SHA256 f01490fe7528e7750c0aa9c971500e2efca3bf3d7491e65a3e522ece982dcf23
MD5 7a7906140989d6d5f2dc3de978ba89ad
SHA1 3258d3f5c9e05d4876d1793c668e037438dfd947
SHA512 435a3cddf2729f9614fe523ac1f177f624d2a8a8acf8c63afdf752e48cbc222787766c18be000602fe3294e2273698b3acb7954e4c18efb05287d886f06d29fe
MD5 SHA1 SHA512

Submit Download

RES3042.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3042.tmp
Size 1KB
SHA256 e92cab7727badc2c32d7183717e5856350bbed40a78afd1d2f54acdfacc8a5c5
MD5 a58a7eeb8824df9fa94aba7973cae87b
SHA1 a072776b1b53f97dcbef122b763e7e7f48860715
SHA512 2977ac7324434425bd1a1632df36a0eff391de51b9672ccd60a489470c3772c0010dc7b5afb692b2d5e314377ab8374727adc535ac02a84ae263f5ee71261f6b
MD5 SHA1 SHA512

Submit Download

RKW7EBQnZE.bat

Path C:\Users\Admin\AppData\Local\Temp\RKW7EBQnZE.bat
Size 251B
SHA256 d80723b8e6cb6440cc7249c2f78cfa6107a9d59c0ecabb3e3a110853e9be683f
MD5 24d296cc8b00e9909906dbe136d6da1c
SHA1 2a6a5585df2b428383777e9a99ef90d15c6b66db
SHA512 e829a29738e529d05e9e732762f21cb5a266e196355b269db2d8dd3505100bd48ffa1a420ddf548607d19276026ccd854ea73036c4c161fae5b9aec0f498f964
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_t0tlr1yi.oox.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0tlr1yi.oox.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

gbxaZFyaug.bat

Path C:\Users\Admin\AppData\Local\Temp\gbxaZFyaug.bat
Size 203B
SHA256 35794b58065f5b49aaf8f5ec4fc434c6cef31f748971f4773e75a48119449359
MD5 0957b61b108dfeaf694a77552129e936
SHA1 d5a5a4f22f43f3dae540766631bcedfa0b408825
SHA512 3d32af9155b515e35ffbf591d0f2f15f64dd6f7f073029f2d37ca54a0017be7ce5df963f9b583990972fd2163736a9d9e55fa2e796ff37eca2d4c31bcd571afa
MD5 SHA1 SHA512

Submit Download

j5cqYlxHIW.bat

Path C:\Users\Admin\AppData\Local\Temp\j5cqYlxHIW.bat
Size 251B
SHA256 c2378d059b55a257bd9939a4d47ac2a58a58efdf8cd2fb3065e6885f16a0aa87
MD5 a752cfb9ad673e0d92acedd37967b5ef
SHA1 f0a28cf737791b8fdc6a22ca54e7d5e6a42a2d30
SHA512 d583ede3d9b1e0551b1c9d773581521be1226da4419ed63ad397476e53f1e665f2bf646aaa8b3afd6615f151817083d1f591cf530670cb16cf1596d2f617b024
MD5 SHA1 SHA512

Submit Download

kJRy2Wx8TR.bat

Path C:\Users\Admin\AppData\Local\Temp\kJRy2Wx8TR.bat
Size 251B
SHA256 46be2049dce10a2428b9a4b46f409d1662f31cf00cac7006fc7ed53c66577516
MD5 4259f03fcaef8db95af6cb810b656260
SHA1 9e2e692ffa869c717145064ae1b9f0f79867b59f
SHA512 6f92560fb22fdea9070b4e3a84564c5091e9f14b3f0b1b0c0ce1952e2a9b8b576338878ecc4ac7b7ba8d46418b5823bb44afc29c23cd29bc9e5ab0345261f130
MD5 SHA1 SHA512

Submit Download

sOnG1wexym.bat

Path C:\Users\Admin\AppData\Local\Temp\sOnG1wexym.bat
Size 251B
SHA256 b0c2e408b16ae76cd4dca49920986f65e966c0d7be57ab1ad15aa8f511f702f4
MD5 8143739cc6528f958d3181d669f9ca70
SHA1 24ced432ae52f719063fd12843e78d826ba2764d
SHA512 8bb1c79e3c62a740eca310dfcf1ef314c98e1438846cce66e8f05c9add8b197efc13be96413b7b1ba70f2f6b902c22913c0121bf59d174963cff533a703fca50
MD5 SHA1 SHA512

Submit Download

tI0tYXMWWV.bat

Path C:\Users\Admin\AppData\Local\Temp\tI0tYXMWWV.bat
Size 251B
SHA256 174bd69a25b63c40ee3a392ea861d0200aabe3bc7fa0970c2d9508f45e4f4687
MD5 aee788dae186033c586ec4ba60fc12cf
SHA1 cd82f71a18c46a1c46e3dce65253aa7ac0f6f884
SHA512 142830d61c2bd651f68249d10be96ce3932ee0b81bc52076707ae7abafb1c764ab9d3ddf9638e2c7b6705844f95f027db417eb51becedb28811ff035439400dd
MD5 SHA1 SHA512

Submit Download

usSWzSdfMb.bat

Path C:\Users\Admin\AppData\Local\Temp\usSWzSdfMb.bat
Size 203B
SHA256 f0a0e98e2cb6ad7a4617b9c57258dcca241a958ef9a2c3af6b8708ae925965a5
MD5 96b2ef9a4c97568aba9e75cbb65a0396
SHA1 d879753e744c7917437a6bf0a502cff3e5937411
SHA512 56533ec10742ad55fcb7e12f55d79d50c6f34e0117f54cf8f76b35bd39f77c9c247b08f501a4e07356f21d87f1c2a6f0a0df9483dfc1a9754008b41fef1ba4f4
MD5 SHA1 SHA512

Submit Download

CSCF8AA3DACC7974BACA0987477A49A29BE.TMP

Path \??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCF8AA3DACC7974BACA0987477A49A29BE.TMP
Size 1KB
SHA256 e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f
MD5 b5189fb271be514bec128e0d0809c04e
SHA1 5dd625d27ed30fca234ec097ad66f6c13a7edcbe
SHA512 f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e
MD5 SHA1 SHA512

Submit Download

4psogkzy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4psogkzy\4psogkzy.0.cs
Size 408B
SHA256 45a9bbbb8e0efddb92262cc178f85710c1a1353a4b199bc96cd55f8d06544303
MD5 ac92854579607c9ef7dfc26202851a04
SHA1 4ebd20149fef4529fae2a2da3397dac4eb54fa43
SHA512 7e7d0004bcc3ef9642356df47c5a4c24e13896f042c70fbdcafe786be2c4d29fd5e62dd8e7fc7f7011ff0afd0bc86b6e4864ec09ac917121726fc9b99cb1501c
MD5 SHA1 SHA512

Submit Download

4psogkzy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4psogkzy\4psogkzy.cmdline
Size 265B
SHA256 17c397f7f602895000ed742ebe90eb7e93f09631fa72e9907cae2b2743151523
MD5 31ae918cb7ad3b93490042653d3648dd
SHA1 861ad469bbd38d05196c845aa880dab015f619de
SHA512 a2230c487375e0e82bcab15e7e4296b066501ed7d2b9da1372fd1fa6389b2bbe7a5989aafe381ede192ca8b1016008762e7c7f1a0b19d35457a05a745ff1fc5e
MD5 SHA1 SHA512

Submit Download

4s5fgzft.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4s5fgzft\4s5fgzft.0.cs
Size 378B
SHA256 0d2ac6defcd279de0514015d3f152919087fc2d6369f0f5decd22303f77a5aaf
MD5 f7fd8f0868adde1335f3dad238ec2dbf
SHA1 07e618c2ad6e799881745c3bd9033889de7c1c96
SHA512 4349d224b90244cd52ad9590b928155866bbf2580f9e7d8e211c5586689687d87ed39b05fa1822ebf6d937154bebf3606d06365e15ceb71402e4b831d8b7fa48
MD5 SHA1 SHA512

Submit Download

4s5fgzft.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4s5fgzft\4s5fgzft.cmdline
Size 235B
SHA256 891611e5496e8c9bef31443ff16dc406bde6fdac74e7315e16aaeeef70b752ed
MD5 ec6be3e7dd9089797561697455796554
SHA1 81d66d8575f70b8877abbb698bf67bc3146f4cc6
SHA512 6502b2e4fd0577ae39c6c1fe40afb99dd0f5c14771cb7abb1f0f47eee641f9a913773a42d3d6516a3135c91eee86346d17cc99e7660ea16262d3bd4d97ca902b
MD5 SHA1 SHA512

Submit Download

CSC9F3F7EB18EDD401D876017D0368E5E70.TMP

Path \??\c:\Windows\System32\CSC9F3F7EB18EDD401D876017D0368E5E70.TMP
Size 1KB
SHA256 1bf68148c555d0e84720c497dcf3ad708da300ee7472df12c9307a3acd4abde1
MD5 188249e3f31caa0264351fc374794895
SHA1 323a707d1a37ac8cbae6d6e502cc850f69ae2e15
SHA512 28a0d97e83b6b6d10c0114166e8f23845663a34c8f262aa5a31ffb885abe232badb6f95bba99b8688559cac81f8ff93c3609ac363d8903d35f535d7c5e1e02d5
MD5 SHA1 SHA512

Submit Download

memory/1616-8-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Download

memory/1616-3-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Download

memory/1616-12-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Download

memory/1616-9-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Download

memory/1616-14-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Download

memory/1616-7-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Download

memory/1616-0-0x00007FFD3FDC3000-0x00007FFD3FDC5000-memory.dmp

Download

memory/1616-6-0x00000000015E0000-0x00000000015EE000-memory.dmp

Download

memory/1616-4-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Download

memory/1616-11-0x0000000001630000-0x000000000163C000-memory.dmp

Download

memory/1616-110-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Download

memory/1616-1-0x0000000000C20000-0x0000000000DCC000-memory.dmp

Download

memory/1616-2-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Download

memory/2440-215-0x000000001BC90000-0x000000001BDFA000-memory.dmp

Download

memory/2752-224-0x000000001B990000-0x000000001BAFA000-memory.dmp

Download

memory/4460-206-0x000000001BA30000-0x000000001BB9A000-memory.dmp

Download

memory/4692-233-0x000000001C420000-0x000000001C58A000-memory.dmp

Download

memory/5012-88-0x0000026277140000-0x0000026277162000-memory.dmp

Download