dcrat | 2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
Size

1.7MB
MD5

46702766a2b352b3db95618c69a14526
SHA1

0c2c1e90dc69c16e2b09b705f6914b2372431a59
SHA256

2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9
SHA512

e1f84e854034293444f0f3ce562816e3f011ec58008f3601e00a7cf7125fc29c2f965fad7a59498d4d96b941006f20a4dcbb3373b325cd9fb6018cfa2aefc06e
SSDEEP

49152:z+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKv:eTHUxUoh1IF9gl2

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2732	schtasks.exe	30

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1920-1-0x0000000001170000-0x0000000001330000-memory.dmp	dcrat
behavioral1/files/0x0006000000019030-27.dat	dcrat
behavioral1/files/0x000800000001a4aa-88.dat	dcrat
behavioral1/files/0x000a000000018d68-159.dat	dcrat
behavioral1/files/0x00080000000194a7-208.dat	dcrat
behavioral1/memory/2196-297-0x0000000000860000-0x0000000000A20000-memory.dmp	dcrat
behavioral1/memory/2800-308-0x0000000000200000-0x00000000003C0000-memory.dmp	dcrat
behavioral1/memory/2328-320-0x0000000001130000-0x00000000012F0000-memory.dmp	dcrat
behavioral1/memory/948-343-0x00000000013C0000-0x0000000001580000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1916	powershell.exe
2136	powershell.exe
2684	powershell.exe
2892	powershell.exe
1812	powershell.exe
2908	powershell.exe
984	powershell.exe
3032	powershell.exe
840	powershell.exe
2488	powershell.exe
2344	powershell.exe
880	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe

Executes dropped EXE 9 IoCs

pid	Process
2196	dllhost.exe
2800	dllhost.exe
2328	dllhost.exe
3068	dllhost.exe
948	dllhost.exe
1628	dllhost.exe
1284	dllhost.exe
1676	dllhost.exe
1908	dllhost.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\taskhost.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\5940a34987c991	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\RCXC8DA.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\ja-JP\RCXCADE.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\ja-JP\OSPPSVC.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\services.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\RCXD841.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\Windows Mail\ja-JP\OSPPSVC.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\services.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\ja-JP\RCXCADF.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCXCCE3.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\taskhost.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\RCXC8D9.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCXCD51.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\RCXD3CB.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\RCXD3CC.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\b75386f1303e64	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\Windows Mail\ja-JP\1610b97d3ab4a7	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\c5b4cb5e9653cc	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\b75386f1303e64	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\RCXD7D3.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\ShellNew\7a0fd90576e088	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Windows\CSC\v2.0.6\dllhost.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Windows\AppCompat\Programs\886983d96e3d3e	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Windows\ShellNew\explorer.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Windows\ShellNew\explorer.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File created	C:\Windows\AppCompat\Programs\csrss.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Windows\ShellNew\RCXC059.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Windows\ShellNew\RCXC0C7.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Windows\AppCompat\Programs\RCXD159.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Windows\AppCompat\Programs\RCXD1C8.tmp	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
File opened for modification	C:\Windows\AppCompat\Programs\csrss.exe	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2840	schtasks.exe
1716	schtasks.exe
1332	schtasks.exe
2640	schtasks.exe
2664	schtasks.exe
1136	schtasks.exe
2356	schtasks.exe
1884	schtasks.exe
2860	schtasks.exe
2924	schtasks.exe
2780	schtasks.exe
2700	schtasks.exe
332	schtasks.exe
2636	schtasks.exe
2144	schtasks.exe
1916	schtasks.exe
2124	schtasks.exe
836	schtasks.exe
3060	schtasks.exe
2520	schtasks.exe
2448	schtasks.exe
3052	schtasks.exe
2340	schtasks.exe
1936	schtasks.exe
1500	schtasks.exe
776	schtasks.exe
2708	schtasks.exe
2772	schtasks.exe
2996	schtasks.exe
1952	schtasks.exe
2240	schtasks.exe
2584	schtasks.exe
1088	schtasks.exe
1108	schtasks.exe
1744	schtasks.exe
344	schtasks.exe
2720	schtasks.exe
2928	schtasks.exe
2952	schtasks.exe
1748	schtasks.exe
1528	schtasks.exe
2400	schtasks.exe
2608	schtasks.exe
1248	schtasks.exe
568	schtasks.exe
1604	schtasks.exe
1520	schtasks.exe
644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
2684	powershell.exe
2136	powershell.exe
2908	powershell.exe
840	powershell.exe
984	powershell.exe
880	powershell.exe
1812	powershell.exe
2488	powershell.exe
3032	powershell.exe
2344	powershell.exe
2892	powershell.exe
1916	powershell.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe
2196	dllhost.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	2196	dllhost.exe
Token: SeDebugPrivilege	2800	dllhost.exe
Token: SeDebugPrivilege	2328	dllhost.exe
Token: SeDebugPrivilege	3068	dllhost.exe
Token: SeDebugPrivilege	948	dllhost.exe
Token: SeDebugPrivilege	1628	dllhost.exe
Token: SeDebugPrivilege	1284	dllhost.exe
Token: SeDebugPrivilege	1676	dllhost.exe
Token: SeDebugPrivilege	1908	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2684	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	80
PID 1920 wrote to memory of 2684	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	80
PID 1920 wrote to memory of 2684	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	80
PID 1920 wrote to memory of 3032	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	81
PID 1920 wrote to memory of 3032	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	81
PID 1920 wrote to memory of 3032	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	81
PID 1920 wrote to memory of 2136	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	82
PID 1920 wrote to memory of 2136	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	82
PID 1920 wrote to memory of 2136	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	82
PID 1920 wrote to memory of 840	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	83
PID 1920 wrote to memory of 840	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	83
PID 1920 wrote to memory of 840	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	83
PID 1920 wrote to memory of 2892	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	84
PID 1920 wrote to memory of 2892	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	84
PID 1920 wrote to memory of 2892	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	84
PID 1920 wrote to memory of 2488	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	85
PID 1920 wrote to memory of 2488	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	85
PID 1920 wrote to memory of 2488	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	85
PID 1920 wrote to memory of 1812	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	86
PID 1920 wrote to memory of 1812	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	86
PID 1920 wrote to memory of 1812	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	86
PID 1920 wrote to memory of 2908	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	87
PID 1920 wrote to memory of 2908	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	87
PID 1920 wrote to memory of 2908	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	87
PID 1920 wrote to memory of 1916	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	88
PID 1920 wrote to memory of 1916	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	88
PID 1920 wrote to memory of 1916	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	88
PID 1920 wrote to memory of 2344	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	89
PID 1920 wrote to memory of 2344	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	89
PID 1920 wrote to memory of 2344	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	89
PID 1920 wrote to memory of 880	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	90
PID 1920 wrote to memory of 880	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	90
PID 1920 wrote to memory of 880	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	90
PID 1920 wrote to memory of 984	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	91
PID 1920 wrote to memory of 984	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	91
PID 1920 wrote to memory of 984	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	91
PID 1920 wrote to memory of 3028	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	104
PID 1920 wrote to memory of 3028	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	104
PID 1920 wrote to memory of 3028	1920	2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe	104
PID 3028 wrote to memory of 1440	3028	cmd.exe	106
PID 3028 wrote to memory of 1440	3028	cmd.exe	106
PID 3028 wrote to memory of 1440	3028	cmd.exe	106
PID 3028 wrote to memory of 2196	3028	cmd.exe	107
PID 3028 wrote to memory of 2196	3028	cmd.exe	107
PID 3028 wrote to memory of 2196	3028	cmd.exe	107
PID 2196 wrote to memory of 2124	2196	dllhost.exe	108
PID 2196 wrote to memory of 2124	2196	dllhost.exe	108
PID 2196 wrote to memory of 2124	2196	dllhost.exe	108
PID 2196 wrote to memory of 1872	2196	dllhost.exe	109
PID 2196 wrote to memory of 1872	2196	dllhost.exe	109
PID 2196 wrote to memory of 1872	2196	dllhost.exe	109
PID 2124 wrote to memory of 2800	2124	WScript.exe	110
PID 2124 wrote to memory of 2800	2124	WScript.exe	110
PID 2124 wrote to memory of 2800	2124	WScript.exe	110
PID 2800 wrote to memory of 2128	2800	dllhost.exe	111
PID 2800 wrote to memory of 2128	2800	dllhost.exe	111
PID 2800 wrote to memory of 2128	2800	dllhost.exe	111
PID 2800 wrote to memory of 2580	2800	dllhost.exe	112
PID 2800 wrote to memory of 2580	2800	dllhost.exe	112
PID 2800 wrote to memory of 2580	2800	dllhost.exe	112
PID 2128 wrote to memory of 2328	2128	WScript.exe	113
PID 2128 wrote to memory of 2328	2128	WScript.exe	113
PID 2128 wrote to memory of 2328	2128	WScript.exe	113
PID 2328 wrote to memory of 2288	2328	dllhost.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe
"C:\Users\Admin\AppData\Local\Temp\2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Me7UXZhmqZ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
    "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a5e4f13-1c76-45d2-b310-a06ca2855c31.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2124
    - - C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2800
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1837822-e7b8-447a-9baf-cc03b1ee4e26.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3149158c-3018-4350-bc9e-bb93b8f33f29.vbs"
        8⤵
        
        PID:2288
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05a0c0dd-2f67-43ef-9e1c-173ece6694ac.vbs"
        10⤵
        
        PID:676
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:948
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a8a470c-b7b9-4a10-b456-ef6a235c2ca3.vbs"
        12⤵
        
        PID:2840
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a2a236f-84b2-4fb3-ac25-447f1b2ab0f9.vbs"
        14⤵
        
        PID:2460
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\761999d6-6531-4a4e-9b14-7fddd00de4aa.vbs"
        16⤵
        
        PID:2712
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\674f515a-eb6b-483a-b3cc-9310b1bab662.vbs"
        18⤵
        
        PID:1836
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2589a76d-a79f-4c44-b099-46d5efe7425a.vbs"
        20⤵
        
        PID:1340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cff5bd01-8687-4da9-9596-de2616aa74f0.vbs"
        20⤵
        
        PID:1480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5058d3a2-bf50-448b-8df7-9821586cdf7a.vbs"
        18⤵
        
        PID:408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9aec5df0-da09-4e22-97bf-b3a3d25567c0.vbs"
        16⤵
        
        PID:2752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10d817a1-c20b-45ca-a010-739dd7d3595b.vbs"
        14⤵
        
        PID:1584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9443727b-a63a-4bf1-831f-152d34d5ca76.vbs"
        12⤵
        
        PID:996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0a299b4-4021-4a40-8d35-096ce9ed4478.vbs"
        10⤵
        
        PID:2520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbe10c8f-ac70-49a2-875c-a2dd4bca4a1e.vbs"
        8⤵
        
        PID:2032
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4626b2be-910b-48cb-8807-43a926a00238.vbs"
        6⤵
        
        PID:2580
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6954dc5-4a7e-4ad8-85f3-ca7fe15281b6.vbs"
      4⤵
      PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Pictures\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellNew\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\ShellNew\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\ShellNew\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\AppCompat\Programs\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\AppCompat\Programs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\AppCompat\Programs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Users\Default\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Users\Default\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\taskhost.exe

Filesize
1.7MB

MD5
a28e2396c1a646be5ad0796db9ea089b

SHA1
086f4e7dd0446015c4f965c9d847658a4c198d79

SHA256
136d015280693b0ae2615fc50f0c4a202ba9179728e3efcfd01a5e0b9a2a2187

SHA512
e9ff79a9291d50c8dcb4efaa4dfeb3de516026b8083611652142e9b94fc4b6d300a9e4c2757cf744365afdc898e6f9875beabb0834a3e8c8edc89a82053999b0

Download Submit
C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe

Filesize
1.7MB

MD5
0ca054d394141fe9e267ecb74526da98

SHA1
b7fb1c5d4de7c5f4da9707cdc59e4f2393212dbe

SHA256
dc0de207e0b6eca118f6a11465690d968346dd2c914be64692a8f29a9daa6eb8

SHA512
e5683475ca176760f68e42a9268f895845eb0ca733586923046b048494ef7a9e754712e06960d8c53a3a94b0d7b591eb7c42eb11e20b01c046c245f1135b3083

Download Submit
C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\winlogon.exe

Filesize
1.7MB

MD5
46702766a2b352b3db95618c69a14526

SHA1
0c2c1e90dc69c16e2b09b705f6914b2372431a59

SHA256
2c3d4ff9418a1e587dd659c253e47af84820c7ff4218b8dbff46a6a4f1cf47b9

SHA512
e1f84e854034293444f0f3ce562816e3f011ec58008f3601e00a7cf7125fc29c2f965fad7a59498d4d96b941006f20a4dcbb3373b325cd9fb6018cfa2aefc06e

Download Submit
C:\Users\Admin\AppData\Local\Temp\05a0c0dd-2f67-43ef-9e1c-173ece6694ac.vbs

Filesize
758B

MD5
a3951787b94bd77a2f9b949701fad490

SHA1
c7634b5a4e60b5b307442e649608363f58e35c13

SHA256
70b9309edd83067ea9b362cd3d469120007f32f8ef545cfc17e51806d1ed0e25

SHA512
070261bfe7801d39f5a49c4e67e783ccbea1228c6e91e890a6b053241dd8c7fbbb6ca3035b965a3d4def179e51cf010f68de79a42c7c1106194558282a0eca70

Download Submit
C:\Users\Admin\AppData\Local\Temp\0a8a470c-b7b9-4a10-b456-ef6a235c2ca3.vbs

Filesize
757B

MD5
44150baf41f3f0d99afaf665236a4056

SHA1
54fd54bb8dfb6f9fdf06eb9055efe4d1348a1820

SHA256
081da5cb9469e05e546b805f7d73f496c6d7b7850812fb59817535caf5e947df

SHA512
ad64097f585f295fd7260f98ecbf10739dab6e32fa114ca9cae7f2df609e0d31433916054c8d045247dc18bbee094fc9feebbd0e61989d17cd782c819db699f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2589a76d-a79f-4c44-b099-46d5efe7425a.vbs

Filesize
758B

MD5
fd65d4d8042156df08350db46bfd66f6

SHA1
b1d652cb25ab3d9fe6fad4c6f34eb60fd7a72140

SHA256
af22458d3e3ff4226dd59c01e62975e7c64c9e50198c8edc2a63f7117ad4e1f7

SHA512
d3b239cbbc424995824a5c7beab71a379bf3d1c8b2def329285fc4a829e8891e1e399efe9b29f2690b3eaee5c864702687fc6f00d58f9711b3a4189cfea552b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\3149158c-3018-4350-bc9e-bb93b8f33f29.vbs

Filesize
758B

MD5
0bd6c14d91f0a1570cc3a30442506588

SHA1
153f1deb60fc4a58999918411c5eadaa2b52311d

SHA256
d0efc06d9b49f463b27b713c3177b823df1374250765ea594f876f0ddb208ac1

SHA512
4b544a6a33174f2469187ef5f5c832627721b9c66774d363ef5982aa3655eb8d5f08c615df75942e8f577bc8ab4d8c3dfb2343bbf10e98a34348d9099fcd24ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\674f515a-eb6b-483a-b3cc-9310b1bab662.vbs

Filesize
758B

MD5
81089d8cad6a0bde752c14f5e00ffab4

SHA1
d8ba4d33c08b1ffd6941ef045141a7b89ce24e2d

SHA256
21325917f4fafebb4e03e30a63a3ac901c0d32308eada5af77895654b09c13bb

SHA512
9f0d978218aefe01659c2c591186d720d7e061ac6aed6e60bc4681d690f68b244b45e5bd7dcada08dce782ef18101eea62a1a05aeea890e3f1dcd46980410347

Download Submit
C:\Users\Admin\AppData\Local\Temp\6a2a236f-84b2-4fb3-ac25-447f1b2ab0f9.vbs

Filesize
758B

MD5
7addeb8f05bf7d0c72743e4a14091ef0

SHA1
d6a538988f4727ff88135326065b9dcd46322436

SHA256
a0966f3b4498a996adda42358b337503cbdc381c5c04aa252c8a73863bd1f597

SHA512
f124067cb10ad18623218612d92e3f4718048d35ae32bf92c1b7988de7b6fbd679cd0017b066f3935c0e708931e9062c2f243513bf3fc9eb74ca43791f57086c

Download Submit
C:\Users\Admin\AppData\Local\Temp\761999d6-6531-4a4e-9b14-7fddd00de4aa.vbs

Filesize
758B

MD5
3463dcbe1ecf0b60db7f6e01447749db

SHA1
5c043dbeb898a2dac20531618a5dea255d5a3413

SHA256
311842bbccd78129399cf716366e4adc6fa9723d9389a14efc791efaca9dc284

SHA512
3766b5aded2207b2b817477d33ea6d035e1c553782960b1bfad5fb73abbfe3d78efef12eafef5bf3e12e5e1bcf719f995e3516c00c01067a4f40f0444c85779f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a5e4f13-1c76-45d2-b310-a06ca2855c31.vbs

Filesize
758B

MD5
c08ee040c2754ebf4f020b4473b9ca51

SHA1
87d4393f45dc3f26ac527d5b434524e005dc8c62

SHA256
f356c7d13db81a6734233cd2a4c75096962ce91156e2313cfa997fb8222cb3e2

SHA512
1b1dd8f4ceccd84e0e12c2cbd4714fa7d0f81c3393b166e0180eea34cd4fd954cb9451f9d8a09e686a259982b6bda12ee6c3c8174d88b844e2327efcc498c80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Me7UXZhmqZ.bat

Filesize
247B

MD5
8fa6b677fe3289acd32ccc24634de884

SHA1
66efb399cb824c3c881a72bd221e34eeb36859eb

SHA256
12246e20c65a872c717acadf7661720b5ef446937448659ba743ebcfea234dff

SHA512
2421492ce4946d93a1ccd3bff21eda6f164d28c5c6cbc92157b4cde5452093e11a4114bad6afa562fda27da28bb852a57ffb07101d3032cb88eecf6a47964d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1837822-e7b8-447a-9baf-cc03b1ee4e26.vbs

Filesize
758B

MD5
8320537fcad6c8c3b1b95acbef505c9f

SHA1
eba16a9cde3b714ad1c511e9d0aadff4854ff6a1

SHA256
e286d92e1bf6a6970ecdb41e2a4c696d9519ff6ec6463db2eb895c96a0444d8a

SHA512
359ffe066f442213a7991a661651a52fd1f8828c8dc0a250990ca6229b416cd6eb7aa510bf872654c0867feda48c6267a83518f434e8104b958065e20268b062

Download Submit
C:\Users\Admin\AppData\Local\Temp\e6954dc5-4a7e-4ad8-85f3-ca7fe15281b6.vbs

Filesize
534B

MD5
c5d7f042b7228fd2331408e42c38c782

SHA1
5c776a968164662393f247cf9ec26577ca2ba33d

SHA256
4a07fdc7647f02d35ca9c9b371ff467664e1e59a1037caf1026bd4fe662e6ace

SHA512
c364f4f173bbb711a102aae695b0d727160f5577075ce096543f31f3a277996a3a671c27997b55a121026eabfb390c8092ac1dbaa34316aa9311de52594a8910

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
53a07c69d2686cda1a64e1b334e4a191

SHA1
4e4744b5b86a15c811ea486fadab29e6efb30dc9

SHA256
b594e197b20eaaa2c8701bb7c1c8795fac2959936857bb8091fbaae831b2e5a1

SHA512
1af48b68224a6291e579934adc2dca30e8fab8b03fd49d43cb62673b1e405eec6f9bc78b9b7de867cdd54327aeb0e5f4e08874af79cc42574fd800638f03d3d5

Download Submit
C:\Windows\ShellNew\explorer.exe

Filesize
1.7MB

MD5
65f36acc63b9393386d0ecfc30cef884

SHA1
326638ad72ae2cdc0c9ebca240f1ee1d49193152

SHA256
8cc2709a48c241678e7b4358becf6c2e2d8c87c410b06df68b78f67329cb4963

SHA512
9bf94de022e620a13bfb0596badb1f0ae54d9b535530da9a8dcc534145115d8a44620f43d1012dc4e248f422d194263bd5038d80d090d1252dd6b2635260ef81

Download Submit
memory/948-343-0x00000000013C0000-0x0000000001580000-memory.dmp

Filesize
1.8MB

Download
memory/1628-355-0x00000000005E0000-0x00000000005F2000-memory.dmp

Filesize
72KB

Download
memory/1676-378-0x00000000005F0000-0x0000000000602000-memory.dmp

Filesize
72KB

Download
memory/1908-390-0x0000000000660000-0x0000000000672000-memory.dmp

Filesize
72KB

Download
memory/1920-12-0x0000000000C40000-0x0000000000C4C000-memory.dmp

Filesize
48KB

Download
memory/1920-15-0x0000000000C60000-0x0000000000C68000-memory.dmp

Filesize
32KB

Download
memory/1920-19-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

Filesize
9.9MB

Download
memory/1920-217-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

Filesize
9.9MB

Download
memory/1920-239-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

Filesize
9.9MB

Download
memory/1920-241-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

Filesize
9.9MB

Download
memory/1920-1-0x0000000001170000-0x0000000001330000-memory.dmp

Filesize
1.8MB

Download
memory/1920-199-0x000007FEF5B43000-0x000007FEF5B44000-memory.dmp

Filesize
4KB

Download
memory/1920-17-0x0000000000D10000-0x0000000000D1C000-memory.dmp

Filesize
48KB

Download
memory/1920-16-0x0000000000CF0000-0x0000000000CFC000-memory.dmp

Filesize
48KB

Download
memory/1920-2-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

Filesize
9.9MB

Download
memory/1920-5-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/1920-13-0x0000000000D00000-0x0000000000D0A000-memory.dmp

Filesize
40KB

Download
memory/1920-3-0x0000000000440000-0x000000000045C000-memory.dmp

Filesize
112KB

Download
memory/1920-14-0x0000000000C50000-0x0000000000C5E000-memory.dmp

Filesize
56KB

Download
memory/1920-4-0x0000000000460000-0x0000000000468000-memory.dmp

Filesize
32KB

Download
memory/1920-0-0x000007FEF5B43000-0x000007FEF5B44000-memory.dmp

Filesize
4KB

Download
memory/1920-11-0x0000000000C10000-0x0000000000C22000-memory.dmp

Filesize
72KB

Download
memory/1920-9-0x0000000000C00000-0x0000000000C08000-memory.dmp

Filesize
32KB

Download
memory/1920-8-0x00000000006B0000-0x00000000006BC000-memory.dmp

Filesize
48KB

Download
memory/1920-7-0x00000000006A0000-0x00000000006B0000-memory.dmp

Filesize
64KB

Download
memory/1920-6-0x0000000000680000-0x0000000000696000-memory.dmp

Filesize
88KB

Download
memory/2136-253-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2136-251-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2196-297-0x0000000000860000-0x0000000000A20000-memory.dmp

Filesize
1.8MB

Download
memory/2328-320-0x0000000001130000-0x00000000012F0000-memory.dmp

Filesize
1.8MB

Download
memory/2800-308-0x0000000000200000-0x00000000003C0000-memory.dmp

Filesize
1.8MB

Download