e0b7deb5306d43671d3800515bdf5b31455b483a06862be563813eabea3e181d

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
Size

1.9MB
MD5

f6e9aa3f2d123261eda08333b1bd7559
SHA1

6bfe995054477329b2308617b824fb27ed762449
SHA256

c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195
SHA512

24fd343e717a3b3caf5870b2e8007a16b41f26418ecd8844ccd6f74a6255bf8918f7cf9b2cc3fafdc1cb39fbbbd144daf97832d6217efa7e6330e43f49102633
SSDEEP

24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	296	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2728	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2728	schtasks.exe	31

UAC bypass 3 TTPs 36 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2168	powershell.exe
1744	powershell.exe
1048	powershell.exe
2332	powershell.exe
2572	powershell.exe
2824	powershell.exe
3040	powershell.exe
2452	powershell.exe
2324	powershell.exe
1672	powershell.exe
2980	powershell.exe
680	powershell.exe
2560	powershell.exe
1960	powershell.exe
1932	powershell.exe
1800	powershell.exe
3048	powershell.exe
1576	powershell.exe
1208	powershell.exe
2472	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe

Executes dropped EXE 11 IoCs

pid	Process
2848	taskhost.exe
2612	taskhost.exe
868	taskhost.exe
1324	taskhost.exe
3016	taskhost.exe
1816	taskhost.exe
768	taskhost.exe
2256	taskhost.exe
1004	taskhost.exe
1384	taskhost.exe
828	taskhost.exe

Checks whether UAC is enabled 1 TTPs 24 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\audiodg.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\taskhost.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Google\wininit.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\24dbde2999530e	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files (x86)\Google\56085415360792	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files\MSBuild\audiodg.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Google\RCXCD4.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files\MSBuild\RCXE6CA.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files\MSBuild\RCXE6CB.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\RCXF569.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files (x86)\Windows Portable Devices\smss.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\6cb0b6c459d5d3	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\smss.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCXEF5B.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCX3E7.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files\MSBuild\42af1c969fbb7b	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXEB52.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCXEF5A.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\b75386f1303e64	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\RCXF56A.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Google\RCXCD5.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files (x86)\Windows Portable Devices\69ddcba757bf72	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\dwm.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Program Files (x86)\Google\wininit.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXEB51.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\dwm.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\RCX379.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\taskhost.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Media\RCXE8CF.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Windows\Media\RCXE93D.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Windows\Media\csrss.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Windows\Logs\DPX\b75386f1303e64	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Windows\Media\csrss.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Windows\Logs\DPX\RCXF15F.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Windows\Logs\DPX\RCXF160.tmp	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File opened for modification	C:\Windows\Logs\DPX\taskhost.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Windows\Media\886983d96e3d3e	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
File created	C:\Windows\Logs\DPX\taskhost.exe	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1744	schtasks.exe
1272	schtasks.exe
1648	schtasks.exe
1624	schtasks.exe
2256	schtasks.exe
2928	schtasks.exe
2808	schtasks.exe
1324	schtasks.exe
1756	schtasks.exe
2064	schtasks.exe
2936	schtasks.exe
1748	schtasks.exe
928	schtasks.exe
2116	schtasks.exe
2784	schtasks.exe
2856	schtasks.exe
2940	schtasks.exe
1864	schtasks.exe
2252	schtasks.exe
1932	schtasks.exe
1928	schtasks.exe
1716	schtasks.exe
2440	schtasks.exe
688	schtasks.exe
2340	schtasks.exe
1576	schtasks.exe
2020	schtasks.exe
1508	schtasks.exe
568	schtasks.exe
2128	schtasks.exe
1052	schtasks.exe
1232	schtasks.exe
2904	schtasks.exe
296	schtasks.exe
3048	schtasks.exe
2980	schtasks.exe
2032	schtasks.exe
1632	schtasks.exe
1400	schtasks.exe
2296	schtasks.exe
468	schtasks.exe
2264	schtasks.exe
2672	schtasks.exe
2208	schtasks.exe
2200	schtasks.exe
2360	schtasks.exe
2888	schtasks.exe
2624	schtasks.exe
696	schtasks.exe
2812	schtasks.exe
1948	schtasks.exe
2376	schtasks.exe
832	schtasks.exe
2636	schtasks.exe
1208	schtasks.exe
2452	schtasks.exe
2364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
1048	powershell.exe
3048	powershell.exe
1672	powershell.exe
2332	powershell.exe
2168	powershell.exe
1932	powershell.exe
2560	powershell.exe
1208	powershell.exe
2452	powershell.exe
2324	powershell.exe
2472	powershell.exe
680	powershell.exe
1576	powershell.exe
1800	powershell.exe
1744	powershell.exe
2572	powershell.exe
1960	powershell.exe
2980	powershell.exe
3040	powershell.exe
2824	powershell.exe
2848	taskhost.exe
2612	taskhost.exe
868	taskhost.exe
1324	taskhost.exe
3016	taskhost.exe
1816	taskhost.exe
768	taskhost.exe
2256	taskhost.exe
1004	taskhost.exe
1384	taskhost.exe
828	taskhost.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2848	taskhost.exe
Token: SeDebugPrivilege	2612	taskhost.exe
Token: SeDebugPrivilege	868	taskhost.exe
Token: SeDebugPrivilege	1324	taskhost.exe
Token: SeDebugPrivilege	3016	taskhost.exe
Token: SeDebugPrivilege	1816	taskhost.exe
Token: SeDebugPrivilege	768	taskhost.exe
Token: SeDebugPrivilege	2256	taskhost.exe
Token: SeDebugPrivilege	1004	taskhost.exe
Token: SeDebugPrivilege	1384	taskhost.exe
Token: SeDebugPrivilege	828	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2168	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	89
PID 2548 wrote to memory of 2168	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	89
PID 2548 wrote to memory of 2168	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	89
PID 2548 wrote to memory of 2472	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	90
PID 2548 wrote to memory of 2472	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	90
PID 2548 wrote to memory of 2472	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	90
PID 2548 wrote to memory of 1744	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	91
PID 2548 wrote to memory of 1744	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	91
PID 2548 wrote to memory of 1744	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	91
PID 2548 wrote to memory of 1048	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	92
PID 2548 wrote to memory of 1048	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	92
PID 2548 wrote to memory of 1048	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	92
PID 2548 wrote to memory of 1932	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	93
PID 2548 wrote to memory of 1932	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	93
PID 2548 wrote to memory of 1932	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	93
PID 2548 wrote to memory of 1800	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	94
PID 2548 wrote to memory of 1800	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	94
PID 2548 wrote to memory of 1800	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	94
PID 2548 wrote to memory of 2332	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	95
PID 2548 wrote to memory of 2332	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	95
PID 2548 wrote to memory of 2332	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	95
PID 2548 wrote to memory of 2452	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	96
PID 2548 wrote to memory of 2452	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	96
PID 2548 wrote to memory of 2452	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	96
PID 2548 wrote to memory of 2324	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	97
PID 2548 wrote to memory of 2324	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	97
PID 2548 wrote to memory of 2324	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	97
PID 2548 wrote to memory of 2572	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	98
PID 2548 wrote to memory of 2572	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	98
PID 2548 wrote to memory of 2572	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	98
PID 2548 wrote to memory of 3048	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	99
PID 2548 wrote to memory of 3048	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	99
PID 2548 wrote to memory of 3048	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	99
PID 2548 wrote to memory of 1672	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	100
PID 2548 wrote to memory of 1672	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	100
PID 2548 wrote to memory of 1672	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	100
PID 2548 wrote to memory of 2824	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	101
PID 2548 wrote to memory of 2824	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	101
PID 2548 wrote to memory of 2824	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	101
PID 2548 wrote to memory of 2980	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	102
PID 2548 wrote to memory of 2980	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	102
PID 2548 wrote to memory of 2980	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	102
PID 2548 wrote to memory of 680	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	103
PID 2548 wrote to memory of 680	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	103
PID 2548 wrote to memory of 680	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	103
PID 2548 wrote to memory of 2560	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	104
PID 2548 wrote to memory of 2560	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	104
PID 2548 wrote to memory of 2560	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	104
PID 2548 wrote to memory of 1576	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	105
PID 2548 wrote to memory of 1576	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	105
PID 2548 wrote to memory of 1576	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	105
PID 2548 wrote to memory of 3040	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	106
PID 2548 wrote to memory of 3040	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	106
PID 2548 wrote to memory of 3040	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	106
PID 2548 wrote to memory of 1960	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	107
PID 2548 wrote to memory of 1960	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	107
PID 2548 wrote to memory of 1960	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	107
PID 2548 wrote to memory of 1208	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	108
PID 2548 wrote to memory of 1208	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	108
PID 2548 wrote to memory of 1208	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	108
PID 2548 wrote to memory of 2848	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	129
PID 2548 wrote to memory of 2848	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	129
PID 2548 wrote to memory of 2848	2548	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe	129
PID 2848 wrote to memory of 568	2848	taskhost.exe	130

System policy modification 1 TTPs 36 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe
"C:\Users\Admin\AppData\Local\Temp\c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Favorites\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\DPX\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\My Documents\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\Logs\DPX\taskhost.exe
  "C:\Windows\Logs\DPX\taskhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2848
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9507660b-62bf-47be-b0a3-381d07c99206.vbs"
    3⤵
    PID:568
  - - C:\Windows\Logs\DPX\taskhost.exe
      C:\Windows\Logs\DPX\taskhost.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:2612
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e8dac8e-bd7e-4089-a07b-6783c8141b1d.vbs"
        5⤵
        
        PID:572
      - C:\Windows\Logs\DPX\taskhost.exe
        
        C:\Windows\Logs\DPX\taskhost.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee0a2575-4cd2-47a7-b16d-4dd36e739c60.vbs"
        7⤵
        
        PID:1944
        
        C:\Windows\Logs\DPX\taskhost.exe
        
        C:\Windows\Logs\DPX\taskhost.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1324
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e83a937-b92a-4a43-bac5-1e651d2b4358.vbs"
        9⤵
        
        PID:2832
        
        C:\Windows\Logs\DPX\taskhost.exe
        
        C:\Windows\Logs\DPX\taskhost.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3016
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78d234ca-f3f1-47ee-9d85-8c1322a7f8b0.vbs"
        11⤵
        
        PID:1528
        
        C:\Windows\Logs\DPX\taskhost.exe
        
        C:\Windows\Logs\DPX\taskhost.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1828794-85be-4084-940d-16077f9e6b3d.vbs"
        13⤵
        
        PID:2512
        
        C:\Windows\Logs\DPX\taskhost.exe
        
        C:\Windows\Logs\DPX\taskhost.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\201d9330-8952-4151-a5d4-fd9a33a1e62a.vbs"
        15⤵
        
        PID:2356
        
        C:\Windows\Logs\DPX\taskhost.exe
        
        C:\Windows\Logs\DPX\taskhost.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2256
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0068fe12-f9f2-46f1-b5b3-b8a446191372.vbs"
        17⤵
        
        PID:3004
        
        C:\Windows\Logs\DPX\taskhost.exe
        
        C:\Windows\Logs\DPX\taskhost.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df19196f-76c7-457e-b593-206bd81aaabc.vbs"
        19⤵
        
        PID:2348
        
        C:\Windows\Logs\DPX\taskhost.exe
        
        C:\Windows\Logs\DPX\taskhost.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1384
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7058921-c86f-4488-8aef-910b3bea97a0.vbs"
        21⤵
        
        PID:2144
        
        C:\Windows\Logs\DPX\taskhost.exe
        
        C:\Windows\Logs\DPX\taskhost.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e53d8cb-0624-49a1-8607-4aeef3dfc4d3.vbs"
        21⤵
        
        PID:888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ae1e20c-7966-40a4-a2f3-39dbbf566614.vbs"
        19⤵
        
        PID:2460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40ab1277-1916-4fbd-bc21-060366e1e954.vbs"
        17⤵
        
        PID:2100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca334fa5-f3b7-4620-bb22-9332b6c925c4.vbs"
        15⤵
        
        PID:2628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a666455-5efa-49eb-9124-870eabe96609.vbs"
        13⤵
        
        PID:2188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24e446f4-8b3c-4f53-9b55-f78f2285dad9.vbs"
        11⤵
        
        PID:1648
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\058f7167-a65d-4dea-a48a-06ce4255896e.vbs"
        9⤵
        
        PID:332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f875b4a0-a4ba-4ddc-84dd-349e25508ec6.vbs"
        7⤵
        
        PID:2624
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\960f2f57-174b-44d9-a2a6-0732fc902402.vbs"
        5⤵
        
        PID:2316
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e09fd15-49dc-4e37-a8bc-5b9291fa9001.vbs"
    3⤵
    PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\MSBuild\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Media\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\Media\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Favorites\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Favorites\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Favorites\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Windows\Logs\DPX\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Logs\DPX\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Windows\Logs\DPX\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\My Documents\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\My Documents\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195c" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195c" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default User\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\System.exe

Filesize
1.9MB

MD5
f31fc3465f2775b8f60709f08e0958e2

SHA1
fb4d8d0bc8e6d9044c74f8215f06028c318446ae

SHA256
06b1bb100f748b43db0a81ca0151aa283e97ecb331badeb29158885bc0f71772

SHA512
0c6cd21d5f6722fd8986dfe3d3c032c3a4b50c8cf347b18b313408936017fa2c7ae875573d64b091a4639ed261edc946ca326be16c57f732754d67196e292f77

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe

Filesize
1.9MB

MD5
e86f50e7afa952bf970a49bc0511f8a9

SHA1
a36d1da030557824211e873ecea9f23573ae476b

SHA256
314e282bf6e8b03ba3d18dfdf7b387211afa6be287c06c30f98ae5ac6552b614

SHA512
95b15041e27e59114584a1f5f206f648d2da8415b7962ea99831f6065c469fc0bc1bae36edbc6674eceb9d9493da4df6338e374c00b7fceda2c6d07dbbf027b2

Download Submit
C:\Program Files (x86)\Microsoft.NET\RedistList\taskhost.exe

Filesize
1.9MB

MD5
8f8b9f36b2e659ba5a6759261e0b86b8

SHA1
033e0a80f4405458c0f134260abc2dfd5b517068

SHA256
69d1dfad2a406f881c0577cc8c342f624406feff9761f2428835cfb1a50e9fa9

SHA512
5a181f1de15734a420c6f66dba829a724411dd6a5f1e3d552bde9c3b3d518352b76d5a0791f583a93d83428d20194785c18784970ea1b05158cc9998e7896a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\0068fe12-f9f2-46f1-b5b3-b8a446191372.vbs

Filesize
708B

MD5
ebcdd7b35b627f52441c07694dc05aaf

SHA1
a34b584cfb2b55589b2be37b9c380a73ef387bc6

SHA256
9a0819160392ee8f5e49947c91d125050b6bf98840ba7754b9695cb4675a0db1

SHA512
dadfa30322fede8997706b6900b76fbce1bf2405a9356f756911e2fe8d99748563ca9318d6e624e1dce4d690e8e373e56ae7fdee8f80679182b690850325a96c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1e83a937-b92a-4a43-bac5-1e651d2b4358.vbs

Filesize
708B

MD5
ee01e28cc2ade5ebc42e505d87edfef0

SHA1
80b286660aeee7258bd6cf3438f2d312d27a845c

SHA256
087757cba668df4f305b36527a97c9797244150f6e655ce6e684b8320053883a

SHA512
a18b973a78a8dd2ef6ec1d68a0ffc32bb91413c54fc571c250d19387bdd3616b8f79475a2481885c1d780f26b68a682af9cc67e73e588c917d81a8062c51c624

Download Submit
C:\Users\Admin\AppData\Local\Temp\201d9330-8952-4151-a5d4-fd9a33a1e62a.vbs

Filesize
707B

MD5
ddc053a166978a85ef46c4228a440530

SHA1
594adbbba3e966f638a153fa71a8d7e8de065a25

SHA256
4dd542e7a2e540ff2a65fe2b0ce0f32feb797618ec7f1f5384ef2cf5e2c5af44

SHA512
351e1349c490bf478510300e78d38c68e9440f38e775e3a4230f19cdf3726319f97346979aba62ad81bfb2a72d27f17fbc07479ce7db1eb6087ff2b776918a7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e09fd15-49dc-4e37-a8bc-5b9291fa9001.vbs

Filesize
484B

MD5
23685192dd482678a0ec10292111d3df

SHA1
bcce2e5897e6378802258f875489b363638cc3d1

SHA256
a2f55dea34fa9bf2916a43973ac14d2ff9ec7d3e363cf0c871d7318373ec6267

SHA512
5ea23239a16fbee3cfe2a925c4c77b00f7f826e3ccb2071032f86ee138ae359c30c8c783a71ad0dee4a393b7570171c2c1a44ccf5a1441c77442061273cb1d19

Download Submit
C:\Users\Admin\AppData\Local\Temp\78d234ca-f3f1-47ee-9d85-8c1322a7f8b0.vbs

Filesize
708B

MD5
afa10c16ee54de2b83d2bd9092f4ec8b

SHA1
27a4626e3c29c6d95569682697d082a01e850c3e

SHA256
8a644fc9ab179d99767f5966e6e2894998b7f1e068450264aeae246dae1eb913

SHA512
d8a2085307b9ad283709d1b4b1db1828177149f57e427190bf1fe3ab871d08afea55c1a8dcfcc97e9a0e70c12d4e17e2e8430548ab8e316828323fb4ca4a71ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\8e8dac8e-bd7e-4089-a07b-6783c8141b1d.vbs

Filesize
708B

MD5
ee9a75948e73a29c1f6488c9d1d2ad2b

SHA1
2808d3fd1675e398982718d7e2f9087b8ca8b94d

SHA256
2e8d1d190eabe230e7a6768101e024df16cc1b92a993f4b9fe62e62f48ed36da

SHA512
e2638ff053d65e0f96a285652fadc34ce674fa7ef4cef5b05b6ddc6f6c2f1b5c2961c303d88aaf5ec7aec6ca3e2067bfbdbe05c2762d728f5636f6e583dc8171

Download Submit
C:\Users\Admin\AppData\Local\Temp\9507660b-62bf-47be-b0a3-381d07c99206.vbs

Filesize
708B

MD5
eef64172e2dd2d93a05f7f0550b7a324

SHA1
940691435ce115d30aa29dd1367a0470ea85df39

SHA256
23ca0efbd3d20c8552170de55d799dbc4f8f9ba7780f5ec30feb35d6171d96f3

SHA512
5da77b48377bf63249fe177dc2604673d34177ef2ef8a65b5ff69a409d497485fe896ddcebc498a1013af76483b9f9d173f73ee1a6c3dc4854487d38fde4df76

Download Submit
C:\Users\Admin\AppData\Local\Temp\a7058921-c86f-4488-8aef-910b3bea97a0.vbs

Filesize
708B

MD5
71d2d65fbfe22472f34459bbcb27a692

SHA1
580c4722d7fdb583e0626c070b3ed9bcd8426858

SHA256
cc3758c586454527e37c9992e972f2d8b101e99391b5968ff96faf568987578c

SHA512
dd3aafd87de391e750649fb55c411b4c2644a47fb99fe0f8d7e2706091da9631f4ebd6693aa1bf4be9aed3d1528adfe6d2a7cb3295b678de153b092884ee88ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1828794-85be-4084-940d-16077f9e6b3d.vbs

Filesize
708B

MD5
7e36e9f4dbe2f0b412373648abe555a1

SHA1
488ed302b429f17d4d6bbb5d00d332ee7d608bd7

SHA256
54dfdcb543935a5015564cf176891ef530a44ee8bd93b0bba1e38a89de8d6129

SHA512
7b6d4033569b4530bc82d2fbe91d1b034f65e373fa63fb772c3ac9615d0e382cee43b56ead08ba95888ba963033345b71197ba300f6488982f63e5fe9c4a31c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\df19196f-76c7-457e-b593-206bd81aaabc.vbs

Filesize
708B

MD5
9473da58e405ac7759d109db7a4e4178

SHA1
e49cc79f56b3130f4c1363acedaf0309c55fbbaf

SHA256
5c585c068d89430bce8d5f90776d352c39500562d53d723d292ceead3c5f52af

SHA512
df2908d1bcf7b2f15ba557b41d1d675a1f6b10027e6f9ad5f5c84814afdfa4abb36c10e512f8097dc32dbe0694e574d58fa1954e4297c42e59aaa412fef58d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ee0a2575-4cd2-47a7-b16d-4dd36e739c60.vbs

Filesize
707B

MD5
835955ca083d1bd76a41c0fb5b7a4c46

SHA1
a50d468c55b72c32742d2b63026e70ab2310950e

SHA256
ea95fac05425cff532e4a1de4c6bbdc141d2c1d2c5f9d535a9feba97956365fd

SHA512
fade33b206ecf6b2de36746b904233aa0828937445820a633c77a9459fddca9f1afcf72939caa3fe08ae93688ab43ad438a6159f5b8d1b090f356f4303a03922

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
abbaab64a7e19e3e314b28f820436b1f

SHA1
7ad38ca356bd84dcd2015f50f57280ce44acc8ff

SHA256
ccdba535872ff33244f7fdadedb0c2da4e7b63d97f03bad754929a4704a923cb

SHA512
3c2253fdbe3e860a136fee7d8b04c5a37dd3e6328475f47a3fa1ea21f96b98219a05e79541ed2c6570c9ad50efc07d2d7240a6e5a5c96080c0372c99b1db9ea9

Download Submit
C:\Users\Public\Favorites\dllhost.exe

Filesize
1.9MB

MD5
f6e9aa3f2d123261eda08333b1bd7559

SHA1
6bfe995054477329b2308617b824fb27ed762449

SHA256
c119d7a5cbe03522b96e6fe8dd21f16e239d5ad617df9752ac0ca4827951e195

SHA512
24fd343e717a3b3caf5870b2e8007a16b41f26418ecd8844ccd6f74a6255bf8918f7cf9b2cc3fafdc1cb39fbbbd144daf97832d6217efa7e6330e43f49102633

Download Submit
C:\Windows\Media\csrss.exe

Filesize
1.9MB

MD5
59dbc453179dfd914287b260ac200836

SHA1
8fa8e8ebdf77ed820014195991588a6ff21a4ee1

SHA256
abe50698feddabd825f3320cdee662a52fb8905c431d68fd131f69d7da44b2c7

SHA512
1c6e61624c1cd8eb6dc4c2555b065daac4c929ff9db398600fc6d918472c6fb9932960d7dd4abe7adbaad1a188cd934260cf8e02a4edd16d12665aafb32ceca6

Download Submit
memory/828-509-0x0000000001320000-0x000000000150A000-memory.dmp

Filesize
1.9MB

Download
memory/868-419-0x0000000000CA0000-0x0000000000CF6000-memory.dmp

Filesize
344KB

Download
memory/1048-302-0x0000000001F10000-0x0000000001F18000-memory.dmp

Filesize
32KB

Download
memory/1048-299-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/1816-453-0x0000000000F40000-0x0000000000F52000-memory.dmp

Filesize
72KB

Download
memory/2548-3-0x0000000000DA0000-0x0000000000DBC000-memory.dmp

Filesize
112KB

Download
memory/2548-1-0x0000000000ED0000-0x00000000010BA000-memory.dmp

Filesize
1.9MB

Download
memory/2548-4-0x00000000004B0000-0x00000000004B8000-memory.dmp

Filesize
32KB

Download
memory/2548-18-0x000000001ADE0000-0x000000001ADEC000-memory.dmp

Filesize
48KB

Download
memory/2548-8-0x0000000000E80000-0x0000000000ED6000-memory.dmp

Filesize
344KB

Download
memory/2548-7-0x0000000000B90000-0x0000000000B9A000-memory.dmp

Filesize
40KB

Download
memory/2548-301-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2548-5-0x0000000000640000-0x0000000000650000-memory.dmp

Filesize
64KB

Download
memory/2548-9-0x0000000000C20000-0x0000000000C2C000-memory.dmp

Filesize
48KB

Download
memory/2548-10-0x0000000000DE0000-0x0000000000DE8000-memory.dmp

Filesize
32KB

Download
memory/2548-17-0x000000001ADD0000-0x000000001ADDC000-memory.dmp

Filesize
48KB

Download
memory/2548-0-0x000007FEF52D3000-0x000007FEF52D4000-memory.dmp

Filesize
4KB

Download
memory/2548-238-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2548-15-0x000000001ADB0000-0x000000001ADBE000-memory.dmp

Filesize
56KB

Download
memory/2548-16-0x000000001ADC0000-0x000000001ADC8000-memory.dmp

Filesize
32KB

Download
memory/2548-14-0x000000001ADA0000-0x000000001ADAA000-memory.dmp

Filesize
40KB

Download
memory/2548-6-0x0000000000DC0000-0x0000000000DD6000-memory.dmp

Filesize
88KB

Download
memory/2548-13-0x000000001AD30000-0x000000001AD3C000-memory.dmp

Filesize
48KB

Download
memory/2548-215-0x000007FEF52D3000-0x000007FEF52D4000-memory.dmp

Filesize
4KB

Download
memory/2548-12-0x0000000000DF0000-0x0000000000E02000-memory.dmp

Filesize
72KB

Download
memory/2548-2-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2612-407-0x0000000001000000-0x00000000011EA000-memory.dmp

Filesize
1.9MB

Download
memory/2848-396-0x0000000000ED0000-0x0000000000EE2000-memory.dmp

Filesize
72KB

Download
memory/2848-395-0x0000000000D10000-0x0000000000D66000-memory.dmp

Filesize
344KB

Download
memory/2848-305-0x0000000000EF0000-0x00000000010DA000-memory.dmp

Filesize
1.9MB

Download