dcrat | 55edcf08f8521a9cddde8570baaac0ab8ef6e640e96c834db0e5c12f5b9c68fe

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
Size

1.6MB
MD5

e9a05151dfc1c4c2e84f16e25d05f6ee
SHA1

4bced15dc17ebf0e95cb34558e093446d394b235
SHA256

f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1
SHA512

6bd1a48e3d6a6a76b115bb6b6dddb95c5a39a890ca285f8d9470a6857d73c761225271ea513b1762641b373aa737b845261e0098e94ea8552ddd04226be804af
SSDEEP

24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 53 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2580	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2580	schtasks.exe	31

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral15/memory/2752-1-0x00000000009C0000-0x0000000000B62000-memory.dmp	dcrat
behavioral15/files/0x00050000000195d9-25.dat	dcrat
behavioral15/files/0x000a00000001941a-113.dat	dcrat
behavioral15/files/0x000c00000001962a-195.dat	dcrat
behavioral15/files/0x0007000000019db8-217.dat	dcrat
behavioral15/files/0x0035000000015ccc-246.dat	dcrat
behavioral15/memory/2952-264-0x0000000000C50000-0x0000000000DF2000-memory.dmp	dcrat
behavioral15/memory/940-376-0x0000000000FF0000-0x0000000001192000-memory.dmp	dcrat
behavioral15/memory/2092-388-0x00000000003E0000-0x0000000000582000-memory.dmp	dcrat
behavioral15/memory/1788-400-0x0000000000F10000-0x00000000010B2000-memory.dmp	dcrat
behavioral15/memory/952-445-0x00000000003D0000-0x0000000000572000-memory.dmp	dcrat
behavioral15/memory/2008-457-0x00000000012D0000-0x0000000001472000-memory.dmp	dcrat
behavioral15/memory/1708-480-0x0000000001370000-0x0000000001512000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2972	powershell.exe
1612	powershell.exe
628	powershell.exe
1908	powershell.exe
2960	powershell.exe
1892	powershell.exe
1260	powershell.exe
2836	powershell.exe
1108	powershell.exe
1092	powershell.exe
1640	powershell.exe
1844	powershell.exe
1548	powershell.exe
1536	powershell.exe
1664	powershell.exe
900	powershell.exe
1736	powershell.exe
1652	powershell.exe
276	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2952	explorer.exe
2392	explorer.exe
940	explorer.exe
2092	explorer.exe
1788	explorer.exe
1660	explorer.exe
1924	explorer.exe
2508	explorer.exe
952	explorer.exe
2008	explorer.exe
2892	explorer.exe
1708	explorer.exe
1508	explorer.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\RCXF163.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files\DVD Maker\RCXF164.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Program Files (x86)\Windows Portable Devices\lsass.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Program Files\Uninstall Information\WmiPrvSE.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Program Files\Uninstall Information\24dbde2999530e	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCX5F.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXF368.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files\DVD Maker\wininit.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\56085415360792	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Program Files (x86)\Internet Explorer\explorer.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\lsass.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCX2D2.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX1640.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files\Uninstall Information\RCX16AE.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Program Files\DVD Maker\wininit.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6203df4a6bafc7	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCXF369.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCX60.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCX2D1.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\explorer.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Program Files\Uninstall Information\WmiPrvSE.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Program Files\DVD Maker\56085415360792	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Program Files (x86)\Internet Explorer\7a0fd90576e088	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Branding\ShellBrd\f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File created	C:\Windows\Branding\ShellBrd\5f9dc6ea631274	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Windows\Branding\ShellBrd\RCXFE5A.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Windows\Branding\ShellBrd\RCXFE5B.tmp	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
File opened for modification	C:\Windows\Branding\ShellBrd\f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1636	schtasks.exe
2252	schtasks.exe
760	schtasks.exe
576	schtasks.exe
640	schtasks.exe
2712	schtasks.exe
1516	schtasks.exe
1632	schtasks.exe
1132	schtasks.exe
2908	schtasks.exe
1260	schtasks.exe
268	schtasks.exe
2372	schtasks.exe
3032	schtasks.exe
2772	schtasks.exe
2936	schtasks.exe
484	schtasks.exe
2044	schtasks.exe
988	schtasks.exe
1220	schtasks.exe
2452	schtasks.exe
1952	schtasks.exe
1892	schtasks.exe
2944	schtasks.exe
2116	schtasks.exe
2528	schtasks.exe
2204	schtasks.exe
2432	schtasks.exe
2324	schtasks.exe
2824	schtasks.exe
3048	schtasks.exe
1792	schtasks.exe
1924	schtasks.exe
1704	schtasks.exe
2960	schtasks.exe
1664	schtasks.exe
2628	schtasks.exe
924	schtasks.exe
2128	schtasks.exe
1564	schtasks.exe
1880	schtasks.exe
1076	schtasks.exe
2988	schtasks.exe
2632	schtasks.exe
2564	schtasks.exe
1328	schtasks.exe
1640	schtasks.exe
2952	schtasks.exe
2968	schtasks.exe
1584	schtasks.exe
2500	schtasks.exe
1620	schtasks.exe
1976	schtasks.exe
700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
1736	powershell.exe
276	powershell.exe
1640	powershell.exe
900	powershell.exe
1652	powershell.exe
628	powershell.exe
2960	powershell.exe
1908	powershell.exe
1260	powershell.exe
1548	powershell.exe
1664	powershell.exe
2836	powershell.exe
1536	powershell.exe
1108	powershell.exe
1844	powershell.exe
1892	powershell.exe
1612	powershell.exe
2972	powershell.exe
1092	powershell.exe
2952	explorer.exe
2392	explorer.exe
940	explorer.exe
2092	explorer.exe
1788	explorer.exe
1660	explorer.exe
1924	explorer.exe
2508	explorer.exe
952	explorer.exe
2008	explorer.exe
2892	explorer.exe
1708	explorer.exe
1508	explorer.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	276	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	2952	explorer.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	2392	explorer.exe
Token: SeDebugPrivilege	940	explorer.exe
Token: SeDebugPrivilege	2092	explorer.exe
Token: SeDebugPrivilege	1788	explorer.exe
Token: SeDebugPrivilege	1660	explorer.exe
Token: SeDebugPrivilege	1924	explorer.exe
Token: SeDebugPrivilege	2508	explorer.exe
Token: SeDebugPrivilege	952	explorer.exe
Token: SeDebugPrivilege	2008	explorer.exe
Token: SeDebugPrivilege	2892	explorer.exe
Token: SeDebugPrivilege	1708	explorer.exe
Token: SeDebugPrivilege	1508	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 276	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	87
PID 2752 wrote to memory of 276	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	87
PID 2752 wrote to memory of 276	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	87
PID 2752 wrote to memory of 1652	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	88
PID 2752 wrote to memory of 1652	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	88
PID 2752 wrote to memory of 1652	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	88
PID 2752 wrote to memory of 1108	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	90
PID 2752 wrote to memory of 1108	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	90
PID 2752 wrote to memory of 1108	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	90
PID 2752 wrote to memory of 1736	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	91
PID 2752 wrote to memory of 1736	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	91
PID 2752 wrote to memory of 1736	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	91
PID 2752 wrote to memory of 1892	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	92
PID 2752 wrote to memory of 1892	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	92
PID 2752 wrote to memory of 1892	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	92
PID 2752 wrote to memory of 1548	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	93
PID 2752 wrote to memory of 1548	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	93
PID 2752 wrote to memory of 1548	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	93
PID 2752 wrote to memory of 2960	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	95
PID 2752 wrote to memory of 2960	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	95
PID 2752 wrote to memory of 2960	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	95
PID 2752 wrote to memory of 1908	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	96
PID 2752 wrote to memory of 1908	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	96
PID 2752 wrote to memory of 1908	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	96
PID 2752 wrote to memory of 1844	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	97
PID 2752 wrote to memory of 1844	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	97
PID 2752 wrote to memory of 1844	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	97
PID 2752 wrote to memory of 1640	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	100
PID 2752 wrote to memory of 1640	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	100
PID 2752 wrote to memory of 1640	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	100
PID 2752 wrote to memory of 628	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	101
PID 2752 wrote to memory of 628	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	101
PID 2752 wrote to memory of 628	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	101
PID 2752 wrote to memory of 2836	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	103
PID 2752 wrote to memory of 2836	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	103
PID 2752 wrote to memory of 2836	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	103
PID 2752 wrote to memory of 1612	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	104
PID 2752 wrote to memory of 1612	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	104
PID 2752 wrote to memory of 1612	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	104
PID 2752 wrote to memory of 1260	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	105
PID 2752 wrote to memory of 1260	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	105
PID 2752 wrote to memory of 1260	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	105
PID 2752 wrote to memory of 900	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	107
PID 2752 wrote to memory of 900	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	107
PID 2752 wrote to memory of 900	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	107
PID 2752 wrote to memory of 1664	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	111
PID 2752 wrote to memory of 1664	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	111
PID 2752 wrote to memory of 1664	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	111
PID 2752 wrote to memory of 1092	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	114
PID 2752 wrote to memory of 1092	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	114
PID 2752 wrote to memory of 1092	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	114
PID 2752 wrote to memory of 1536	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	115
PID 2752 wrote to memory of 1536	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	115
PID 2752 wrote to memory of 1536	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	115
PID 2752 wrote to memory of 2972	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	116
PID 2752 wrote to memory of 2972	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	116
PID 2752 wrote to memory of 2972	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	116
PID 2752 wrote to memory of 2952	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	121
PID 2752 wrote to memory of 2952	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	121
PID 2752 wrote to memory of 2952	2752	f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe	121
PID 2952 wrote to memory of 1848	2952	explorer.exe	126
PID 2952 wrote to memory of 1848	2952	explorer.exe	126
PID 2952 wrote to memory of 1848	2952	explorer.exe	126
PID 2952 wrote to memory of 2732	2952	explorer.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
"C:\Users\Admin\AppData\Local\Temp\f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\ShellBrd\f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Program Files (x86)\Internet Explorer\explorer.exe
  "C:\Program Files (x86)\Internet Explorer\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c41c51d-272e-49a5-bbc4-bbf43635a4d6.vbs"
    3⤵
    PID:1848
  - - C:\Program Files (x86)\Internet Explorer\explorer.exe
      "C:\Program Files (x86)\Internet Explorer\explorer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2392
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0a1ad23-8a4d-4335-962c-4d85705221ce.vbs"
        5⤵
        
        PID:2832
      - C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d589361a-490f-483a-979a-2c33ba49d8b7.vbs"
        7⤵
        
        PID:760
        
        C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9d7bef1-d972-442c-a934-640ce602ce39.vbs"
        9⤵
        
        PID:2800
        
        C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8632b13f-b9e5-4740-bf8d-b9ccf0e68900.vbs"
        11⤵
        
        PID:1564
        
        C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55212f8d-a58d-48ee-b1ed-4949d828bcd7.vbs"
        13⤵
        
        PID:2300
        
        C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b6f9168-d841-4cfd-8720-a7fe379a7515.vbs"
        15⤵
        
        PID:2420
        
        C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e17cdd1-9bda-45b4-a81c-b0f3e28efb6b.vbs"
        17⤵
        
        PID:1872
        
        C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26fd3061-a179-431a-8b92-a43944df22f5.vbs"
        19⤵
        
        PID:484
        
        C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b2103ca-ab36-4d78-84e6-a2857e3ad1b7.vbs"
        21⤵
        
        PID:2512
        
        C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b241a7f3-a31e-420e-bf18-5e9cb2db68af.vbs"
        23⤵
        
        PID:2900
        
        C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fb3c30f-c636-4904-a035-8dd77f2105f0.vbs"
        25⤵
        
        PID:1964
        
        C:\Program Files (x86)\Internet Explorer\explorer.exe
        
        "C:\Program Files (x86)\Internet Explorer\explorer.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1846a0f8-4e0d-40a5-a25d-25f27673e63f.vbs"
        27⤵
        
        PID:1460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b762ac7-1b20-45c3-b881-e64504b92cac.vbs"
        27⤵
        
        PID:712
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\830bf09b-2bf6-464a-a4e3-1cb21109214d.vbs"
        25⤵
        
        PID:2508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56cc43f7-e39f-4d54-89cc-b95be123ac95.vbs"
        23⤵
        
        PID:2080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bba3dc98-1788-4c9e-8eff-b19291e1ed81.vbs"
        21⤵
        
        PID:1780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\01a87e1a-255d-46f5-baeb-062f8eaf3dac.vbs"
        19⤵
        
        PID:1632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04b6d014-c212-4d50-901b-cdafb3e01347.vbs"
        17⤵
        
        PID:1600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50cace04-3c36-4598-acee-bb021126e9ea.vbs"
        15⤵
        
        PID:2696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8c756bc-b10a-4b6a-8804-02a4deee2547.vbs"
        13⤵
        
        PID:864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03fb21f6-b227-48b2-84e3-811a93d9d657.vbs"
        11⤵
        
        PID:1672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99ff5dd9-823a-40ec-a146-573515bca16f.vbs"
        9⤵
        
        PID:2824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8125a130-3fa6-40d8-97e3-a77bebd59555.vbs"
        7⤵
        
        PID:1020
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0137eebe-eaae-4f02-a9d9-e279c1804788.vbs"
        5⤵
        
        PID:2672
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\200b6a56-0233-43b7-a356-5ce94b8a5f9d.vbs"
    3⤵
    PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\DVD Maker\wininit.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\DVD Maker\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1f" /sc MINUTE /mo 14 /tr "'C:\Windows\Branding\ShellBrd\f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1" /sc ONLOGON /tr "'C:\Windows\Branding\ShellBrd\f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1f" /sc MINUTE /mo 7 /tr "'C:\Windows\Branding\ShellBrd\f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\Public\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Public\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Users\Public\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Downloads\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Downloads\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dwm.exe

Filesize
1.6MB

MD5
65fbb2f96c55a5005c50509d1fb66924

SHA1
08dc85ebb987a04cba15925bdc136bd93d5a2dbc

SHA256
c8bee22d01fed0635f1b67cb8e29e757ba802dc92656cd0e4db8d57f423605eb

SHA512
bc5fc84f08c17a578e8eb2a87d4179124c657dedb2248b576581da50713452fc26189002de73ebf32adb2097cb4990f2965db5881bbf209466a324bec5ed96de

Download Submit
C:\Program Files\Uninstall Information\WmiPrvSE.exe

Filesize
1.6MB

MD5
799686b8afbb3bdd23a22aa73fdc19fd

SHA1
3453b63457ba1c3aee7cc6f561711e855f5a9068

SHA256
a5e9e2a4c4d3fa7a927dcbcaca047b6f025c55119d3393dad829248f9b4af52c

SHA512
d91485f32cd2f5bdbf93de775998d2ad0a3e6e4f40c364e30458634db1d84fd207bac9e594c5ea010e9bd5cc0b7627a46f50b6c1bb1e6cb7570ae4fc2f824f21

Download Submit
C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\audiodg.exe

Filesize
1.6MB

MD5
0066f8a171f74cf95eda221a0f6d5f92

SHA1
9d0fdfbd25008ba1c95a4046038e3fb0fbd87975

SHA256
5cb7ca259219356c4ce4089c774af2f3fe005f000d11ff245a869bb449ca2770

SHA512
554a203555f28dfba33d899b2f769b5aef11a59e562c839737e94ca0b6a2ebcd3cc47a2fce59e7be27eebe580b8c34b2a4a20a388db7cccaff9bb65bf81e721a

Download Submit
C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe

Filesize
1.6MB

MD5
e9a05151dfc1c4c2e84f16e25d05f6ee

SHA1
4bced15dc17ebf0e95cb34558e093446d394b235

SHA256
f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1

SHA512
6bd1a48e3d6a6a76b115bb6b6dddb95c5a39a890ca285f8d9470a6857d73c761225271ea513b1762641b373aa737b845261e0098e94ea8552ddd04226be804af

Download Submit
C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe

Filesize
1.6MB

MD5
420ae8a6b309ba492304463c9fa57ba8

SHA1
ffeb9451b71bef3fc6d7760117551238a4510b9b

SHA256
028982fca887a0aa235ed3263a908fe8f9def43c4fd35add1bbdb60cf1754560

SHA512
6778c64aa33de6f2500f313e5c4987143a5061765dab93bceb901e9235f58acd056e63aa7b18dfde5838af25fda9b5e5066cebe3e3ba83cf22e2bd6b9e7e8c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\200b6a56-0233-43b7-a356-5ce94b8a5f9d.vbs

Filesize
505B

MD5
5951b9b0e809f9dc9e51b19cf66abb72

SHA1
7801eb10ed8cfb8a21d37497bae59d910306998e

SHA256
881d92f73623db92ef460bb61ffe2b37525714a860397dc70b8d98719e4ab4c2

SHA512
e2764f0d640dad60ed56bf9611ae012d77df0992155182a61beaee0879073dea1f521ce5a79384c2f3a72e4a0215325907281f4597893618b8624e83be57676e

Download Submit
C:\Users\Admin\AppData\Local\Temp\26fd3061-a179-431a-8b92-a43944df22f5.vbs

Filesize
728B

MD5
0ffe411c9b26e225b883ef64993318ba

SHA1
fd948466b66b6cbe81d6076281c5546232d5d863

SHA256
9e0ef36d2c5aed2fd9e5048a33bd74b461d4f50569ac5a6e34d228d3181e566a

SHA512
1bebe48e5b833716aa95bb3b2433845bf653311a86e74c93a8493f9870c9e952c0edb6dd8e8290fdea8081c91cd5f1ac344016d23f7b5f8088e03c0ab97e4367

Download Submit
C:\Users\Admin\AppData\Local\Temp\4b6f9168-d841-4cfd-8720-a7fe379a7515.vbs

Filesize
729B

MD5
e9662373e9f298b11d9a470d810e8a56

SHA1
e831f392d9d38b84bbcaf0bfa29a33a08be40386

SHA256
52eeee3303455b0739a25f303764adf8882ad416e9e8d850bee19692986752b6

SHA512
afff8b7427e8c92f4d987eeac1762466f96b3d6aa75fe922f28a2d73fabfd612dabd63ec38d2da167c33b0d580d5575072126c59e097358b830f78aa2f753c38

Download Submit
C:\Users\Admin\AppData\Local\Temp\55212f8d-a58d-48ee-b1ed-4949d828bcd7.vbs

Filesize
729B

MD5
ed85718fdf0f0b33a0a2d182713f842b

SHA1
cf749a12e6653e4f4abf958e9370acf4294d0c40

SHA256
5499d62658e7d64dc62634ebef3d052875c02402a38d7d4386ae0e2a9b7c5daa

SHA512
6adb598c208c65021357ee618c34a42c06fd81237a40e5180893264659dacf297ab8acc82970a8ad85b9741509fb2e86ede128f19add7cb3ac2aa5adb245c93d

Download Submit
C:\Users\Admin\AppData\Local\Temp\8632b13f-b9e5-4740-bf8d-b9ccf0e68900.vbs

Filesize
729B

MD5
ee301ac24842c08ce6e637a2471096f3

SHA1
587e0ed3eece40b86240c6770b4ba1d66712c605

SHA256
6c7b041e386dd4f50c183d57cefab6a785ce761d783d1d61a9506df17e217d3a

SHA512
d65bef5694554c5b6950b46c3333b2123d7b94b12f4c40dfc3659a5dcb5a2c9cdcf043442b59d247734f251ff5b22fda87a5406a74e539ec9fd1c06fc25f57ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b2103ca-ab36-4d78-84e6-a2857e3ad1b7.vbs

Filesize
729B

MD5
898471d752fa946b7c863fd5da12dee2

SHA1
7d38e2ea23a12e1a3ec00fc33c38b7adfefe5acf

SHA256
753d4458fa907a72a50267461d13c003115f79d906898496b53043e43aa7fe9e

SHA512
8e1be42e1a8dc9a1333772d803c22937f3e311317f625d470ade8e44cdbc5445ed18923fe763b386d10087f9acdcb01b7774b53e3c2550722a5a7f888be9a5a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\8c41c51d-272e-49a5-bbc4-bbf43635a4d6.vbs

Filesize
729B

MD5
54b4793f5066374a29d8a5ea1fb06ab9

SHA1
0c268681a27fc3bfe040995ee03031fa5112bf45

SHA256
0a17f65f7fc1771ed5038179f8781aadc0d716ed7dc3cc73e9d23885204b9d39

SHA512
4cd5f682beddf8f626436e64ade43bc580fc4c8cad69a5b4c65a1b361f6a6c38b45a42c063d2fdc84f2850673b8fbdbe562c5ac7db07c3719f9fe3135c4c7ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9e17cdd1-9bda-45b4-a81c-b0f3e28efb6b.vbs

Filesize
729B

MD5
db4ec2fe777f433687cd2e79f772790e

SHA1
a075359840b2ecc01a39f83a1e3194e0bf3adc69

SHA256
11b43cfab12984adc961b1c7dc9c9849539587b4e5ee5a1b29dd74f8d623fc8f

SHA512
8b6f7872f19e6ecbba50c52be080c7e8e5fab24a178c66735191d2bbbbbf4f2641b1a1f74c9eec1894815e4ae22357749d89d5ac2c25cc4d54a833d1dc3e42ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\b241a7f3-a31e-420e-bf18-5e9cb2db68af.vbs

Filesize
729B

MD5
0d99707727af6480e52572de3c6c741a

SHA1
b25740c4ca91b5a3caff1cd001655fbe6947a107

SHA256
f832db96c180097b5930cbfe5519cb224a64e083c3077bfcc2a71327116bb0c7

SHA512
476598457ea62e07f7de12741f5d6ce7b77b99e5a2c72c7c5441b25e17603a98c229c433a6c2757e8eebf82c8eeb68ea42861591ce11c99d6cd8ba446aceda2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\d589361a-490f-483a-979a-2c33ba49d8b7.vbs

Filesize
728B

MD5
bd3fda20d1995d9a24ee77177ed99660

SHA1
f3edfdfb72264ce0063dea510a30de61a6d6e937

SHA256
39751dd96b7a6fa7255ada843db837f610d2ee35662270235e9b5a741366f2de

SHA512
0a5e92956df951b2d619353af9b6f46781bc24a5debdd2ae6b68694cb561fec2fb27d5a4c5a1abdbc3f35e584cef41ed1cddc0cbf2490e7397da5c9f78c407ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\d9d7bef1-d972-442c-a934-640ce602ce39.vbs

Filesize
729B

MD5
7af1041d5ad239077e884a6a4bac471e

SHA1
7ff0f8fc143f9b7cddd1379961bd297a76fb75cf

SHA256
4addb67f572af99b7ac2a5fa962fbe3e69884dfcbca340f0d00d044faa95660c

SHA512
d48e82b635fbe8bca41acb63e924d1374d158cf8953838b6ea0b9475d93801d26afd6e1a74700dcafe1c50e6e8d5e0f7c5cdeed6d4a9bc906808f23664ecab5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f0a1ad23-8a4d-4335-962c-4d85705221ce.vbs

Filesize
729B

MD5
783a3f1be9e1c9798d58bcffd8b612b2

SHA1
07c97a57482f615f6b0985f63608e0e9b0bc0d9f

SHA256
d809aa92ea59b58daecaea64906efe842add31d9bd93cc7822ac72568f816fdd

SHA512
f99d6846fa9d26be3f99a0599a7a2bd5f3a43eb9d962ddbf352e8f5ef265bf74ebbe4dc1fe7c8d26daa87880e338816c7e0dc8ce1736ef542dc94cdf6c5cb454

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b83430ec19d54d0b28e30b9551021e26

SHA1
1bcb4abffbc1087c0713dfec7dc4388a70899da1

SHA256
89506aa43951434ddaf1e86a19701c524b487ec3bafd47d092c93d9972992bb3

SHA512
44e4f6e8133a2ee8dfab2788fc636d6c66da29b2485878bce63e499e06a0050506e0246ca16aadcae279e5110e1d7e6705af5b69fae8afcaf0e0f99754cfea31

Download Submit
memory/940-376-0x0000000000FF0000-0x0000000001192000-memory.dmp

Filesize
1.6MB

Download
memory/952-445-0x00000000003D0000-0x0000000000572000-memory.dmp

Filesize
1.6MB

Download
memory/1708-480-0x0000000001370000-0x0000000001512000-memory.dmp

Filesize
1.6MB

Download
memory/1736-263-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/1736-265-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/1788-400-0x0000000000F10000-0x00000000010B2000-memory.dmp

Filesize
1.6MB

Download
memory/2008-457-0x00000000012D0000-0x0000000001472000-memory.dmp

Filesize
1.6MB

Download
memory/2092-388-0x00000000003E0000-0x0000000000582000-memory.dmp

Filesize
1.6MB

Download
memory/2752-12-0x000000001A780000-0x000000001A78E000-memory.dmp

Filesize
56KB

Download
memory/2752-13-0x000000001A790000-0x000000001A798000-memory.dmp

Filesize
32KB

Download
memory/2752-259-0x000007FEF6620000-0x000007FEF700C000-memory.dmp

Filesize
9.9MB

Download
memory/2752-235-0x000007FEF6620000-0x000007FEF700C000-memory.dmp

Filesize
9.9MB

Download
memory/2752-220-0x000007FEF6623000-0x000007FEF6624000-memory.dmp

Filesize
4KB

Download
memory/2752-3-0x00000000003D0000-0x00000000003EC000-memory.dmp

Filesize
112KB

Download
memory/2752-5-0x0000000001FF0000-0x0000000002006000-memory.dmp

Filesize
88KB

Download
memory/2752-6-0x00000000009B0000-0x00000000009B8000-memory.dmp

Filesize
32KB

Download
memory/2752-8-0x0000000002010000-0x0000000002018000-memory.dmp

Filesize
32KB

Download
memory/2752-11-0x000000001A770000-0x000000001A77A000-memory.dmp

Filesize
40KB

Download
memory/2752-0-0x000007FEF6623000-0x000007FEF6624000-memory.dmp

Filesize
4KB

Download
memory/2752-1-0x00000000009C0000-0x0000000000B62000-memory.dmp

Filesize
1.6MB

Download
memory/2752-14-0x000000001A7A0000-0x000000001A7A8000-memory.dmp

Filesize
32KB

Download
memory/2752-15-0x000000001A7B0000-0x000000001A7BA000-memory.dmp

Filesize
40KB

Download
memory/2752-16-0x000000001A7C0000-0x000000001A7CC000-memory.dmp

Filesize
48KB

Download
memory/2752-9-0x00000000020B0000-0x00000000020BC000-memory.dmp

Filesize
48KB

Download
memory/2752-10-0x00000000021D0000-0x00000000021DC000-memory.dmp

Filesize
48KB

Download
memory/2752-7-0x0000000002020000-0x0000000002030000-memory.dmp

Filesize
64KB

Download
memory/2752-4-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2752-2-0x000007FEF6620000-0x000007FEF700C000-memory.dmp

Filesize
9.9MB

Download
memory/2952-264-0x0000000000C50000-0x0000000000DF2000-memory.dmp

Filesize
1.6MB

Download