13998cf5ce3fc1b1fb20635ef2c1e476c880d72eec7afb7e8ec74808928700da

Analysis

max time kernel
114s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8b0399c704553c85dfd0ab584536333.exe
Size

1.9MB
MD5

a8b0399c704553c85dfd0ab584536333
SHA1

62aea1857adbb4160c94beb5c8a599c0b6064a07
SHA256

2614012e702c04f31efd94532e4d8331b5a8d2ec0a2f7b98cdaf4c02942c469e
SHA512

65cf46ce9d75e7395d77c2025a9ab8552cfebc3b979c0c1596f9b3114b0699a11882c6dc1d312b0d3a2e14cf887525990b2612372a990748f6b31914f03f7904
SSDEEP

24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	352	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1120	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	1948	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	1948	schtasks.exe	30

UAC bypass 3 TTPs 27 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a8b0399c704553c85dfd0ab584536333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a8b0399c704553c85dfd0ab584536333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a8b0399c704553c85dfd0ab584536333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1232	powershell.exe
1260	powershell.exe
1864	powershell.exe
1628	powershell.exe
1852	powershell.exe
2360	powershell.exe
2888	powershell.exe
2656	powershell.exe
1404	powershell.exe
2912	powershell.exe
2952	powershell.exe
2772	powershell.exe
3056	powershell.exe
2052	powershell.exe
2720	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	a8b0399c704553c85dfd0ab584536333.exe

Executes dropped EXE 8 IoCs

pid	Process
2744	csrss.exe
1788	csrss.exe
2184	csrss.exe
2764	csrss.exe
484	csrss.exe
3036	csrss.exe
1600	csrss.exe
2816	csrss.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a8b0399c704553c85dfd0ab584536333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a8b0399c704553c85dfd0ab584536333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\es-ES\RCXD49B.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\es-ES\services.exe	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\6ccacd8608530f	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Program Files\Windows NT\OSPPSVC.exe	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Windows NT\RCXC9A9.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Windows NT\OSPPSVC.exe	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Program Files\Windows NT\1610b97d3ab4a7	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\f3b6ecef712a24	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\c5b4cb5e9653cc	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCXBDDB.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCXBDDC.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Windows NT\RCXC04E.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Windows NT\RCXC93B.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCXCBAD.tmp	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\Idle.exe	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Program Files\Windows NT\services.exe	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\Idle.exe	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Windows NT\services.exe	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCXCBAE.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\es-ES\RCXD49A.tmp	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Program Files\Windows NT\c5b4cb5e9653cc	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\services.exe	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Program Files\Windows NT\RCXBFE0.tmp	a8b0399c704553c85dfd0ab584536333.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCHEALTH\RCXCDB1.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Windows\Media\RCXB7BE.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Windows\PCHEALTH\RCXCDB2.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Windows\Media\services.exe	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Windows\PCHEALTH\audiodg.exe	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Windows\Media\c5b4cb5e9653cc	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Windows\PCHEALTH\42af1c969fbb7b	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCXC6C9.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\RCXC737.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Windows\PCHEALTH\audiodg.exe	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Windows\Media\services.exe	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\winlogon.exe	a8b0399c704553c85dfd0ab584536333.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\cc11b995f2a76d	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Windows\Media\RCXB7BD.tmp	a8b0399c704553c85dfd0ab584536333.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\winlogon.exe	a8b0399c704553c85dfd0ab584536333.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2808	schtasks.exe
2852	schtasks.exe
1168	schtasks.exe
2848	schtasks.exe
2896	schtasks.exe
2760	schtasks.exe
2836	schtasks.exe
352	schtasks.exe
1924	schtasks.exe
2720	schtasks.exe
2724	schtasks.exe
1120	schtasks.exe
1964	schtasks.exe
1552	schtasks.exe
904	schtasks.exe
912	schtasks.exe
2228	schtasks.exe
3012	schtasks.exe
2140	schtasks.exe
2972	schtasks.exe
2704	schtasks.exe
700	schtasks.exe
1496	schtasks.exe
600	schtasks.exe
2136	schtasks.exe
2936	schtasks.exe
2696	schtasks.exe
2436	schtasks.exe
1916	schtasks.exe
2160	schtasks.exe
2372	schtasks.exe
2368	schtasks.exe
1144	schtasks.exe
2944	schtasks.exe
2184	schtasks.exe
2736	schtasks.exe
2632	schtasks.exe
3068	schtasks.exe
1820	schtasks.exe
1244	schtasks.exe
1284	schtasks.exe
2152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2100	a8b0399c704553c85dfd0ab584536333.exe
2100	a8b0399c704553c85dfd0ab584536333.exe
2100	a8b0399c704553c85dfd0ab584536333.exe
2100	a8b0399c704553c85dfd0ab584536333.exe
2100	a8b0399c704553c85dfd0ab584536333.exe
2656	powershell.exe
2952	powershell.exe
2888	powershell.exe
2912	powershell.exe
1404	powershell.exe
2772	powershell.exe
2720	powershell.exe
3056	powershell.exe
1232	powershell.exe
1852	powershell.exe
2360	powershell.exe
2052	powershell.exe
1628	powershell.exe
1864	powershell.exe
1260	powershell.exe
2744	csrss.exe
1788	csrss.exe
2184	csrss.exe
2764	csrss.exe
484	csrss.exe
3036	csrss.exe
1600	csrss.exe
2816	csrss.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	a8b0399c704553c85dfd0ab584536333.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	2744	csrss.exe
Token: SeDebugPrivilege	1788	csrss.exe
Token: SeDebugPrivilege	2184	csrss.exe
Token: SeDebugPrivilege	2764	csrss.exe
Token: SeDebugPrivilege	484	csrss.exe
Token: SeDebugPrivilege	3036	csrss.exe
Token: SeDebugPrivilege	1600	csrss.exe
Token: SeDebugPrivilege	2816	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2912	2100	a8b0399c704553c85dfd0ab584536333.exe	74
PID 2100 wrote to memory of 2912	2100	a8b0399c704553c85dfd0ab584536333.exe	74
PID 2100 wrote to memory of 2912	2100	a8b0399c704553c85dfd0ab584536333.exe	74
PID 2100 wrote to memory of 3056	2100	a8b0399c704553c85dfd0ab584536333.exe	75
PID 2100 wrote to memory of 3056	2100	a8b0399c704553c85dfd0ab584536333.exe	75
PID 2100 wrote to memory of 3056	2100	a8b0399c704553c85dfd0ab584536333.exe	75
PID 2100 wrote to memory of 2888	2100	a8b0399c704553c85dfd0ab584536333.exe	76
PID 2100 wrote to memory of 2888	2100	a8b0399c704553c85dfd0ab584536333.exe	76
PID 2100 wrote to memory of 2888	2100	a8b0399c704553c85dfd0ab584536333.exe	76
PID 2100 wrote to memory of 2720	2100	a8b0399c704553c85dfd0ab584536333.exe	77
PID 2100 wrote to memory of 2720	2100	a8b0399c704553c85dfd0ab584536333.exe	77
PID 2100 wrote to memory of 2720	2100	a8b0399c704553c85dfd0ab584536333.exe	77
PID 2100 wrote to memory of 2360	2100	a8b0399c704553c85dfd0ab584536333.exe	79
PID 2100 wrote to memory of 2360	2100	a8b0399c704553c85dfd0ab584536333.exe	79
PID 2100 wrote to memory of 2360	2100	a8b0399c704553c85dfd0ab584536333.exe	79
PID 2100 wrote to memory of 1404	2100	a8b0399c704553c85dfd0ab584536333.exe	80
PID 2100 wrote to memory of 1404	2100	a8b0399c704553c85dfd0ab584536333.exe	80
PID 2100 wrote to memory of 1404	2100	a8b0399c704553c85dfd0ab584536333.exe	80
PID 2100 wrote to memory of 2772	2100	a8b0399c704553c85dfd0ab584536333.exe	81
PID 2100 wrote to memory of 2772	2100	a8b0399c704553c85dfd0ab584536333.exe	81
PID 2100 wrote to memory of 2772	2100	a8b0399c704553c85dfd0ab584536333.exe	81
PID 2100 wrote to memory of 1852	2100	a8b0399c704553c85dfd0ab584536333.exe	83
PID 2100 wrote to memory of 1852	2100	a8b0399c704553c85dfd0ab584536333.exe	83
PID 2100 wrote to memory of 1852	2100	a8b0399c704553c85dfd0ab584536333.exe	83
PID 2100 wrote to memory of 2952	2100	a8b0399c704553c85dfd0ab584536333.exe	89
PID 2100 wrote to memory of 2952	2100	a8b0399c704553c85dfd0ab584536333.exe	89
PID 2100 wrote to memory of 2952	2100	a8b0399c704553c85dfd0ab584536333.exe	89
PID 2100 wrote to memory of 2052	2100	a8b0399c704553c85dfd0ab584536333.exe	90
PID 2100 wrote to memory of 2052	2100	a8b0399c704553c85dfd0ab584536333.exe	90
PID 2100 wrote to memory of 2052	2100	a8b0399c704553c85dfd0ab584536333.exe	90
PID 2100 wrote to memory of 1628	2100	a8b0399c704553c85dfd0ab584536333.exe	91
PID 2100 wrote to memory of 1628	2100	a8b0399c704553c85dfd0ab584536333.exe	91
PID 2100 wrote to memory of 1628	2100	a8b0399c704553c85dfd0ab584536333.exe	91
PID 2100 wrote to memory of 2656	2100	a8b0399c704553c85dfd0ab584536333.exe	92
PID 2100 wrote to memory of 2656	2100	a8b0399c704553c85dfd0ab584536333.exe	92
PID 2100 wrote to memory of 2656	2100	a8b0399c704553c85dfd0ab584536333.exe	92
PID 2100 wrote to memory of 1864	2100	a8b0399c704553c85dfd0ab584536333.exe	94
PID 2100 wrote to memory of 1864	2100	a8b0399c704553c85dfd0ab584536333.exe	94
PID 2100 wrote to memory of 1864	2100	a8b0399c704553c85dfd0ab584536333.exe	94
PID 2100 wrote to memory of 1260	2100	a8b0399c704553c85dfd0ab584536333.exe	95
PID 2100 wrote to memory of 1260	2100	a8b0399c704553c85dfd0ab584536333.exe	95
PID 2100 wrote to memory of 1260	2100	a8b0399c704553c85dfd0ab584536333.exe	95
PID 2100 wrote to memory of 1232	2100	a8b0399c704553c85dfd0ab584536333.exe	96
PID 2100 wrote to memory of 1232	2100	a8b0399c704553c85dfd0ab584536333.exe	96
PID 2100 wrote to memory of 1232	2100	a8b0399c704553c85dfd0ab584536333.exe	96
PID 2100 wrote to memory of 2744	2100	a8b0399c704553c85dfd0ab584536333.exe	104
PID 2100 wrote to memory of 2744	2100	a8b0399c704553c85dfd0ab584536333.exe	104
PID 2100 wrote to memory of 2744	2100	a8b0399c704553c85dfd0ab584536333.exe	104
PID 2744 wrote to memory of 3024	2744	csrss.exe	105
PID 2744 wrote to memory of 3024	2744	csrss.exe	105
PID 2744 wrote to memory of 3024	2744	csrss.exe	105
PID 2744 wrote to memory of 548	2744	csrss.exe	106
PID 2744 wrote to memory of 548	2744	csrss.exe	106
PID 2744 wrote to memory of 548	2744	csrss.exe	106
PID 3024 wrote to memory of 1788	3024	WScript.exe	107
PID 3024 wrote to memory of 1788	3024	WScript.exe	107
PID 3024 wrote to memory of 1788	3024	WScript.exe	107
PID 1788 wrote to memory of 1968	1788	csrss.exe	108
PID 1788 wrote to memory of 1968	1788	csrss.exe	108
PID 1788 wrote to memory of 1968	1788	csrss.exe	108
PID 1788 wrote to memory of 2808	1788	csrss.exe	109
PID 1788 wrote to memory of 2808	1788	csrss.exe	109
PID 1788 wrote to memory of 2808	1788	csrss.exe	109
PID 1968 wrote to memory of 2184	1968	WScript.exe	110

System policy modification 1 TTPs 27 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	a8b0399c704553c85dfd0ab584536333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	a8b0399c704553c85dfd0ab584536333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	a8b0399c704553c85dfd0ab584536333.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a8b0399c704553c85dfd0ab584536333.exe
"C:\Users\Admin\AppData\Local\Temp\a8b0399c704553c85dfd0ab584536333.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a8b0399c704553c85dfd0ab584536333.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\uninstall\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Music\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PCHEALTH\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\Mahjong\es-ES\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1232
- C:\Users\Public\Documents\My Music\csrss.exe
  "C:\Users\Public\Documents\My Music\csrss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c1ea853-c024-4054-81c2-18c1b7a2052a.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Users\Public\Documents\My Music\csrss.exe
      "C:\Users\Public\Documents\My Music\csrss.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1788
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3838081-f761-44b5-80a8-08c51c1b8aac.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1968
      - C:\Users\Public\Documents\My Music\csrss.exe
        
        "C:\Users\Public\Documents\My Music\csrss.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07e6cc10-fbbd-4e58-9f05-8d69dafa0a71.vbs"
        7⤵
        
        PID:2428
        
        C:\Users\Public\Documents\My Music\csrss.exe
        
        "C:\Users\Public\Documents\My Music\csrss.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47ceaf33-a310-4875-b1e3-72ff94bc9e20.vbs"
        9⤵
        
        PID:1760
        
        C:\Users\Public\Documents\My Music\csrss.exe
        
        "C:\Users\Public\Documents\My Music\csrss.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f90cac88-188c-4b23-ad35-7c15e6bccad3.vbs"
        11⤵
        
        PID:1044
        
        C:\Users\Public\Documents\My Music\csrss.exe
        
        "C:\Users\Public\Documents\My Music\csrss.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8334f1e9-0bb2-4e82-856f-6fd8b2c14995.vbs"
        13⤵
        
        PID:1988
        
        C:\Users\Public\Documents\My Music\csrss.exe
        
        "C:\Users\Public\Documents\My Music\csrss.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93a95b9f-08bd-46cc-89aa-a79c3e468add.vbs"
        15⤵
        
        PID:2640
        
        C:\Users\Public\Documents\My Music\csrss.exe
        
        "C:\Users\Public\Documents\My Music\csrss.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4987e911-957a-44a4-a90c-39d1436eec67.vbs"
        17⤵
        
        PID:1672
        
        C:\Users\Public\Documents\My Music\csrss.exe
        
        "C:\Users\Public\Documents\My Music\csrss.exe"
        18⤵
        
        PID:2776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75fed6c5-ce90-49e3-a7a0-858919893103.vbs"
        19⤵
        
        PID:2084
        
        C:\Users\Public\Documents\My Music\csrss.exe
        
        "C:\Users\Public\Documents\My Music\csrss.exe"
        20⤵
        
        PID:2360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bf58117-488d-4d72-bd0e-515d97d5af52.vbs"
        21⤵
        
        PID:828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\097207bf-3cd8-462f-844a-54e4bb04ce02.vbs"
        21⤵
        
        PID:2728
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b3b3ba5-59b9-44d5-b318-7f7d1b200b3b.vbs"
        19⤵
        
        PID:2856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1848b316-a1ce-4293-8a5a-e568ec121ba0.vbs"
        17⤵
        
        PID:2764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06e4af41-c80c-409d-8dc6-af937ea73582.vbs"
        15⤵
        
        PID:2024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c89cd9a8-2626-4d1a-bd33-d0de9bc926cc.vbs"
        13⤵
        
        PID:2548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f067411-8f48-498f-9580-113ad3c03f3f.vbs"
        11⤵
        
        PID:2624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a73a5d7-8e68-4760-b215-3a971fda9a2d.vbs"
        9⤵
        
        PID:2756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8105c1f1-7f75-429c-b7da-7dfa21f813e7.vbs"
        7⤵
        
        PID:2812
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d49414ee-3fbb-41b3-bcc4-ae237a0ff565.vbs"
        5⤵
        
        PID:2808
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\562f7763-49aa-45c3-960a-d81eadc8859b.vbs"
    3⤵
    PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Media\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\uninstall\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\uninstall\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows NT\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\My Music\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Music\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Windows NT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Windows\PCHEALTH\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Windows\PCHEALTH\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Games\Mahjong\es-ES\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Mahjong\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Games\Mahjong\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows NT\OSPPSVC.exe

Filesize
1.9MB

MD5
805f0d8aea360cba460450740bc9fc2c

SHA1
339d691715ff34bf93a995ab9fea75eaf803bcd0

SHA256
a9f7182e9ec71cfc98a2570302dbeac95099952a3548b5eea03a9c9d81a057ee

SHA512
b7ae4b8cf30020cf573727282c33ae6e53b783f196733148e17eddcfdaa9c193c6a017c172a5786dbb8d60c21216026676a878232848e010000d56cc30514c4c

Download Submit
C:\Program Files\Windows NT\services.exe

Filesize
1.9MB

MD5
a8b0399c704553c85dfd0ab584536333

SHA1
62aea1857adbb4160c94beb5c8a599c0b6064a07

SHA256
2614012e702c04f31efd94532e4d8331b5a8d2ec0a2f7b98cdaf4c02942c469e

SHA512
65cf46ce9d75e7395d77c2025a9ab8552cfebc3b979c0c1596f9b3114b0699a11882c6dc1d312b0d3a2e14cf887525990b2612372a990748f6b31914f03f7904

Download Submit
C:\Program Files\Windows NT\services.exe

Filesize
1.9MB

MD5
5ec8760c7ef102f0ac463d3e49ad5295

SHA1
c7081b9eb89f834e3766f3ea371949e7f8f7bafd

SHA256
c77e4c3748c7b34ceb63c09161327024b86671302778d9aff8ef046ac4ab0430

SHA512
fc5629c190b49053600b9a4f661b66d585ef7263b657e20ecc5ac88d40c78042102b383da3955f7d7879abc8ac142aa00dfccdf555ebce9c41931ce73b38df00

Download Submit
C:\Users\Admin\AppData\Local\Temp\07e6cc10-fbbd-4e58-9f05-8d69dafa0a71.vbs

Filesize
720B

MD5
dfa0fd2004ab0dd354421ddd786caa15

SHA1
6c0ff778955d3990f7c786c20db4bf788c7c6a43

SHA256
e495fbb30ac1612656accdc26beca49db9f642a30966a4eddd3c6253bc762218

SHA512
3f10d45508a83f40e53e7e5849f855c08536bb5fea8b7ba00473e92211a2ef56ff23f8fb47cf0f415dc9f2821598e5a74e9e38b59ffea49c16981761b3916f71

Download Submit
C:\Users\Admin\AppData\Local\Temp\2bf58117-488d-4d72-bd0e-515d97d5af52.vbs

Filesize
720B

MD5
d71476daf5cd4096d590e63dd5a55d4e

SHA1
4f27ca7ec92edf7b00828f476a93a014e5b800dc

SHA256
e567246a7bf5a488ceb3df73be88810a91333890953e142a8ac547138114b462

SHA512
05fd0d30a429f51af8b88cceb033b4dd64f25a6390d4dfa8957fb61117a632f091d01d41f8c4802011c0e76d8c3ddb7832b72623677e940ba53b2de88b7ffc21

Download Submit
C:\Users\Admin\AppData\Local\Temp\3c1ea853-c024-4054-81c2-18c1b7a2052a.vbs

Filesize
720B

MD5
e024ff7fcd565df5364be0788d686b38

SHA1
5d0ff683fb8d55c6f0ec2a789387a8bd55451c4f

SHA256
c4df6fb8907ff452d2b20a64b09d04eb49166f64cdcc0ec2ee4a8c586e164364

SHA512
c6d8ea5a206463d31f844a05a78554faa5066bf8dc08df8f62e82e753a7b382aaf5b0f5c8f2fac7839fd437ae6f2331810907830727de37b7ad76d44d9220787

Download Submit
C:\Users\Admin\AppData\Local\Temp\47ceaf33-a310-4875-b1e3-72ff94bc9e20.vbs

Filesize
720B

MD5
61ed33d68aaf3c65e2ce065c272d567d

SHA1
e8d795ddf23c78e9ea79fab301593d89c4d004a2

SHA256
210ba83bc5da28e9e9519a245b42dabe12d615f371da4966d9b00e84260d869c

SHA512
849f14029d3aa1404942006ff6b179358464823f6f98ebcb6527fe9aed6da3f8be6eb77b666fe2eef00c6ec0327b362f60e2d1aea1461f1e660849bfb2d46cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\4987e911-957a-44a4-a90c-39d1436eec67.vbs

Filesize
720B

MD5
5e25d6f7b55b8f39995500f8caeff516

SHA1
b8f017588f23c42dd3c19d335a98b4b037d57f0e

SHA256
68576ce2ac3661fb253951270a54d886945067cfddc5532f3de26be8df91ff7d

SHA512
f259d4a2d11a796eba5a449f8ce858754de90d5e770dbde099052994ad76f3491889bd23902cd0a3dac7f61fc8a736e53144a425029aa0795cd754913a9c453d

Download Submit
C:\Users\Admin\AppData\Local\Temp\562f7763-49aa-45c3-960a-d81eadc8859b.vbs

Filesize
496B

MD5
4e60dade7725119daabdc0acdda7503a

SHA1
147c311c13ad7692b6a40d97182ca8147e1df078

SHA256
2aeee7d19ab291387867ca370ec6ce03a27e9c3dc942ba1be0e18a73e7841d0b

SHA512
7f15692d5982cad60194c8925cd5b90832f11f2d7826b76b4b04fc55930270d29f9af1ed3e0eb4440109376f8370bab224ce461d265fc22c176a7e38f0d1f783

Download Submit
C:\Users\Admin\AppData\Local\Temp\67d364d828a3a1e72dc99b586dadae47b5918f45.exe

Filesize
1.4MB

MD5
e012828c986dd0ea3754179a63003ab4

SHA1
033c71e88284937bfa321b782e6fb01baab528c4

SHA256
352f0501afd5c5d886749bca78c8279072ced80a3e31f3b8bce6573bd1165957

SHA512
06a78fabb379b3ffb6ee632b3193ad04be7713e3a095337ae7eb902d89ac796afb1625af26aa14e6d0dd123354a42371dde8cb9d3744ce392884a98c9afa3010

Download Submit
C:\Users\Admin\AppData\Local\Temp\75fed6c5-ce90-49e3-a7a0-858919893103.vbs

Filesize
720B

MD5
5079e07005d625e225aa02ebc0771a19

SHA1
73578a3d4df83c300782c3544ff8459c2bcc4c95

SHA256
42ff0e67ca8fda02668f05fc3255011d956fee586fd17947c4a079bbc67c2196

SHA512
b872a805f0c61eaf0cb86215a1887dab34de7f0d4d1d7b15d0a592fa56808e92059be872554b86c2493d5d5f11c44e4e39def29fe007b87f7a64f494f5ae86f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\8334f1e9-0bb2-4e82-856f-6fd8b2c14995.vbs

Filesize
720B

MD5
2141f11d1804d4447e1ded715a855d02

SHA1
1e7dc2dedee7c3ce99f74b08d97ec82b5ea45bc0

SHA256
4335862c66b497972f1c36ff471c2308e12ece211d76aa4230ec9d5a8289df08

SHA512
f7b229f512840d717f84d36e91a3db9dfd7ceb74e27112ab2b570522f6e75ea7de415081ac70a2f9fd797907fd67ff22e95b5daadd1dd833e921519c00537444

Download Submit
C:\Users\Admin\AppData\Local\Temp\93a95b9f-08bd-46cc-89aa-a79c3e468add.vbs

Filesize
720B

MD5
63d7f8553c979cb89bb3dc7c47ce1286

SHA1
721a631cd6437bf62a861b5306fbb0a40f3c82a5

SHA256
ae26b37b0a5b535fb555c3e9064266f58f8446f0e72baff1823388b5e452dd60

SHA512
819c4b48f59855cdd0579be52a666aa808eb3a9b4205520ed647581b5b5840b4ec6723c3da0a6313c878d68f1c01efba1b625873bffa9815360645a5dfab851c

Download Submit
C:\Users\Admin\AppData\Local\Temp\a3838081-f761-44b5-80a8-08c51c1b8aac.vbs

Filesize
720B

MD5
feaed9940b66876dfccf3853fe9dd72f

SHA1
5bcff67fab7019ef8b49dad8be3766c7311ac18c

SHA256
8d29216361e58c8147fb9138a5bc368745ee76ecfbc892128179e1c6344db78f

SHA512
316ec17915e134ef0e297c4ddc61579836d158e5781a13d2378fbc585f158b51b4238422cf25f1f8d995d042205ff52ce88795e1366dd4a6b188c4cf95c2c056

Download Submit
C:\Users\Admin\AppData\Local\Temp\f90cac88-188c-4b23-ad35-7c15e6bccad3.vbs

Filesize
719B

MD5
63c06e72033655ee3e3861ac361a8652

SHA1
10bf72390251954e3c8cad9e661abcfa8a3ab3fe

SHA256
20f74d58424e0c04089090b9ae6483f3a5ea1d1d6d54c5ce41162e93e5425157

SHA512
add0dc1c430025ee437592067d7f41e76ec3299ed51d469b3815f45813364efdd8a1740745d3c539203a5aab4034580a0d32c0030daff74d67b96f6ce6bf5343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5bcc04fa6313cf98cb451309b95bd89b

SHA1
a64caa2bdf2c7952652c878acd64ddf5800c5c74

SHA256
e223db0da47be271120fd81a4c95d624fb4ae4fd38014d00de9da6d58745c955

SHA512
9adc080b42a15796d56cdc46633df65337d00094028a88bbb30fb603a4eb6d8685a9a80781f37a114b15587d3ee7bbffd32d5d6fe53223d802938328a6e17174

Download Submit
C:\Users\Public\Music\csrss.exe

Filesize
1.9MB

MD5
49a4e386e9013a5ea53fcbe03edb879a

SHA1
cb1bc1c422d7d83f2c6da1d5e40bff4c1c2c503b

SHA256
f3c5e3f1762df01a28af6793c313d71fcb8efb709823c4e3400e0b8e46f416d8

SHA512
ffa0f602b4ff2b3210c36f5e90046f32c9a645650f5f9f0fc8d88517d485c298cae983b4a00ae80ba907025f3ce4bc882854ab836a6922d695f71025da467b4c

Download Submit
C:\Users\Public\Music\csrss.exe

Filesize
1.6MB

MD5
0086416c45285c709db7ff24fca0e0fe

SHA1
9d73bbe5f6d969cbae1c2fe406873642fb43f242

SHA256
64a71ee36d71bc81fb0bfcb99ee10d24b6728320348db370ac814b7d4f3488ca

SHA512
f86cf9d476c8b230e8e473655f18cee41fd91b71c591a74b42a6b04ec93b57cc2ffaf7b6b3444c8f8c43e8635c943fc8b384883792f12e2f680dc07bd04602f0

Download Submit
C:\Windows\BitLockerDiscoveryVolumeContents\winlogon.exe

Filesize
1.9MB

MD5
d52bdaa6ea6aaafb920e94a2c45a8012

SHA1
836adfcea2882bf55e2fc43dc7d0184b4c39c49d

SHA256
53f79a155745fa9ee15921fea784fb2c44048ed5885d03f5a04565b647c59cf6

SHA512
7ed3ff170553c88877098ddf39a72004671a4f820e014bd99df94f512a610f764af96bad6a10ab729ffbdb514705296b5bfb2b18bfae9e45287eed1a75a96a0d

Download Submit
memory/1600-371-0x0000000000BE0000-0x0000000000C36000-memory.dmp

Filesize
344KB

Download
memory/1600-372-0x0000000000560000-0x0000000000572000-memory.dmp

Filesize
72KB

Download
memory/1788-312-0x0000000000D60000-0x0000000000F4A000-memory.dmp

Filesize
1.9MB

Download
memory/2100-18-0x000000001AC00000-0x000000001AC0C000-memory.dmp

Filesize
48KB

Download
memory/2100-16-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/2100-14-0x0000000002470000-0x000000000247A000-memory.dmp

Filesize
40KB

Download
memory/2100-1-0x0000000000E60000-0x000000000104A000-memory.dmp

Filesize
1.9MB

Download
memory/2100-2-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2100-292-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2100-5-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Filesize
64KB

Download
memory/2100-299-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2100-4-0x0000000000450000-0x0000000000458000-memory.dmp

Filesize
32KB

Download
memory/2100-3-0x0000000000A00000-0x0000000000A1C000-memory.dmp

Filesize
112KB

Download
memory/2100-15-0x0000000002480000-0x000000000248E000-memory.dmp

Filesize
56KB

Download
memory/2100-9-0x0000000000BF0000-0x0000000000BFC000-memory.dmp

Filesize
48KB

Download
memory/2100-17-0x00000000024A0000-0x00000000024AC000-memory.dmp

Filesize
48KB

Download
memory/2100-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/2100-7-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/2100-215-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/2100-13-0x0000000000D10000-0x0000000000D1C000-memory.dmp

Filesize
48KB

Download
memory/2100-10-0x0000000000C00000-0x0000000000C08000-memory.dmp

Filesize
32KB

Download
memory/2100-12-0x0000000000C10000-0x0000000000C22000-memory.dmp

Filesize
72KB

Download
memory/2100-6-0x0000000000BC0000-0x0000000000BD6000-memory.dmp

Filesize
88KB

Download
memory/2100-8-0x0000000000CA0000-0x0000000000CF6000-memory.dmp

Filesize
344KB

Download
memory/2184-325-0x0000000000650000-0x0000000000662000-memory.dmp

Filesize
72KB

Download
memory/2184-324-0x0000000000FC0000-0x00000000011AA000-memory.dmp

Filesize
1.9MB

Download
memory/2656-239-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2656-230-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download
memory/2744-301-0x0000000002150000-0x0000000002162000-memory.dmp

Filesize
72KB

Download
memory/2744-300-0x0000000000B10000-0x0000000000B66000-memory.dmp

Filesize
344KB

Download
memory/2744-298-0x0000000000B60000-0x0000000000D4A000-memory.dmp

Filesize
1.9MB

Download
memory/2776-397-0x0000000000770000-0x0000000000782000-memory.dmp

Filesize
72KB

Download
memory/2816-384-0x0000000001150000-0x000000000133A000-memory.dmp

Filesize
1.9MB

Download
memory/2816-385-0x00000000004D0000-0x0000000000526000-memory.dmp

Filesize
344KB

Download
memory/3036-359-0x0000000001040000-0x000000000122A000-memory.dmp

Filesize
1.9MB

Download