4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
147s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250410-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
14/04/2025, 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f926cc363c27c542c23e14398096eda8.exe
Size

1.9MB
MD5

f926cc363c27c542c23e14398096eda8
SHA1

03442d6ea4a9acd36987b916ffe0261810e6dbfd
SHA256

ec0c9de9d6eef69bfe2c220f21971d4acc91004194cd8cf993a2bd34a04e31df
SHA512

581d105843a37d51aed86b071aed97c4188cb4bc8aed8b8c9bd9f7c297d5b3ba79d1d93f0a3d9bb5da89dbb445385838f7df229bec27b36d46b13757eb16491f
SSDEEP

24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5488	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5988	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5784	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5240	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5216	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5528	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5736	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5496	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5672	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2612	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5396	2612	schtasks.exe	81

UAC bypass 3 TTPs 30 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	f926cc363c27c542c23e14398096eda8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	f926cc363c27c542c23e14398096eda8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f926cc363c27c542c23e14398096eda8.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5356	powershell.exe
1904	powershell.exe
5708	powershell.exe
4228	powershell.exe
5608	powershell.exe
1148	powershell.exe
2860	powershell.exe
232	powershell.exe
5840	powershell.exe
1700	powershell.exe
3208	powershell.exe
5720	powershell.exe
3364	powershell.exe
5516	powershell.exe
5172	powershell.exe
5436	powershell.exe
1456	powershell.exe
2760	powershell.exe
3296	powershell.exe
4488	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	f926cc363c27c542c23e14398096eda8.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000\Control Panel\International\Geo\Nation	f926cc363c27c542c23e14398096eda8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000\Control Panel\International\Geo\Nation	SppExtComObj.exe

Executes dropped EXE 9 IoCs

pid	Process
2812	SppExtComObj.exe
1512	SppExtComObj.exe
3040	SppExtComObj.exe
4136	SppExtComObj.exe
3904	SppExtComObj.exe
640	SppExtComObj.exe
1820	SppExtComObj.exe
5304	SppExtComObj.exe
2328	SppExtComObj.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f926cc363c27c542c23e14398096eda8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f926cc363c27c542c23e14398096eda8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad\attachments\ea9f0e6c9e2dcd	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Program Files (x86)\Windows Mail\winlogon.exe	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad\attachments\taskhostw.exe	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\RCX8792.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\RCX8800.tmp	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Program Files (x86)\Windows Mail\cc11b995f2a76d	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\f3b6ecef712a24	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad\attachments\RCX671F.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\winlogon.exe	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\dllhost.exe	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad\attachments\taskhostw.exe	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Program Files\Windows Defender\en-US\TextInputHost.exe	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Program Files\Windows Defender\en-US\22eafd247d37c3	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Program Files (x86)\Reference Assemblies\5940a34987c991	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX7DB7.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\RCX8029.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\TextInputHost.exe	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Program Files (x86)\Reference Assemblies\dllhost.exe	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad\attachments\RCX66B1.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\RCX8097.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\RCX851F.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\RCX858D.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX7D49.tmp	f926cc363c27c542c23e14398096eda8.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\uk-UA\886983d96e3d3e	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Windows\Migration\WTR\66fc9ff0ee96c2	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Windows\es-ES\dwm.exe	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Windows\es-ES\6cb0b6c459d5d3	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Windows\Migration\WTR\RCX6E1A.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Windows\es-ES\RCX73EB.tmp	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Windows\SystemResources\Windows.SystemToast.DesktopSpotlight\SearchApp.exe	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Windows\uk-UA\RCX5F29.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Windows\uk-UA\RCX5F98.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Windows\es-ES\dwm.exe	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Windows\uk-UA\csrss.exe	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Windows\uk-UA\csrss.exe	f926cc363c27c542c23e14398096eda8.exe
File created	C:\Windows\Migration\WTR\sihost.exe	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Windows\Migration\WTR\RCX6E88.tmp	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Windows\Migration\WTR\sihost.exe	f926cc363c27c542c23e14398096eda8.exe
File opened for modification	C:\Windows\es-ES\RCX737D.tmp	f926cc363c27c542c23e14398096eda8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	f926cc363c27c542c23e14398096eda8.exe
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-21-137520623-1834890667-2396102459-1000_Classes\Local Settings	SppExtComObj.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5988	schtasks.exe
4512	schtasks.exe
5488	schtasks.exe
4180	schtasks.exe
4900	schtasks.exe
1060	schtasks.exe
4992	schtasks.exe
4912	schtasks.exe
4868	schtasks.exe
4000	schtasks.exe
552	schtasks.exe
2444	schtasks.exe
5672	schtasks.exe
1956	schtasks.exe
1216	schtasks.exe
5108	schtasks.exe
4984	schtasks.exe
1164	schtasks.exe
3152	schtasks.exe
1064	schtasks.exe
1012	schtasks.exe
2532	schtasks.exe
5080	schtasks.exe
5784	schtasks.exe
5216	schtasks.exe
5736	schtasks.exe
4568	schtasks.exe
2600	schtasks.exe
5496	schtasks.exe
4828	schtasks.exe
4788	schtasks.exe
2884	schtasks.exe
3288	schtasks.exe
1528	schtasks.exe
4808	schtasks.exe
5240	schtasks.exe
4836	schtasks.exe
4964	schtasks.exe
4332	schtasks.exe
5048	schtasks.exe
5396	schtasks.exe
936	schtasks.exe
4956	schtasks.exe
5528	schtasks.exe
3040	schtasks.exe
5012	schtasks.exe
2248	schtasks.exe
3704	schtasks.exe
3284	schtasks.exe
5040	schtasks.exe
5044	schtasks.exe
3608	schtasks.exe
4768	schtasks.exe
4904	schtasks.exe
4920	schtasks.exe
4648	schtasks.exe
2680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
4024	f926cc363c27c542c23e14398096eda8.exe
5708	powershell.exe
5708	powershell.exe
4488	powershell.exe
4488	powershell.exe
3364	powershell.exe
3364	powershell.exe
5436	powershell.exe
5436	powershell.exe
5720	powershell.exe
5720	powershell.exe
3208	powershell.exe
3208	powershell.exe
5516	powershell.exe
5516	powershell.exe
2860	powershell.exe
2860	powershell.exe
232	powershell.exe
232	powershell.exe
5840	powershell.exe
5840	powershell.exe
4228	powershell.exe
4228	powershell.exe
1148	powershell.exe
1148	powershell.exe
1456	powershell.exe
1456	powershell.exe
3296	powershell.exe
3296	powershell.exe
1700	powershell.exe
5172	powershell.exe
1700	powershell.exe
5172	powershell.exe
5608	powershell.exe
5608	powershell.exe
5356	powershell.exe
2760	powershell.exe
2760	powershell.exe
5356	powershell.exe
1904	powershell.exe
1904	powershell.exe
3364	powershell.exe
3364	powershell.exe
4488	powershell.exe
4488	powershell.exe
5708	powershell.exe
5708	powershell.exe
5720	powershell.exe
5720	powershell.exe
5436	powershell.exe
5436	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	f926cc363c27c542c23e14398096eda8.exe
Token: SeDebugPrivilege	5708	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	5436	powershell.exe
Token: SeDebugPrivilege	5720	powershell.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	5516	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	5608	powershell.exe
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	2812	SppExtComObj.exe
Token: SeIncreaseQuotaPrivilege	3364	powershell.exe
Token: SeSecurityPrivilege	3364	powershell.exe
Token: SeTakeOwnershipPrivilege	3364	powershell.exe
Token: SeLoadDriverPrivilege	3364	powershell.exe
Token: SeSystemProfilePrivilege	3364	powershell.exe
Token: SeSystemtimePrivilege	3364	powershell.exe
Token: SeProfSingleProcessPrivilege	3364	powershell.exe
Token: SeIncBasePriorityPrivilege	3364	powershell.exe
Token: SeCreatePagefilePrivilege	3364	powershell.exe
Token: SeBackupPrivilege	3364	powershell.exe
Token: SeRestorePrivilege	3364	powershell.exe
Token: SeShutdownPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeSystemEnvironmentPrivilege	3364	powershell.exe
Token: SeRemoteShutdownPrivilege	3364	powershell.exe
Token: SeUndockPrivilege	3364	powershell.exe
Token: SeManageVolumePrivilege	3364	powershell.exe
Token: 33	3364	powershell.exe
Token: 34	3364	powershell.exe
Token: 35	3364	powershell.exe
Token: 36	3364	powershell.exe
Token: SeIncreaseQuotaPrivilege	5708	powershell.exe
Token: SeSecurityPrivilege	5708	powershell.exe
Token: SeTakeOwnershipPrivilege	5708	powershell.exe
Token: SeLoadDriverPrivilege	5708	powershell.exe
Token: SeSystemProfilePrivilege	5708	powershell.exe
Token: SeSystemtimePrivilege	5708	powershell.exe
Token: SeProfSingleProcessPrivilege	5708	powershell.exe
Token: SeIncBasePriorityPrivilege	5708	powershell.exe
Token: SeCreatePagefilePrivilege	5708	powershell.exe
Token: SeBackupPrivilege	5708	powershell.exe
Token: SeRestorePrivilege	5708	powershell.exe
Token: SeShutdownPrivilege	5708	powershell.exe
Token: SeDebugPrivilege	5708	powershell.exe
Token: SeSystemEnvironmentPrivilege	5708	powershell.exe
Token: SeRemoteShutdownPrivilege	5708	powershell.exe
Token: SeUndockPrivilege	5708	powershell.exe
Token: SeManageVolumePrivilege	5708	powershell.exe
Token: 33	5708	powershell.exe
Token: 34	5708	powershell.exe
Token: 35	5708	powershell.exe
Token: 36	5708	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 5516	4024	f926cc363c27c542c23e14398096eda8.exe	139
PID 4024 wrote to memory of 5516	4024	f926cc363c27c542c23e14398096eda8.exe	139
PID 4024 wrote to memory of 5708	4024	f926cc363c27c542c23e14398096eda8.exe	140
PID 4024 wrote to memory of 5708	4024	f926cc363c27c542c23e14398096eda8.exe	140
PID 4024 wrote to memory of 3364	4024	f926cc363c27c542c23e14398096eda8.exe	141
PID 4024 wrote to memory of 3364	4024	f926cc363c27c542c23e14398096eda8.exe	141
PID 4024 wrote to memory of 5720	4024	f926cc363c27c542c23e14398096eda8.exe	142
PID 4024 wrote to memory of 5720	4024	f926cc363c27c542c23e14398096eda8.exe	142
PID 4024 wrote to memory of 3208	4024	f926cc363c27c542c23e14398096eda8.exe	144
PID 4024 wrote to memory of 3208	4024	f926cc363c27c542c23e14398096eda8.exe	144
PID 4024 wrote to memory of 2860	4024	f926cc363c27c542c23e14398096eda8.exe	145
PID 4024 wrote to memory of 2860	4024	f926cc363c27c542c23e14398096eda8.exe	145
PID 4024 wrote to memory of 5436	4024	f926cc363c27c542c23e14398096eda8.exe	147
PID 4024 wrote to memory of 5436	4024	f926cc363c27c542c23e14398096eda8.exe	147
PID 4024 wrote to memory of 5172	4024	f926cc363c27c542c23e14398096eda8.exe	148
PID 4024 wrote to memory of 5172	4024	f926cc363c27c542c23e14398096eda8.exe	148
PID 4024 wrote to memory of 5356	4024	f926cc363c27c542c23e14398096eda8.exe	149
PID 4024 wrote to memory of 5356	4024	f926cc363c27c542c23e14398096eda8.exe	149
PID 4024 wrote to memory of 4488	4024	f926cc363c27c542c23e14398096eda8.exe	150
PID 4024 wrote to memory of 4488	4024	f926cc363c27c542c23e14398096eda8.exe	150
PID 4024 wrote to memory of 3296	4024	f926cc363c27c542c23e14398096eda8.exe	151
PID 4024 wrote to memory of 3296	4024	f926cc363c27c542c23e14398096eda8.exe	151
PID 4024 wrote to memory of 1700	4024	f926cc363c27c542c23e14398096eda8.exe	153
PID 4024 wrote to memory of 1700	4024	f926cc363c27c542c23e14398096eda8.exe	153
PID 4024 wrote to memory of 2760	4024	f926cc363c27c542c23e14398096eda8.exe	154
PID 4024 wrote to memory of 2760	4024	f926cc363c27c542c23e14398096eda8.exe	154
PID 4024 wrote to memory of 1148	4024	f926cc363c27c542c23e14398096eda8.exe	156
PID 4024 wrote to memory of 1148	4024	f926cc363c27c542c23e14398096eda8.exe	156
PID 4024 wrote to memory of 1904	4024	f926cc363c27c542c23e14398096eda8.exe	157
PID 4024 wrote to memory of 1904	4024	f926cc363c27c542c23e14398096eda8.exe	157
PID 4024 wrote to memory of 5840	4024	f926cc363c27c542c23e14398096eda8.exe	158
PID 4024 wrote to memory of 5840	4024	f926cc363c27c542c23e14398096eda8.exe	158
PID 4024 wrote to memory of 232	4024	f926cc363c27c542c23e14398096eda8.exe	159
PID 4024 wrote to memory of 232	4024	f926cc363c27c542c23e14398096eda8.exe	159
PID 4024 wrote to memory of 1456	4024	f926cc363c27c542c23e14398096eda8.exe	160
PID 4024 wrote to memory of 1456	4024	f926cc363c27c542c23e14398096eda8.exe	160
PID 4024 wrote to memory of 5608	4024	f926cc363c27c542c23e14398096eda8.exe	162
PID 4024 wrote to memory of 5608	4024	f926cc363c27c542c23e14398096eda8.exe	162
PID 4024 wrote to memory of 4228	4024	f926cc363c27c542c23e14398096eda8.exe	163
PID 4024 wrote to memory of 4228	4024	f926cc363c27c542c23e14398096eda8.exe	163
PID 4024 wrote to memory of 2812	4024	f926cc363c27c542c23e14398096eda8.exe	179
PID 4024 wrote to memory of 2812	4024	f926cc363c27c542c23e14398096eda8.exe	179
PID 2812 wrote to memory of 5220	2812	SppExtComObj.exe	181
PID 2812 wrote to memory of 5220	2812	SppExtComObj.exe	181
PID 2812 wrote to memory of 1608	2812	SppExtComObj.exe	182
PID 2812 wrote to memory of 1608	2812	SppExtComObj.exe	182
PID 5220 wrote to memory of 1512	5220	WScript.exe	184
PID 5220 wrote to memory of 1512	5220	WScript.exe	184
PID 1512 wrote to memory of 416	1512	SppExtComObj.exe	185
PID 1512 wrote to memory of 416	1512	SppExtComObj.exe	185
PID 1512 wrote to memory of 2804	1512	SppExtComObj.exe	186
PID 1512 wrote to memory of 2804	1512	SppExtComObj.exe	186
PID 416 wrote to memory of 3040	416	WScript.exe	187
PID 416 wrote to memory of 3040	416	WScript.exe	187
PID 3040 wrote to memory of 5072	3040	SppExtComObj.exe	188
PID 3040 wrote to memory of 5072	3040	SppExtComObj.exe	188
PID 3040 wrote to memory of 4008	3040	SppExtComObj.exe	189
PID 3040 wrote to memory of 4008	3040	SppExtComObj.exe	189
PID 5072 wrote to memory of 4136	5072	WScript.exe	190
PID 5072 wrote to memory of 4136	5072	WScript.exe	190
PID 4136 wrote to memory of 468	4136	SppExtComObj.exe	191
PID 4136 wrote to memory of 468	4136	SppExtComObj.exe	191
PID 4136 wrote to memory of 4260	4136	SppExtComObj.exe	192
PID 4136 wrote to memory of 4260	4136	SppExtComObj.exe	192

System policy modification 1 TTPs 30 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f926cc363c27c542c23e14398096eda8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	f926cc363c27c542c23e14398096eda8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	f926cc363c27c542c23e14398096eda8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SppExtComObj.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f926cc363c27c542c23e14398096eda8.exe
"C:\Users\Admin\AppData\Local\Temp\f926cc363c27c542c23e14398096eda8.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\f926cc363c27c542c23e14398096eda8.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\uk-UA\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\cd2be074b6f9ceb7c82a5635e25f\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad\attachments\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\cd2be074b6f9ceb7c82a5635e25f\SppExtComObj.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\cd2be074b6f9ceb7c82a5635e25f\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\cd2be074b6f9ceb7c82a5635e25f\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\SetupMetrics\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\en-US\TextInputHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Cookies\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\7819bb69b3861a95b3\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- C:\Recovery\WindowsRE\SppExtComObj.exe
  "C:\Recovery\WindowsRE\SppExtComObj.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2812
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52ab0649-8607-4c11-9c88-a7268ca3c2d3.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Recovery\WindowsRE\SppExtComObj.exe
      C:\Recovery\WindowsRE\SppExtComObj.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1512
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91a1d3ef-c33c-47cb-8106-b0571940b4ee.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:416
      - C:\Recovery\WindowsRE\SppExtComObj.exe
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ea80869-d2a2-4645-b510-75e3f635143b.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4136
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1390656c-57cb-400d-98c5-204ffc8b8df7.vbs"
        9⤵
        
        PID:468
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        System policy modification
        
        PID:3904
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61f85115-f19a-442a-aafb-981c6ecbe314.vbs"
        11⤵
        
        PID:4612
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        System policy modification
        
        PID:640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08cb5c83-1bf8-4e62-8778-116d5130ce11.vbs"
        13⤵
        
        PID:4572
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        14⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        System policy modification
        
        PID:1820
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a945b95-32da-495b-ace1-7e020ea81a55.vbs"
        15⤵
        
        PID:2468
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        16⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        System policy modification
        
        PID:5304
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9aea9fad-8c2c-45e2-ab47-e3c4bec424cc.vbs"
        17⤵
        
        PID:5092
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        
        C:\Recovery\WindowsRE\SppExtComObj.exe
        18⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        System policy modification
        
        PID:2328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf715b25-4dbd-4a0d-b3a5-6ee81a4a0c01.vbs"
        19⤵
        
        PID:320
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a96b02a-602f-40d8-966f-edd597e520be.vbs"
        19⤵
        
        PID:4440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08e0421a-e501-4b1d-838f-30bfadc0e02c.vbs"
        17⤵
        
        PID:4788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eec5031d-e9e9-4270-b3f5-d5bd599de1e2.vbs"
        15⤵
        
        PID:3400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ff41f87-c83c-45fd-8c3c-b8f1303f95ac.vbs"
        13⤵
        
        PID:5232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9188b2da-5225-486a-9d18-e05df5f35055.vbs"
        11⤵
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7823d0b1-cca9-4256-bee8-c0032a527a3a.vbs"
        9⤵
        
        PID:4260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31ae35fa-3113-49ab-97ea-5229b94b0e0a.vbs"
        7⤵
        
        PID:4008
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b43811b5-b963-4ce1-bed3-0936b791b610.vbs"
        5⤵
        
        PID:2804
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e736782-68cf-47a5-871c-565ce89ee22d.vbs"
    3⤵
    PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\uk-UA\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\uk-UA\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\uk-UA\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad\attachments\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad\attachments\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad\attachments\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\WTR\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\Migration\WTR\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\cd2be074b6f9ceb7c82a5635e25f\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Templates\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\en-US\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\en-US\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Cookies\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Cookies\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\7819bb69b3861a95b3\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\7819bb69b3861a95b3\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\7819bb69b3861a95b3\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\7819bb69b3861a95b3\sppsvc.exe

Filesize
1.9MB

MD5
99cfd51f0a2d9739763daac9f6b247a6

SHA1
876f4f50d3b568ad75cef3bc1507d5c0be57b365

SHA256
9e41dbe181cb9bfe6e53bf9687a23e7e7e55012908128d56170634efb52869cf

SHA512
694e0bcd4a4b94e26100123171b0016ccbd93cf272b85ae2ad4b99da3ddc2b54ef0cdfe3d59f8fe0675e455768868f8f173bd96b0f3c5b82ceaea8f360dd51b9

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad\attachments\taskhostw.exe

Filesize
1.9MB

MD5
7304931989fc836c9aa255f5e6861618

SHA1
b248b6f6a374274fcd11fcefa5927bc4ac2ff143

SHA256
e0bdd5bb90e5d1f9206155068f1f90470c640f7175a59d6c180b35abfaedbc98

SHA512
8b4c3b8b898fc2e98f3ccd217286bcac2047e966818dc05744f9a3527e0dd56a59ffde16ca43056571ad2baa25bbc1ac05bfcb7febf89bb9983b371bb64519a5

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\lsass.exe

Filesize
1.9MB

MD5
9a34f2e45325b4a6d068ff642cd2913a

SHA1
e4010759d3145774de3af808271c05c1ed06f57c

SHA256
1bcb96132b30b050c159c34908b38b0df4da5ce4c8c8995a6357519322ea2d1e

SHA512
f45fa27a62c2e48375428ff9300d656dd9264902cb9f5d23eec872de5aab517dcf2b82984112377002348d9d20e2db055491725e13161b2d07c01f77a5bae112

Download Submit
C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe

Filesize
1.9MB

MD5
1725cbca7445aa832e18398076a2727e

SHA1
b76561562b9830dd60ef6e73b86a3f87290111ef

SHA256
d922cddc91789a1fae09530c0333279ebd0f0c48a97f0ad8d6a08e195273761a

SHA512
b4f9826fbd11fca57bbd5012a9231a99fd2c454d61107c6c3cfe14488400d444d49ae39d3f4aac05a738e0b78b5be4047955e83fd1c963e77d8b1c129bb91351

Download Submit
C:\Program Files\Windows Defender\en-US\TextInputHost.exe

Filesize
1.9MB

MD5
b3689ccc9cb2d0e34309d01990104fbe

SHA1
8267f332a1669eb4ed94191454baa6bd97f4f652

SHA256
d591426075095a867b1248e314dd0a534a4c5f1cfb65b0137777d33651506af9

SHA512
039e927235712eea01ef2f80b29e2348e961096e13178c5f04f0f5e2055cafdc9e77e2875925c2b88dff83a9cd2fc54116795f3dbb2e5f64c1658367bf659636

Download Submit
C:\ProgramData\Microsoft\Windows\Templates\dllhost.exe

Filesize
1.9MB

MD5
130533f8a03a0831d1a19c5a8cf8881b

SHA1
18d0fc2e4c20eaae4965c43926b15f8b5109f585

SHA256
5dc5391a8716a3976dd46c35ba8693440aba8bcfb60b33d9672134d4d8f866ad

SHA512
9ef971649ed77bb810e1f5b7d429b7f0681061d7ab65cbcf5c223851b1e477fd0086ad30317dc038be72117f9f377165d63053a3f8c56f183b01e2daea8d0b34

Download Submit
C:\Recovery\WindowsRE\SppExtComObj.exe

Filesize
1.9MB

MD5
979bb03fd1b7d2e2ddc3e6bfe752ef65

SHA1
cb3fcc2ab64a7e0e1747b752bf95e514e4681f1d

SHA256
685bcfe925ce597703f94aca55cc9bd5c341f978698957a9e790f2341dcfe61a

SHA512
2f2c3bbe99ab851317d2faeaea5d8cf82b3a5897aa07fb9b4f9a63d52962975ba21f9b8629e78e3f84a8f073a0f286c5dc73dd60ef9f4c7d62ff58b961a36f6d

Download Submit
C:\Recovery\WindowsRE\unsecapp.exe

Filesize
1.9MB

MD5
2ce2853f838306357067847dfa291631

SHA1
e5b7e7e8eafece9e2994a697432a5bb45d1fd6c2

SHA256
04bf122c67da3de8377778e15dac3700532cdbd903bd6dc2298af840c11e1005

SHA512
134e059b807c673ccb53e8c49e34b9f3c2ef8a3a345772cdd66cf0bca0efc50b462c8aa219b45f8c56d45482da6a662091b461c19d1f745151471366fa01914f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SppExtComObj.exe.log

Filesize
1KB

MD5
9cdc082abcfcf189c301172f429a95b6

SHA1
2b48360ba5b8cfb5e9b5dcaa168b037a2d2583fe

SHA256
35a6bd50fcb3680da7bf82e91e10db63005483cd55fc33fa017363fe3444256f

SHA512
157febdd860dd528eb8044f4558197240ed68b74d8a7e99f0324ea8d6b5a5ea867068029f316f1affe478f35f7609bac9aba44e322691855ffa44daf9abb5f6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c8d27f6f0df449bebaad5cb89ff8de95

SHA1
1b49a8fbfa00496dcbf25261194fb0cfe6e6f066

SHA256
7be529c33f6c4986b68c0664edeb9c957b0726eec5cc80ca92ca5d4b457a9bea

SHA512
d84d9df8a21d1061a6673bb42d4303ba5f5d8bebcaf2cf93587574ea02b74369579c52e539b1cd4f09082a06c9b1bc85c0623d560528d0bcb5524c44d389252e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
63971d511e1eab7749438a109f664080

SHA1
cb9f67017a936cec4446a5f1ee095f7c77eb94e5

SHA256
a7bb2ed5d318399afbc9fe15f96b5af7a593da7a8f8a409891dea21b5dc92151

SHA512
7638e9237153d2f33f93aa2e2d7f203351cd9b751f64c1e9b9a0fd4bf5ae58cbea4a624ece54bdaef409d9073c876836ff91ca6c8957c35d619a04c4d68773a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3ed64f1321577f6035aa9d014b59812e

SHA1
c63d4582766d7a3cbf82fab114bf6dac63e2cf03

SHA256
77035b90b47e344221e2ab749d929106bd9333ec6edb501c04bfcf19227a58db

SHA512
f0c283039815c5a30dfff21a9e510c276d0dc735f9082c7361630955386eef94f094e8b68d1c649b4ec5d67813095fb1fadc743cf1821fea642d5f959d8e6efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a7e4fa03fecd07af94d6e5e643466561

SHA1
e4aee30f57972306c32b761632a05b66569fd415

SHA256
b5dab891147313dca0e7151792164000fdc5b9c5b2bf8d5c1d76a2ae01560f05

SHA512
a87fb2aba77f74f0c7586b4d97f616fd3e4443681643d1ed8142e21f12582c52e9dbd5e891d7686b1ab3586b1072257b998b2885b8740a652d10b920bda1e6ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6a2f2df2306ca3d9775dfa18d8d5b8a3

SHA1
ee7038ebc2bac1216e16e0677a8a67292efe480c

SHA256
907060371ddcaa49b29bc9daf30d33e51798df5525bfce06d741391d5c4d2fe5

SHA512
0c3875b8cbdac33dc9249a3a4810b0e794a4feeb88e79a5dd5456bae37de37b9d630781f601ad30a25d41e68f31ad75de7dd9715a3bcb65e896a679ff5771ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b2983a42cb722a1c3b53797ecc690137

SHA1
191a4013e3d40a7db0b3aa15f77f27bcc07fcffb

SHA256
77412ecc476de96d9c82c557f3476be7f444c577e77eb93998013c7108923f4f

SHA512
1c6a87d6537a16d62cfd9c78f94b68969193ba204d7a7146435ad9e08f4b9398dd9954788e3a0405fe6fb224e114640f43382ca02d8cb7223aa497a9ee46da00

Download Submit
C:\Users\Admin\AppData\Local\Temp\08cb5c83-1bf8-4e62-8778-116d5130ce11.vbs

Filesize
713B

MD5
e93c0e026ab0ad49993303c0703f1280

SHA1
cfcf5d41bba20ea0f853321c1105f46c6888e0f4

SHA256
1570dfe5785a50916bf8ae05d8bd7d68e7a0ce0bfd934221847867bc0d7a7621

SHA512
698c85a1bf678486f7ccc5c36550e803c39455e387752bc4407f02f4f70691a0b852c63f6315c27bbf8dc842a048c81eda176d6526877ff9b5fb2e62c952ba5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1390656c-57cb-400d-98c5-204ffc8b8df7.vbs

Filesize
714B

MD5
3052c24f02948403addaa8d4769964b8

SHA1
6a6988f2804cd53a3a6ba29df7654b65e07a02a3

SHA256
606ff952fc319f8cef514b1d2ccb4abe438f5195f9990c491b6a6f16ec870c58

SHA512
ec2b1e22a358c4df7ab733c772ee655a0fb1c750088c0622bb71408b26b1d32c1bc69f45b57a516a5faeea010ecdd409f910523e7f62a8795735223e0099476a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1ea80869-d2a2-4645-b510-75e3f635143b.vbs

Filesize
714B

MD5
c5046eabc69f9129624fb81981f5f352

SHA1
44a00351ebd560f6176e7aebf30dc8d2aebd0d6c

SHA256
cf23602defae987b5ab9c7e486d754aae17eb47873d030e297f7ce1dbd374279

SHA512
352104671fe5391f0585e1161028d2c2ce885b271343afd10b830c6e2ad2635cd8b0e8d68d8c5f4bde78be042b59df7dd8958ebc6a06b4875bafe89c002374b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\52ab0649-8607-4c11-9c88-a7268ca3c2d3.vbs

Filesize
714B

MD5
0d9a28bc5123f59eaef072c4566236f7

SHA1
574a1006e6e2e023ae3329f2a0276de0eef55c14

SHA256
3b5650890599786611de206ead64955624d3d18a95bb3cc48f855f4ca90d9f5e

SHA512
e19e24c9f8da4ce29029ec5ccaa65aa7a0a247c7cf73057f9c00eed9aaf2d739a8a861ceb3173f7d46fd3473243fc5972bd7d96977ba0354ec760796db332ee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\61f85115-f19a-442a-aafb-981c6ecbe314.vbs

Filesize
714B

MD5
d6f0d62926eef2acc88a42724f2dac90

SHA1
e4c600d0ae5f802ac241003e8fb309219c58d815

SHA256
b2942c2bf6218be3b2a77b336d6f79c01e73c2ae475c947cacdba0b23fafc0aa

SHA512
a90655285f5141c266f0f358631fc4e4c3ea723544f26a9e658ddb53cd19a241d0c2ddc9b5bedaff5eeb8b5152c1cda4fd029996b4f558a5ebda34a5bb1fa51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7e736782-68cf-47a5-871c-565ce89ee22d.vbs

Filesize
490B

MD5
dd7331a98c0145d00fae21dfbf4beeba

SHA1
3211d06f95d9b2d1ecf1c08bffbf5c57c6f203ec

SHA256
496806e1a29815952b60d73b2e0fbed18e524d89091faa53021a688e4bd22f2e

SHA512
758922cee3aba259027c7e6462b003abf28f618e1203c994c82c53f74a0fd7b56521966bc634cf9bd0adeffa2437f3dd1546b31aa19a3145a7c08a156732c121

Download Submit
C:\Users\Admin\AppData\Local\Temp\91a1d3ef-c33c-47cb-8106-b0571940b4ee.vbs

Filesize
714B

MD5
1c0f80fcb5f4358330fddf732b5ecf05

SHA1
09917f961a64ce74d97e52ec851455e950dbedb2

SHA256
2e92f4bb042c9638ec888aab4f4ac9ab6f8eedaaefe0f5923c6e336eac08d673

SHA512
cb29a33bd20b92fd1e8470a1e77f0a544b128289bbe34a6945d1d235ad6e95ba05201a986e90e231eddc0d8f9c52376f51089cccda71773f5d45fa1c84f8687a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9a945b95-32da-495b-ace1-7e020ea81a55.vbs

Filesize
714B

MD5
43657103a0f336dd160717ab808a849b

SHA1
b4191e6e8c47b19ae546cee4eddbbec788fafbe4

SHA256
ade67df29cbea4bd86b06971b93d293b23d169c5a0358f027abd16e0116a576f

SHA512
5d42f1d653eca6ac5a16cf311fa58f3f8602d206a29fcba6ee71b91fb5147d976b5b176535b7b2e19df52c453f0a694dcb6ca3c0d59d19d48c4c7f727ab0314d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9aea9fad-8c2c-45e2-ab47-e3c4bec424cc.vbs

Filesize
714B

MD5
815a32e3e1eb44eebb0349f98ee14d1f

SHA1
a63666af69138b73ccd704d7e155992f98c79322

SHA256
ced5b0a1fd8c36431dc7517be3daf159018d527c3adac7f7a0bccc7e199d35d7

SHA512
bae66a7024d7c973f9b583d8f95fa193839b9e12c8fbce62ae122c6819b795a635cd10b5251b854f1ebde86840ea9052eb283231fd3e6a36c746d21ba2b16416

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c2ninagf.0tb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cf715b25-4dbd-4a0d-b3a5-6ee81a4a0c01.vbs

Filesize
714B

MD5
7bf489d0c7ba8ac763e2f88ae410bed3

SHA1
2b8adfc4ca7f2a8618d64863edf01145242b0ff9

SHA256
db09a38e398bf08b32610b418084790eb0a7a91286c8e92c00dee088f95979ef

SHA512
aa1af461409130c24ba4f63f0f69b0ee08c15c460982a5cac43c363a2b9a1cd6ab1902cb9671cce9fe4bfdcd63ba39cd0eda06229b73fa0a2ead3292b63059fb

Download Submit
C:\Users\Default\smss.exe

Filesize
1.9MB

MD5
7af1ef0b84d3c368eed3986ce40ca1a6

SHA1
e33f2f04d14d60a22e1818136610193cd37c723d

SHA256
26af5b6c67fa3ac28084ef8d751525d6ba96bf204640411f3a8816bc3f019798

SHA512
d8585e1b6494445dba14f4c719323d341d9d6b767e7858ab371cf15cf7bd0230cca0bb2f49159a2ea7b13cf16c5d2d1ed06f6e1aee7887e5463851bb621eb738

Download Submit
C:\Windows\es-ES\dwm.exe

Filesize
1.9MB

MD5
f1ed3ac418c73edc3655d2834f1e200a

SHA1
576d16ef701d786d0e6378cd632c61ae3cd1760d

SHA256
51dde559e81375c2fae98427d9b65695a74695e7e2965e9b602261a4bfe0dfb3

SHA512
ae6dda73aca41867154a776055135a9159fc8f4e318cba9491d33b7d20f286081523528eb570d79e070b0f7d372a3fe5450f96c97eb70dd20a7426ffb4464fdb

Download Submit
C:\Windows\uk-UA\csrss.exe

Filesize
1.9MB

MD5
48dd6f4fc24e9129fd35e01330ed19d2

SHA1
cc866948b396613888aa68cb587eb531c7293c7b

SHA256
63b330661f8bc79dfc9eb975ee01f69c57ceecb6a73d892881440c8901d65af8

SHA512
d4519cce300eff59a322fec6833f921c90142038f0656428312f5144994c4dc7a9de29548ed86337f43583d40f30354b24885e82ee89097c86dc28ebd530658a

Download Submit
C:\cd2be074b6f9ceb7c82a5635e25f\Registry.exe

Filesize
1.9MB

MD5
658644c1b4adcaeb5851ba784160bca0

SHA1
7f4df2cafadc4dea10998497eb5a61e44aaa8c2b

SHA256
32e0ac624a25c00cae93bcc51f59903288e78b79d741f86120b7277e8a88c284

SHA512
5e208e9b6b4817fa4fe4f86ec8318d1905bacc97366eb801d02dd401e1cc7b88b306c280b4783ced38f356c1d5d0bdb499dea12cd5a490fdde3161d60568bd1d

Download Submit
C:\cd2be074b6f9ceb7c82a5635e25f\SppExtComObj.exe

Filesize
1.9MB

MD5
2146a704f4fc91145ee1772a1d43556b

SHA1
055e5455904d75cb1bd874c747760bc1faee16e5

SHA256
b493df345d1b64603c5e15bad862f1ec5553b45fd459af6e50baab07afc44990

SHA512
9be3fb7c4a183f709983e88280283df55db1cd658ab678261fe77ccc287f02b60b0a85452a624e294448c250c5be72d6726327a13c89ecb406c1a5064dafaa5f

Download Submit
C:\cd2be074b6f9ceb7c82a5635e25f\csrss.exe

Filesize
1.9MB

MD5
627b4a1d2a64786f7d5181350a547118

SHA1
5981869194db50992aa838e06d9ce4f942a089b4

SHA256
a1fbc898f580515fef3051ad3e116c73c0924840437d1141a0f5e0f936a1e14c

SHA512
2dc1e3ba050eb5d8372e6e5c9f1c86128c6181b63c7ca113bda834f6bafb7666e5ef979a5a62baf75d26e4231cbfc3be66a7cfb99bb54ceda7b5ea77efbc8809

Download Submit
C:\cd2be074b6f9ceb7c82a5635e25f\sppsvc.exe

Filesize
1.9MB

MD5
ae9eaa21919f6160b462f7ea583c3365

SHA1
2a85a814ceb2e116acb2be6ee78bf70fc4c5d856

SHA256
83e18d902c75b478fe381409e94aa608d8e88483692273ce021c6e7466dc0a1e

SHA512
e4ca00338bc141d7bb05c76dd17235fc323b31df1226aefeded13630512339907ac023555ec9fb61b5536dd64b5f05c20b25325cd0987ca5178aae096ef25321

Download Submit
memory/640-558-0x000000001B8F0000-0x000000001B946000-memory.dmp

Filesize
344KB

Download
memory/1512-494-0x000000001BB10000-0x000000001BB66000-memory.dmp

Filesize
344KB

Download
memory/1820-574-0x000000001B1D0000-0x000000001B1E2000-memory.dmp

Filesize
72KB

Download
memory/2812-443-0x000000001B470000-0x000000001B482000-memory.dmp

Filesize
72KB

Download
memory/2812-441-0x00000000000F0000-0x00000000002DA000-memory.dmp

Filesize
1.9MB

Download
memory/3040-510-0x000000001B970000-0x000000001B982000-memory.dmp

Filesize
72KB

Download
memory/3904-542-0x0000000002C50000-0x0000000002C62000-memory.dmp

Filesize
72KB

Download
memory/3904-541-0x000000001B6B0000-0x000000001B706000-memory.dmp

Filesize
344KB

Download
memory/4024-18-0x000000001B550000-0x000000001B558000-memory.dmp

Filesize
32KB

Download
memory/4024-133-0x00007FFA02153000-0x00007FFA02155000-memory.dmp

Filesize
8KB

Download
memory/4024-15-0x000000001B4B0000-0x000000001B4BC000-memory.dmp

Filesize
48KB

Download
memory/4024-13-0x0000000002AA0000-0x0000000002AB2000-memory.dmp

Filesize
72KB

Download
memory/4024-9-0x0000000002A30000-0x0000000002A86000-memory.dmp

Filesize
344KB

Download
memory/4024-149-0x00007FFA02150000-0x00007FFA02C12000-memory.dmp

Filesize
10.8MB

Download
memory/4024-0-0x00007FFA02153000-0x00007FFA02155000-memory.dmp

Filesize
8KB

Download
memory/4024-6-0x00000000010F0000-0x0000000001100000-memory.dmp

Filesize
64KB

Download
memory/4024-2-0x00007FFA02150000-0x00007FFA02C12000-memory.dmp

Filesize
10.8MB

Download
memory/4024-1-0x0000000000570000-0x000000000075A000-memory.dmp

Filesize
1.9MB

Download
memory/4024-19-0x000000001B560000-0x000000001B56C000-memory.dmp

Filesize
48KB

Download
memory/4024-20-0x000000001B570000-0x000000001B57C000-memory.dmp

Filesize
48KB

Download
memory/4024-14-0x000000001C5D0000-0x000000001CAF8000-memory.dmp

Filesize
5.2MB

Download
memory/4024-17-0x000000001B540000-0x000000001B54E000-memory.dmp

Filesize
56KB

Download
memory/4024-3-0x00000000010C0000-0x00000000010DC000-memory.dmp

Filesize
112KB

Download
memory/4024-16-0x000000001B530000-0x000000001B53A000-memory.dmp

Filesize
40KB

Download
memory/4024-442-0x00007FFA02150000-0x00007FFA02C12000-memory.dmp

Filesize
10.8MB

Download
memory/4024-4-0x00000000029E0000-0x0000000002A30000-memory.dmp

Filesize
320KB

Download
memory/4024-5-0x00000000010E0000-0x00000000010E8000-memory.dmp

Filesize
32KB

Download
memory/4024-7-0x0000000001100000-0x0000000001116000-memory.dmp

Filesize
88KB

Download
memory/4024-8-0x0000000001120000-0x000000000112A000-memory.dmp

Filesize
40KB

Download
memory/4024-10-0x0000000002A80000-0x0000000002A8C000-memory.dmp

Filesize
48KB

Download
memory/4024-11-0x0000000002A90000-0x0000000002A98000-memory.dmp

Filesize
32KB

Download
memory/4488-252-0x00000182D4FA0000-0x00000182D4FC2000-memory.dmp

Filesize
136KB

Download