dcrat | 223733ec708531603b51bf10fc3126cb4dfd47f4aaada4a75acd168eb06b9d50

Analysis

user interaction
yes
max time kernel
899s
max time network
901s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 13:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hard serial number.exe
Size 1.1MB
Sample260504-rach3sds91
SHA256 223733ec708531603b51bf10fc3126cb4dfd47f4aaada4a75acd168eb06b9d50
MD5 208477a99dd021397a883960d0115c6d
SHA1 7695a822cf67d5e8ea1a6a87e7a06dcef0548ee5
SHA512 e2737e49078db1e600bcccbac0f2aaa5aaf07349116294e58e4c91366c547d2639233feae61f84b6f049d761372da13ade40686db16222eeef36572a4ad5f399
SSDEEP 24576:U2G/nvxW3Ww0twMQNrHBXYjVzxYxEbtyXAjo7dcCHBPR2mpfmN:UbA30PQQV2XAUrR3fe
TLSH
T12D454A017E84CA12F0192633C2FF490847B8AC516BA6E71B7EBA376D55123937D1CADB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000024486-14.dat	dcrat
behavioral1/memory/1540-16-0x0000000000150000-0x0000000000226000-memory.dmp	dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5472	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5460	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5216	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5588	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5668	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5556	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5296	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4244	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5324	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5284	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6136	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5952	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5968	4640	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	4640	schtasks.exe	88

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	Hard serial number.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	chaincommonitor.exe

Executes dropped EXE 35 IoCs

pid	Process
1540	chaincommonitor.exe
5004	WmiPrvSE.exe
3672	lsass.exe
1824	wininit.exe
1856	csrss.exe
3812	fontdrvhost.exe
1732	TrustedInstaller.exe
1248	cmd.exe
6020	TextInputHost.exe
4800	WUDFHost.exe
4480	Idle.exe
6008	Idle.exe
1800	RuntimeBroker.exe
4128	WaaSMedicAgent.exe
1008	conhost.exe
1112	wininit.exe
4228	TrustedInstaller.exe
4844	lsass.exe
2308	TextInputHost.exe
4380	lsass.exe
4820	cmd.exe
2172	csrss.exe
4208	WUDFHost.exe
3288	TextInputHost.exe
5896	Idle.exe
4868	RuntimeBroker.exe
3024	WmiPrvSE.exe
4496	wininit.exe
544	WaaSMedicAgent.exe
3092	fontdrvhost.exe
5760	cmd.exe
416	conhost.exe
5696	WUDFHost.exe
5812	lsass.exe
4476	TrustedInstaller.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	ipinfo.io
40	ipinfo.io

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\uninstall\04c1e7795967e4	chaincommonitor.exe
File created	C:\Program Files\edge_BITS_4676_1957165190\WUDFHost.exe	chaincommonitor.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\9e8d7a4ca61bd9	chaincommonitor.exe
File created	C:\Program Files (x86)\Adobe\04c1e7795967e4	chaincommonitor.exe
File created	C:\Program Files\Windows Mail\TextInputHost.exe	chaincommonitor.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe	chaincommonitor.exe
File created	C:\Program Files\edge_BITS_4676_1957165190\480b7989c529f6	chaincommonitor.exe
File created	C:\Program Files (x86)\Windows NT\6203df4a6bafc7	chaincommonitor.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\lsass.exe	chaincommonitor.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\TrustedInstaller.exe	chaincommonitor.exe
File created	C:\Program Files\edge_BITS_4256_1511981484\csrss.exe	chaincommonitor.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\5b884080fd4f94	chaincommonitor.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe	chaincommonitor.exe
File created	C:\Program Files (x86)\Adobe\TrustedInstaller.exe	chaincommonitor.exe
File created	C:\Program Files (x86)\Windows NT\lsass.exe	chaincommonitor.exe
File opened for modification	C:\Program Files (x86)\Windows NT\lsass.exe	chaincommonitor.exe
File created	C:\Program Files\edge_BITS_4336_506886496\ebf1f9fa8afd6d	chaincommonitor.exe
File created	C:\Program Files\edge_BITS_4256_1511981484\886983d96e3d3e	chaincommonitor.exe
File created	C:\Program Files\Windows Mail\22eafd247d37c3	chaincommonitor.exe
File created	C:\Program Files\edge_BITS_4336_506886496\cmd.exe	chaincommonitor.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System\Speech\RuntimeBroker.exe	chaincommonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hard serial number.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	Hard serial number.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	chaincommonitor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2524	schtasks.exe
5104	schtasks.exe
2460	schtasks.exe
5556	schtasks.exe
1396	schtasks.exe
1048	schtasks.exe
5284	schtasks.exe
4304	schtasks.exe
4688	schtasks.exe
5588	schtasks.exe
3124	schtasks.exe
4244	schtasks.exe
3876	schtasks.exe
404	schtasks.exe
396	schtasks.exe
4776	schtasks.exe
1812	schtasks.exe
5296	schtasks.exe
2140	schtasks.exe
2092	schtasks.exe
4836	schtasks.exe
4924	schtasks.exe
664	schtasks.exe
1288	schtasks.exe
4128	schtasks.exe
5324	schtasks.exe
3636	schtasks.exe
3248	schtasks.exe
2376	schtasks.exe
1568	schtasks.exe
4452	schtasks.exe
3860	schtasks.exe
2104	schtasks.exe
4052	schtasks.exe
5216	schtasks.exe
1988	schtasks.exe
1628	schtasks.exe
4820	schtasks.exe
1032	schtasks.exe
1216	schtasks.exe
1052	schtasks.exe
2464	schtasks.exe
2136	schtasks.exe
1868	schtasks.exe
2528	schtasks.exe
5460	schtasks.exe
4264	schtasks.exe
2084	schtasks.exe
5952	schtasks.exe
5968	schtasks.exe
1768	schtasks.exe
5472	schtasks.exe
5668	schtasks.exe
4320	schtasks.exe
3800	schtasks.exe
3152	schtasks.exe
6136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
1540	chaincommonitor.exe
2172	csrss.exe
2172	csrss.exe
2172	csrss.exe
2172	csrss.exe
2172	csrss.exe
2172	csrss.exe
2172	csrss.exe
2172	csrss.exe
2172	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2172	csrss.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	chaincommonitor.exe
Token: SeDebugPrivilege	5004	WmiPrvSE.exe
Token: SeDebugPrivilege	1824	wininit.exe
Token: SeDebugPrivilege	3672	lsass.exe
Token: SeDebugPrivilege	3812	fontdrvhost.exe
Token: SeDebugPrivilege	1856	csrss.exe
Token: SeDebugPrivilege	1248	cmd.exe
Token: SeDebugPrivilege	1732	TrustedInstaller.exe
Token: SeDebugPrivilege	6020	TextInputHost.exe
Token: SeDebugPrivilege	4800	WUDFHost.exe
Token: SeDebugPrivilege	4480	Idle.exe
Token: SeDebugPrivilege	6008	Idle.exe
Token: SeDebugPrivilege	1800	RuntimeBroker.exe
Token: SeDebugPrivilege	1008	conhost.exe
Token: SeDebugPrivilege	4128	WaaSMedicAgent.exe
Token: SeDebugPrivilege	1112	wininit.exe
Token: SeDebugPrivilege	4228	TrustedInstaller.exe
Token: SeDebugPrivilege	4844	lsass.exe
Token: SeDebugPrivilege	4380	lsass.exe
Token: SeDebugPrivilege	2308	TextInputHost.exe
Token: SeDebugPrivilege	4820	cmd.exe
Token: SeDebugPrivilege	2172	csrss.exe
Token: SeDebugPrivilege	4208	WUDFHost.exe
Token: SeDebugPrivilege	5896	Idle.exe
Token: SeDebugPrivilege	3288	TextInputHost.exe
Token: SeDebugPrivilege	4868	RuntimeBroker.exe
Token: SeDebugPrivilege	3024	WmiPrvSE.exe
Token: SeDebugPrivilege	4496	wininit.exe
Token: SeDebugPrivilege	544	WaaSMedicAgent.exe
Token: SeDebugPrivilege	3092	fontdrvhost.exe
Token: SeDebugPrivilege	5760	cmd.exe
Token: SeDebugPrivilege	416	conhost.exe
Token: SeDebugPrivilege	5696	WUDFHost.exe
Token: SeDebugPrivilege	5812	lsass.exe
Token: SeDebugPrivilege	4476	TrustedInstaller.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4456	4676	Hard serial number.exe	84
PID 4456 wrote to memory of 5604	4456	WScript.exe	92
PID 5604 wrote to memory of 1540	5604	cmd.exe	94
PID 1540 wrote to memory of 1444	1540	chaincommonitor.exe	187
PID 1444 wrote to memory of 5780	1444	cmd.exe	190
PID 1444 wrote to memory of 4820	1444	cmd.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Hard serial number.exe
"C:\Users\Admin\AppData\Local\Temp\Hard serial number.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\containercomponentsaves\oiF5KfJ33iaZc9bYA.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\containercomponentsaves\KRJsmLXE.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5604
  - - C:\containercomponentsaves\chaincommonitor.exe
      "C:\containercomponentsaves\chaincommonitor.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gh1v4FcHnJ.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1444
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5780
      - C:\Program Files\edge_BITS_4336_506886496\cmd.exe
        
        "C:\Program Files\edge_BITS_4336_506886496\cmd.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\containercomponentsaves\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\containercomponentsaves\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\containercomponentsaves\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\containercomponentsaves\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\containercomponentsaves\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\containercomponentsaves\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\edge_BITS_4336_506886496\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4336_506886496\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files\edge_BITS_4336_506886496\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\uninstall\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\uninstall\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\edge_BITS_4256_1511981484\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4256_1511981484\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\edge_BITS_4256_1511981484\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'C:\Program Files\edge_BITS_4676_1957165190\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4676_1957165190\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 7 /tr "'C:\Program Files\edge_BITS_4676_1957165190\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Documents\My Pictures\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Pictures\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Documents\My Pictures\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Documents\My Videos\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Videos\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Documents\My Videos\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\containercomponentsaves\WmiPrvSE.exe
"C:\containercomponentsaves\WmiPrvSE.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Recent\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\Recent\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Recent\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Program Files (x86)\Windows NT\lsass.exe
"C:\Program Files (x86)\Windows NT\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Recovery\WindowsRE\wininit.exe
"C:\Recovery\WindowsRE\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Program Files\edge_BITS_4256_1511981484\csrss.exe
"C:\Program Files\edge_BITS_4256_1511981484\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
"C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Program Files\Windows Mail\TextInputHost.exe
"C:\Program Files\Windows Mail\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Program Files\Mozilla Firefox\uninstall\TrustedInstaller.exe
"C:\Program Files\Mozilla Firefox\uninstall\TrustedInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Program Files\edge_BITS_4336_506886496\cmd.exe
"C:\Program Files\edge_BITS_4336_506886496\cmd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\containercomponentsaves\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Program Files\edge_BITS_4676_1957165190\WUDFHost.exe
"C:\Program Files\edge_BITS_4676_1957165190\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Users\Default\Idle.exe
"C:\Users\Default\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\containercomponentsaves\Idle.exe
"C:\containercomponentsaves\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\containercomponentsaves\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\containercomponentsaves\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Links\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\Links\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5968

C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
"C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Users\Admin\Documents\My Pictures\WaaSMedicAgent.exe
"C:\Users\Admin\Documents\My Pictures\WaaSMedicAgent.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Users\Admin\Recent\conhost.exe
"C:\Users\Admin\Recent\conhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Links\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Users\Default\Documents\My Videos\wininit.exe
"C:\Users\Default\Documents\My Videos\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Program Files (x86)\Adobe\TrustedInstaller.exe
"C:\Program Files (x86)\Adobe\TrustedInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Recovery\WindowsRE\lsass.exe
"C:\Recovery\WindowsRE\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Users\Default\Links\TextInputHost.exe
"C:\Users\Default\Links\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\containercomponentsaves\lsass.exe
"C:\containercomponentsaves\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Program Files\edge_BITS_4256_1511981484\csrss.exe
"C:\Program Files\edge_BITS_4256_1511981484\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Program Files\edge_BITS_4676_1957165190\WUDFHost.exe
"C:\Program Files\edge_BITS_4676_1957165190\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Users\Default\Links\TextInputHost.exe
C:\Users\Default\Links\TextInputHost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Users\Default\Idle.exe
C:\Users\Default\Idle.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5896

C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe
"C:\Program Files (x86)\Windows NT\Accessories\en-US\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\containercomponentsaves\WmiPrvSE.exe
C:\containercomponentsaves\WmiPrvSE.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Users\Default\Documents\My Videos\wininit.exe
"C:\Users\Default\Documents\My Videos\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Users\Admin\Documents\My Pictures\WaaSMedicAgent.exe
"C:\Users\Admin\Documents\My Pictures\WaaSMedicAgent.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe
"C:\Program Files (x86)\Windows Multimedia Platform\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Program Files\edge_BITS_4336_506886496\cmd.exe
"C:\Program Files\edge_BITS_4336_506886496\cmd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5760

C:\Users\Admin\Recent\conhost.exe
C:\Users\Admin\Recent\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:416

C:\Program Files\edge_BITS_4676_1957165190\WUDFHost.exe
"C:\Program Files\edge_BITS_4676_1957165190\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\containercomponentsaves\lsass.exe
C:\containercomponentsaves\lsass.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Program Files (x86)\Adobe\TrustedInstaller.exe
"C:\Program Files (x86)\Adobe\TrustedInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

gh1v4FcHnJ.bat

Path C:\Users\Admin\AppData\Local\Temp\gh1v4FcHnJ.bat
Size 214B
SHA256 f071ad9398a9e02d5250fc6b143e90e5dbdfabd47d5bb8ca2336c1f26d7db1f4
MD5 ef2e2dfa25d15c3d566c35193c574f6e
SHA1 6ffe981ed1edbead974fda6e8d0e527377c63268
SHA512 65d7ee7565e2bb9572d45b9ca4d796637135be39b2eb4e0cb520d1a401b0ede228408ec4b15370f02e903928bf008e0739b7353ef2fe52a1040a241e7781e7f6
TLSH
T1AED02343C403C79D15D204560655158D54272C48B5C416B107DD9654259B475755E5C6
MD5 SHA1 SHA512 TLSH

Submit Download

KRJsmLXE.bat

Path C:\containercomponentsaves\KRJsmLXE.bat
Size 48B
SHA256 4f6aa2bca870021d2532b20ec7a93b9a752654a98d60c3c18e9089bcb288304a
MD5 ddfd14be9e337ab2068d0d69d11692ee
SHA1 41f09c7450c5abf17e89915a33b173cf2bc7dd94
SHA512 2bb6310cfe873d6c0f5fea81f18bc68d17b9ceeb8a137636b8b4523a3861b5ee694a9c709361ef2c23e8c979117ef918b517391934c21ec0ce0ba8c137e74588
MD5 SHA1 SHA512

Submit Download

chaincommonitor.exe

Path C:\containercomponentsaves\chaincommonitor.exe
Size 828KB
SHA256 de8396f4ba0b3291090fcd7f36ffb5fe2a966738fb9a2d2ed3d1732c76c25b38
MD5 e5bc800a6efdf560ee844d34598787c1
SHA1 a0d35d18304ef4eaea03ab87d9eaea8d35dce445
SHA512 d5b4ae2749d2156c63ba33a76310011cf9e1fef35fee0e4181b804f8d882d40cd29c9c1e6cda26e935727b893b540c7ab8a7861b6eca32ebede0e0d6f124fd83
SSDEEP 24576:4MQNrHBXYjVzxYxEbtyXAjo7dcCHBPR2mpfm:HQQV2XAUrR3f
TLSH
T1AF05F7017E84CE12F0192233C2EF494887B89D5166A6E32B7DBA377E55123A77C0D9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oiF5KfJ33iaZc9bYA.vbe

Path C:\containercomponentsaves\oiF5KfJ33iaZc9bYA.vbe
Size 209B
SHA256 aac6df1ae7767aedfb895f12388dab711af5f86187b60bdbe73e042e6abc44c9
MD5 afe3a300bd4612f93cec867a67af28e7
SHA1 fdbe3316468136b74559407b60455557fea3841b
SHA512 da73758c61eb56bdce719627eddc7888896a6ddf70b598703bf18b9bb2b2df7422898879914a84b1b0f2fba4f10965f4406d46889fc47eb567302211925a0ccd
TLSH
T102D0232C9026BF54009C150AF09088CDCC21C2C7B3B9734B5CDCCC124700346143C3D0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/416-210-0x00000000027B0000-0x00000000027BC000-memory.dmp

Download

memory/544-182-0x00000000016C0000-0x00000000016CC000-memory.dmp

Download

memory/1008-125-0x0000000001810000-0x000000000181C000-memory.dmp

Download

memory/1112-129-0x000000001BFD0000-0x000000001BFDC000-memory.dmp

Download

memory/1248-114-0x0000000000A90000-0x0000000000A9C000-memory.dmp

Download

memory/1540-16-0x0000000000150000-0x0000000000226000-memory.dmp

Download

memory/1540-93-0x00000000009F0000-0x00000000009FC000-memory.dmp

Download

memory/1732-115-0x00000000016C0000-0x00000000016CC000-memory.dmp

Download

memory/1800-123-0x000000001C5F0000-0x000000001C5FC000-memory.dmp

Download

memory/1824-103-0x0000000002800000-0x000000000280C000-memory.dmp

Download

memory/1856-109-0x000000001BFE0000-0x000000001BFEC000-memory.dmp

Download

memory/2172-141-0x000000001C760000-0x000000001C76C000-memory.dmp

Download

memory/2308-136-0x0000000001250000-0x000000000125C000-memory.dmp

Download

memory/3024-180-0x0000000002C10000-0x0000000002C1C000-memory.dmp

Download

memory/3092-190-0x00000000024F0000-0x00000000024FC000-memory.dmp

Download

memory/3288-167-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

Download

memory/3672-105-0x000000001D350000-0x000000001D35C000-memory.dmp

Download

memory/3812-107-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Download

memory/4128-127-0x0000000002650000-0x000000000265C000-memory.dmp

Download

memory/4208-155-0x00000000024B0000-0x00000000024BC000-memory.dmp

Download

memory/4228-133-0x0000000000A20000-0x0000000000A2C000-memory.dmp

Download

memory/4380-134-0x000000001D140000-0x000000001D14C000-memory.dmp

Download

memory/4456-11-0x0000000002740000-0x000000000283A000-memory.dmp

Download

memory/4456-12-0x0000000003280000-0x0000000003313000-memory.dmp

Download

memory/4456-10-0x0000000003280000-0x0000000003313000-memory.dmp

Download

memory/4456-8-0x0000000002740000-0x000000000283A000-memory.dmp

Download

memory/4476-219-0x00000000023A0000-0x00000000023AC000-memory.dmp

Download

memory/4480-119-0x000000001C090000-0x000000001C09C000-memory.dmp

Download

memory/4496-181-0x000000001AFD0000-0x000000001AFDC000-memory.dmp

Download

memory/4800-117-0x00000000009F0000-0x00000000009FC000-memory.dmp

Download

memory/4820-138-0x0000000001220000-0x000000000122C000-memory.dmp

Download

memory/4844-132-0x000000001BFE0000-0x000000001BFEC000-memory.dmp

Download

memory/4868-168-0x000000001B5E0000-0x000000001B5EC000-memory.dmp

Download

memory/5004-101-0x00000000023F0000-0x00000000023FC000-memory.dmp

Download

memory/5696-217-0x00000000031A0000-0x00000000031AC000-memory.dmp

Download

memory/5760-209-0x00000000013D0000-0x00000000013DC000-memory.dmp

Download

memory/5812-218-0x00000000013F0000-0x00000000013FC000-memory.dmp

Download

memory/5896-166-0x00000000024A0000-0x00000000024AC000-memory.dmp

Download

memory/6008-121-0x00000000021F0000-0x00000000021FC000-memory.dmp

Download

memory/6020-111-0x00000000030E0000-0x00000000030EC000-memory.dmp

Download