271b738791619b89212e47caa12d2b544f1bf973cba6ecac4436befe2f339354

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
your_file.exe
Size 374KB
Sample260806-2vm6esbq5x
SHA256 271b738791619b89212e47caa12d2b544f1bf973cba6ecac4436befe2f339354
MD5 c9fa8ae47807a62b52a171818e013643
SHA1 0cf84907fcdd435ae063b96db2b3c503b3ce55a7
SHA512 adf3f86cd39814c4f0f31d402bca1dc7e2e1f388e28cdde2c561ae1ac9e73d8338d9e23dc3103d697842a730953206eaa7b097f811410f476ffa2242fcda51ed
SSDEEP 6144:+6HjoWceTstqlkgor5eKIoN25y8+8eeFCuvozc39pRL0D5bO69CN5aXiS5:+BGshBkeeF8ctpR0DosXiS5
TLSH
T16A84B4247F988A09E590297E415E5A11C7DA91F222327303370BFF615D89DDEEE2C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1912	dllhost.exe
6124	dllhost.exe
1600	Audiodg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com
5	pastebin.com
6	pastebin.com
13	pastebin.com

Looks up external IP address via web service 1 TTPs 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	icanhazip.com
3	api.ipify.org
7	api.ipify.org
8	api.ipify.org
16	icanhazip.com

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dllhost.exe	dllhost.exe
File opened for modification	C:\Windows\Audiodg.exe	Audiodg.exe
File opened for modification	C:\Windows\dllhost.exe	dllhost.exe
File opened for modification	C:\Windows\Audiodg.exe	dllhost.exe
File created	C:\Windows\dllhost.exe	your_file.exe
File opened for modification	C:\Windows\dllhost.exe	your_file.exe
File created	C:\Windows\Audiodg.exe	your_file.exe
File opened for modification	C:\Windows\Audiodg.exe	your_file.exe
File opened for modification	C:\Windows\Audiodg.exe	dllhost.exe
File opened for modification	C:\Windows\dllhost.exe	Audiodg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 60 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
700	cmd.exe
5564	cmd.exe
4116	cmd.exe
2388	cmd.exe
1956	cmd.exe
5380	cmd.exe
5256	cmd.exe
4724	cmd.exe
5752	cmd.exe
3176	cmd.exe
1412	cmd.exe
6052	cmd.exe
3236	cmd.exe
2848	cmd.exe
4228	cmd.exe
4272	cmd.exe
932	cmd.exe
2324	cmd.exe
5676	cmd.exe
1128	cmd.exe
2456	cmd.exe
3216	cmd.exe
5632	cmd.exe
3620	cmd.exe
3012	cmd.exe
5252	cmd.exe
3924	cmd.exe
3028	cmd.exe
5988	cmd.exe
1188	cmd.exe
6132	cmd.exe
1868	cmd.exe
2168	cmd.exe
868	cmd.exe
4232	cmd.exe
4824	cmd.exe
6140	cmd.exe
1784	cmd.exe
3264	cmd.exe
5544	cmd.exe
2416	cmd.exe
3440	cmd.exe
5920	cmd.exe
5160	cmd.exe
4776	cmd.exe
2680	cmd.exe
4908	cmd.exe
2556	cmd.exe
5784	cmd.exe
2588	cmd.exe
5372	cmd.exe
3244	cmd.exe
3384	cmd.exe
4280	cmd.exe
5848	cmd.exe
3972	cmd.exe
2776	cmd.exe
3256	cmd.exe
5140	cmd.exe
5112	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 60 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5064	schtasks.exe
5104	schtasks.exe
2884	schtasks.exe
5172	schtasks.exe
3204	schtasks.exe
4700	schtasks.exe
5144	schtasks.exe
5000	schtasks.exe
4572	schtasks.exe
1492	schtasks.exe
3980	schtasks.exe
3036	schtasks.exe
1232	schtasks.exe
4976	schtasks.exe
1356	schtasks.exe
5848	schtasks.exe
1404	schtasks.exe
4300	schtasks.exe
3204	schtasks.exe
1212	schtasks.exe
1424	schtasks.exe
2864	schtasks.exe
1160	schtasks.exe
5844	schtasks.exe
204	schtasks.exe
5296	schtasks.exe
4908	schtasks.exe
2884	schtasks.exe
5768	schtasks.exe
4176	schtasks.exe
1300	schtasks.exe
1300	schtasks.exe
2124	schtasks.exe
5636	schtasks.exe
6100	schtasks.exe
5224	schtasks.exe
1424	schtasks.exe
600	schtasks.exe
5572	schtasks.exe
5108	schtasks.exe
2700	schtasks.exe
5744	schtasks.exe
5024	schtasks.exe
4856	schtasks.exe
3144	schtasks.exe
1704	schtasks.exe
2404	schtasks.exe
5868	schtasks.exe
4848	schtasks.exe
3456	schtasks.exe
1512	schtasks.exe
5872	schtasks.exe
5820	schtasks.exe
4632	schtasks.exe
2540	schtasks.exe
4812	schtasks.exe
2864	schtasks.exe
4192	schtasks.exe
2144	schtasks.exe
5064	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	your_file.exe
Token: SeDebugPrivilege	1912	dllhost.exe
Token: SeDebugPrivilege	6124	dllhost.exe
Token: SeDebugPrivilege	1600	Audiodg.exe
Token: SeIncBasePriorityPrivilege	6124	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2308	4916	your_file.exe	91
PID 4916 wrote to memory of 2388	4916	your_file.exe	92
PID 2388 wrote to memory of 5572	2388	cmd.exe	95
PID 4916 wrote to memory of 1784	4916	your_file.exe	96
PID 1784 wrote to memory of 4700	1784	cmd.exe	98
PID 4916 wrote to memory of 1912	4916	your_file.exe	99
PID 6124 wrote to memory of 1956	6124	dllhost.exe	104
PID 1956 wrote to memory of 1300	1956	cmd.exe	106
PID 6124 wrote to memory of 3264	6124	dllhost.exe	107
PID 1600 wrote to memory of 5380	1600	Audiodg.exe	109
PID 5380 wrote to memory of 3036	5380	cmd.exe	112
PID 3264 wrote to memory of 5108	3264	cmd.exe	111
PID 1600 wrote to memory of 4272	1600	Audiodg.exe	113
PID 4272 wrote to memory of 4192	4272	cmd.exe	115
PID 6124 wrote to memory of 3924	6124	dllhost.exe	116
PID 3924 wrote to memory of 3204	3924	cmd.exe	118
PID 6124 wrote to memory of 932	6124	dllhost.exe	119
PID 932 wrote to memory of 1212	932	cmd.exe	121
PID 6124 wrote to memory of 5544	6124	dllhost.exe	123
PID 5544 wrote to memory of 2700	5544	cmd.exe	125
PID 6124 wrote to memory of 2556	6124	dllhost.exe	126
PID 2556 wrote to memory of 4848	2556	cmd.exe	128
PID 6124 wrote to memory of 3244	6124	dllhost.exe	129
PID 3244 wrote to memory of 4632	3244	cmd.exe	131
PID 6124 wrote to memory of 5632	6124	dllhost.exe	132
PID 5632 wrote to memory of 1424	5632	cmd.exe	134
PID 6124 wrote to memory of 2324	6124	dllhost.exe	136
PID 2324 wrote to memory of 2864	2324	cmd.exe	138
PID 6124 wrote to memory of 5256	6124	dllhost.exe	139
PID 5256 wrote to memory of 5064	5256	cmd.exe	141
PID 6124 wrote to memory of 700	6124	dllhost.exe	142
PID 700 wrote to memory of 5636	700	cmd.exe	144
PID 6124 wrote to memory of 3176	6124	dllhost.exe	145
PID 3176 wrote to memory of 1160	3176	cmd.exe	147
PID 6124 wrote to memory of 3256	6124	dllhost.exe	148
PID 3256 wrote to memory of 1232	3256	cmd.exe	150
PID 6124 wrote to memory of 3384	6124	dllhost.exe	151
PID 3384 wrote to memory of 2540	3384	cmd.exe	153
PID 6124 wrote to memory of 3620	6124	dllhost.exe	154
PID 3620 wrote to memory of 5104	3620	cmd.exe	156
PID 6124 wrote to memory of 6132	6124	dllhost.exe	157
PID 6132 wrote to memory of 4976	6132	cmd.exe	159
PID 6124 wrote to memory of 3236	6124	dllhost.exe	160
PID 3236 wrote to memory of 1356	3236	cmd.exe	162
PID 6124 wrote to memory of 5920	6124	dllhost.exe	163
PID 5920 wrote to memory of 5744	5920	cmd.exe	165
PID 1912 wrote to memory of 1128	1912	dllhost.exe	166
PID 6124 wrote to memory of 5372	6124	dllhost.exe	167
PID 1128 wrote to memory of 5848	1128	cmd.exe	170
PID 5372 wrote to memory of 1300	5372	cmd.exe	171
PID 6124 wrote to memory of 3028	6124	dllhost.exe	172
PID 1912 wrote to memory of 6140	1912	dllhost.exe	174
PID 6140 wrote to memory of 2144	6140	cmd.exe	176
PID 3028 wrote to memory of 5144	3028	cmd.exe	177
PID 6124 wrote to memory of 5988	6124	dllhost.exe	178
PID 5988 wrote to memory of 2884	5988	cmd.exe	180
PID 6124 wrote to memory of 4232	6124	dllhost.exe	181
PID 4232 wrote to memory of 5000	4232	cmd.exe	183
PID 6124 wrote to memory of 2848	6124	dllhost.exe	184
PID 2848 wrote to memory of 3204	2848	cmd.exe	186
PID 6124 wrote to memory of 1868	6124	dllhost.exe	187
PID 1868 wrote to memory of 4908	1868	cmd.exe	189
PID 6124 wrote to memory of 3012	6124	dllhost.exe	190
PID 3012 wrote to memory of 1404	3012	cmd.exe	192

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\your_file.exe
"C:\Users\Admin\AppData\Local\Temp\your_file.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="r,qBcf8-cq2)ch" dir=in action=allow program="C:\Windows\dllhost.exe" enable=yes & exit
  2⤵
  PID:2308
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5572
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4700
- C:\Windows\dllhost.exe
  "C:\Windows\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5848
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2144

C:\Windows\dllhost.exe
C:\Windows\dllhost.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1300
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5108
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3204
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1212
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2700
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4848
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4632
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1424
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5064
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5636
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1160
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1232
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2540
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5104
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4976
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1356
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5744
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1300
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5144
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2884
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5000
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3204
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4908
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1404
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4724
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5024
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5140
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5868
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2416
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5844
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5564
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2124
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5160
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4812
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5112
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1188
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5064
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2456
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4280
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3456
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5784
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1512
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1412
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5172
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3440
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4572
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2588
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3980
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5752
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3144
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4776
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1492
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4116
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:600
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6052
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5872
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2168
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4824
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4856
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2884
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3972
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5768
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2680
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2404
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2776
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:204
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4908
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5224
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5296
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5252
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4176
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5676
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5820
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3216
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1424

C:\Windows\Audiodg.exe
C:\Windows\Audiodg.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft/Egde" /tr "C:\Windows\dllhost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3036
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "OneDrive/OneDrive" /tr "C:\Windows\Audiodg.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dllhost.exe

Path C:\Windows\dllhost.exe
Size 374KB
SHA256 271b738791619b89212e47caa12d2b544f1bf973cba6ecac4436befe2f339354
MD5 c9fa8ae47807a62b52a171818e013643
SHA1 0cf84907fcdd435ae063b96db2b3c503b3ce55a7
SHA512 adf3f86cd39814c4f0f31d402bca1dc7e2e1f388e28cdde2c561ae1ac9e73d8338d9e23dc3103d697842a730953206eaa7b097f811410f476ffa2242fcda51ed
SSDEEP 6144:+6HjoWceTstqlkgor5eKIoN25y8+8eeFCuvozc39pRL0D5bO69CN5aXiS5:+BGshBkeeF8ctpR0DosXiS5
TLSH
T16A84B4247F988A09E590297E415E5A11C7DA91F222327303370BFF615D89DDEEE2C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4916-0-0x0000020BF6030000-0x0000020BF6094000-memory.dmp

Download

memory/4916-1-0x00007FF95BB3F000-0x00007FF95BB40000-memory.dmp

Download

memory/4916-2-0x00007FF95B9B0000-0x00007FF95C354000-memory.dmp

Download

memory/4916-3-0x00007FF95B9B0000-0x00007FF95C354000-memory.dmp

Download

memory/4916-4-0x00007FF95B9B0000-0x00007FF95C354000-memory.dmp

Download

memory/4916-5-0x00007FF95B9B0000-0x00007FF95C354000-memory.dmp

Download

memory/4916-65-0x00007FF95B9B0000-0x00007FF95C354000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads