dcrat | 94aa487917e64061798918b573e3f4dfb027315bfeedc8af71f1e08da5ea2084

Analysis

max time kernel
146s
max time network
149s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
31-10-2022 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94aa487917e64061798918b573e3f4dfb027315bfeedc8af71f1e08da5ea2084.exe
Size

1.3MB
MD5

4726018a85f26b6b7e7fe0feee42bf4a
SHA1

2cddf0cf839b49e2025bc303ce2fc1be084d2de5
SHA256

94aa487917e64061798918b573e3f4dfb027315bfeedc8af71f1e08da5ea2084
SHA512

c451e8b2ea2910d93d1fab09c1c362fdfd23e439b437cfe884247a953f42bff6e8fa0ac2a7f35925e65ee61cd2acf0b2554837a333b565ba5793feeabf928db9
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	328	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	68	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	196	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	4300	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	4300	schtasks.exe	70

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001abee-281.dat	dcrat
behavioral1/files/0x000800000001abee-282.dat	dcrat
behavioral1/memory/3800-283-0x0000000000270000-0x0000000000380000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac20-370.dat	dcrat
behavioral1/files/0x000600000001ac20-371.dat	dcrat
behavioral1/files/0x000600000001ac20-998.dat	dcrat
behavioral1/files/0x000600000001ac20-1004.dat	dcrat
behavioral1/files/0x000600000001ac20-1009.dat	dcrat
behavioral1/files/0x000600000001ac20-1015.dat	dcrat
behavioral1/files/0x000600000001ac20-1021.dat	dcrat
behavioral1/files/0x000600000001ac20-1026.dat	dcrat
behavioral1/files/0x000600000001ac20-1032.dat	dcrat
behavioral1/files/0x000600000001ac20-1037.dat	dcrat
behavioral1/files/0x000600000001ac20-1043.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
3800	DllCommonsvc.exe
1776	csrss.exe
5464	csrss.exe
6084	csrss.exe
2764	csrss.exe
5956	csrss.exe
328	csrss.exe
4576	csrss.exe
5012	csrss.exe
1144	csrss.exe
4384	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\ja-JP\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\ja-JP\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\Offline\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\smss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Policies\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Policies\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\Offline\66fc9ff0ee96c2	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\INF\UGatherer\0000\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\INF\UGatherer\0000\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\wininit.exe	DllCommonsvc.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\56085415360792	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4980	schtasks.exe
4012	schtasks.exe
3988	schtasks.exe
4908	schtasks.exe
2316	schtasks.exe
2152	schtasks.exe
3908	schtasks.exe
328	schtasks.exe
2112	schtasks.exe
672	schtasks.exe
2156	schtasks.exe
660	schtasks.exe
2492	schtasks.exe
2628	schtasks.exe
4624	schtasks.exe
4768	schtasks.exe
1432	schtasks.exe
32	schtasks.exe
4896	schtasks.exe
4716	schtasks.exe
4880	schtasks.exe
3200	schtasks.exe
1836	schtasks.exe
532	schtasks.exe
4504	schtasks.exe
2624	schtasks.exe
1272	schtasks.exe
2928	schtasks.exe
3760	schtasks.exe
4832	schtasks.exe
3684	schtasks.exe
3276	schtasks.exe
2248	schtasks.exe
828	schtasks.exe
1584	schtasks.exe
4800	schtasks.exe
4976	schtasks.exe
1820	schtasks.exe
60	schtasks.exe
220	schtasks.exe
1132	schtasks.exe
68	schtasks.exe
196	schtasks.exe
2920	schtasks.exe
4744	schtasks.exe
1696	schtasks.exe
444	schtasks.exe
2160	schtasks.exe
2228	schtasks.exe
4820	schtasks.exe
4720	schtasks.exe
3644	schtasks.exe
4492	schtasks.exe
1776	schtasks.exe
4932	schtasks.exe
1188	schtasks.exe
1616	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	94aa487917e64061798918b573e3f4dfb027315bfeedc8af71f1e08da5ea2084.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	csrss.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3800	DllCommonsvc.exe
3800	DllCommonsvc.exe
3800	DllCommonsvc.exe
3804	powershell.exe
3804	powershell.exe
3896	powershell.exe
3896	powershell.exe
368	powershell.exe
368	powershell.exe
1940	powershell.exe
1940	powershell.exe
4760	powershell.exe
4760	powershell.exe
3492	powershell.exe
3492	powershell.exe
3516	powershell.exe
3516	powershell.exe
3300	powershell.exe
3300	powershell.exe
4436	powershell.exe
4436	powershell.exe
968	powershell.exe
968	powershell.exe
3320	powershell.exe
3320	powershell.exe
4272	powershell.exe
4272	powershell.exe
516	powershell.exe
516	powershell.exe
5044	powershell.exe
5044	powershell.exe
5080	powershell.exe
5080	powershell.exe
388	powershell.exe
388	powershell.exe
4732	powershell.exe
4732	powershell.exe
3232	powershell.exe
3232	powershell.exe
4824	powershell.exe
4824	powershell.exe
5044	powershell.exe
388	powershell.exe
1340	powershell.exe
1340	powershell.exe
3804	powershell.exe
3804	powershell.exe
3896	powershell.exe
3896	powershell.exe
1776	csrss.exe
1776	csrss.exe
368	powershell.exe
368	powershell.exe
1940	powershell.exe
1940	powershell.exe
4760	powershell.exe
4760	powershell.exe
3492	powershell.exe
3492	powershell.exe
4272	powershell.exe
3516	powershell.exe
3516	powershell.exe
3300	powershell.exe
3300	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3800	DllCommonsvc.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	368	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	516	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	1776	csrss.exe
Token: SeDebugPrivilege	388	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	3232	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeIncreaseQuotaPrivilege	388	powershell.exe
Token: SeSecurityPrivilege	388	powershell.exe
Token: SeTakeOwnershipPrivilege	388	powershell.exe
Token: SeLoadDriverPrivilege	388	powershell.exe
Token: SeSystemProfilePrivilege	388	powershell.exe
Token: SeSystemtimePrivilege	388	powershell.exe
Token: SeProfSingleProcessPrivilege	388	powershell.exe
Token: SeIncBasePriorityPrivilege	388	powershell.exe
Token: SeCreatePagefilePrivilege	388	powershell.exe
Token: SeBackupPrivilege	388	powershell.exe
Token: SeRestorePrivilege	388	powershell.exe
Token: SeShutdownPrivilege	388	powershell.exe
Token: SeDebugPrivilege	388	powershell.exe
Token: SeSystemEnvironmentPrivilege	388	powershell.exe
Token: SeRemoteShutdownPrivilege	388	powershell.exe
Token: SeUndockPrivilege	388	powershell.exe
Token: SeManageVolumePrivilege	388	powershell.exe
Token: 33	388	powershell.exe
Token: 34	388	powershell.exe
Token: 35	388	powershell.exe
Token: 36	388	powershell.exe
Token: SeIncreaseQuotaPrivilege	5044	powershell.exe
Token: SeSecurityPrivilege	5044	powershell.exe
Token: SeTakeOwnershipPrivilege	5044	powershell.exe
Token: SeLoadDriverPrivilege	5044	powershell.exe
Token: SeSystemProfilePrivilege	5044	powershell.exe
Token: SeSystemtimePrivilege	5044	powershell.exe
Token: SeProfSingleProcessPrivilege	5044	powershell.exe
Token: SeIncBasePriorityPrivilege	5044	powershell.exe
Token: SeCreatePagefilePrivilege	5044	powershell.exe
Token: SeBackupPrivilege	5044	powershell.exe
Token: SeRestorePrivilege	5044	powershell.exe
Token: SeShutdownPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeSystemEnvironmentPrivilege	5044	powershell.exe
Token: SeRemoteShutdownPrivilege	5044	powershell.exe
Token: SeUndockPrivilege	5044	powershell.exe
Token: SeManageVolumePrivilege	5044	powershell.exe
Token: 33	5044	powershell.exe
Token: 34	5044	powershell.exe
Token: 35	5044	powershell.exe
Token: 36	5044	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1484	3048	94aa487917e64061798918b573e3f4dfb027315bfeedc8af71f1e08da5ea2084.exe	66
PID 3048 wrote to memory of 1484	3048	94aa487917e64061798918b573e3f4dfb027315bfeedc8af71f1e08da5ea2084.exe	66
PID 3048 wrote to memory of 1484	3048	94aa487917e64061798918b573e3f4dfb027315bfeedc8af71f1e08da5ea2084.exe	66
PID 1484 wrote to memory of 4568	1484	WScript.exe	67
PID 1484 wrote to memory of 4568	1484	WScript.exe	67
PID 1484 wrote to memory of 4568	1484	WScript.exe	67
PID 4568 wrote to memory of 3800	4568	cmd.exe	69
PID 4568 wrote to memory of 3800	4568	cmd.exe	69
PID 3800 wrote to memory of 3804	3800	DllCommonsvc.exe	128
PID 3800 wrote to memory of 3804	3800	DllCommonsvc.exe	128
PID 3800 wrote to memory of 3896	3800	DllCommonsvc.exe	129
PID 3800 wrote to memory of 3896	3800	DllCommonsvc.exe	129
PID 3800 wrote to memory of 368	3800	DllCommonsvc.exe	130
PID 3800 wrote to memory of 368	3800	DllCommonsvc.exe	130
PID 3800 wrote to memory of 1940	3800	DllCommonsvc.exe	131
PID 3800 wrote to memory of 1940	3800	DllCommonsvc.exe	131
PID 3800 wrote to memory of 4760	3800	DllCommonsvc.exe	140
PID 3800 wrote to memory of 4760	3800	DllCommonsvc.exe	140
PID 3800 wrote to memory of 3492	3800	DllCommonsvc.exe	134
PID 3800 wrote to memory of 3492	3800	DllCommonsvc.exe	134
PID 3800 wrote to memory of 3300	3800	DllCommonsvc.exe	135
PID 3800 wrote to memory of 3300	3800	DllCommonsvc.exe	135
PID 3800 wrote to memory of 3516	3800	DllCommonsvc.exe	137
PID 3800 wrote to memory of 3516	3800	DllCommonsvc.exe	137
PID 3800 wrote to memory of 4436	3800	DllCommonsvc.exe	143
PID 3800 wrote to memory of 4436	3800	DllCommonsvc.exe	143
PID 3800 wrote to memory of 4272	3800	DllCommonsvc.exe	145
PID 3800 wrote to memory of 4272	3800	DllCommonsvc.exe	145
PID 3800 wrote to memory of 968	3800	DllCommonsvc.exe	165
PID 3800 wrote to memory of 968	3800	DllCommonsvc.exe	165
PID 3800 wrote to memory of 3320	3800	DllCommonsvc.exe	148
PID 3800 wrote to memory of 3320	3800	DllCommonsvc.exe	148
PID 3800 wrote to memory of 5044	3800	DllCommonsvc.exe	149
PID 3800 wrote to memory of 5044	3800	DllCommonsvc.exe	149
PID 3800 wrote to memory of 516	3800	DllCommonsvc.exe	151
PID 3800 wrote to memory of 516	3800	DllCommonsvc.exe	151
PID 3800 wrote to memory of 388	3800	DllCommonsvc.exe	153
PID 3800 wrote to memory of 388	3800	DllCommonsvc.exe	153
PID 3800 wrote to memory of 1340	3800	DllCommonsvc.exe	154
PID 3800 wrote to memory of 1340	3800	DllCommonsvc.exe	154
PID 3800 wrote to memory of 5080	3800	DllCommonsvc.exe	155
PID 3800 wrote to memory of 5080	3800	DllCommonsvc.exe	155
PID 3800 wrote to memory of 3232	3800	DllCommonsvc.exe	157
PID 3800 wrote to memory of 3232	3800	DllCommonsvc.exe	157
PID 3800 wrote to memory of 4732	3800	DllCommonsvc.exe	159
PID 3800 wrote to memory of 4732	3800	DllCommonsvc.exe	159
PID 3800 wrote to memory of 4824	3800	DllCommonsvc.exe	162
PID 3800 wrote to memory of 4824	3800	DllCommonsvc.exe	162
PID 3800 wrote to memory of 1776	3800	DllCommonsvc.exe	168
PID 3800 wrote to memory of 1776	3800	DllCommonsvc.exe	168
PID 1776 wrote to memory of 5124	1776	csrss.exe	170
PID 1776 wrote to memory of 5124	1776	csrss.exe	170
PID 5124 wrote to memory of 5640	5124	cmd.exe	172
PID 5124 wrote to memory of 5640	5124	cmd.exe	172
PID 5124 wrote to memory of 5464	5124	cmd.exe	173
PID 5124 wrote to memory of 5464	5124	cmd.exe	173
PID 5464 wrote to memory of 6112	5464	csrss.exe	174
PID 5464 wrote to memory of 6112	5464	csrss.exe	174
PID 6112 wrote to memory of 5136	6112	cmd.exe	176
PID 6112 wrote to memory of 5136	6112	cmd.exe	176
PID 6112 wrote to memory of 6084	6112	cmd.exe	177
PID 6112 wrote to memory of 6084	6112	cmd.exe	177
PID 6084 wrote to memory of 2232	6084	csrss.exe	178
PID 6084 wrote to memory of 2232	6084	csrss.exe	178

C:\Users\Admin\AppData\Local\Temp\94aa487917e64061798918b573e3f4dfb027315bfeedc8af71f1e08da5ea2084.exe
"C:\Users\Admin\AppData\Local\Temp\94aa487917e64061798918b573e3f4dfb027315bfeedc8af71f1e08da5ea2084.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\ja-JP\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\UGatherer\0000\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Policies\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\Offline\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
    - - C:\Users\Public\Videos\csrss.exe
        
        "C:\Users\Public\Videos\csrss.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1776
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kOAwrWovpT.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5124
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5640
        
        C:\Users\Public\Videos\csrss.exe
        
        "C:\Users\Public\Videos\csrss.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9avng9MHpa.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:6112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:5136
        
        C:\Users\Public\Videos\csrss.exe
        
        "C:\Users\Public\Videos\csrss.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\79RMekxjZd.bat"
        10⤵
        
        PID:2232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1836
        
        C:\Users\Public\Videos\csrss.exe
        
        "C:\Users\Public\Videos\csrss.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zAqEIlSfAD.bat"
        12⤵
        
        PID:1112
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4560
        
        C:\Users\Public\Videos\csrss.exe
        
        "C:\Users\Public\Videos\csrss.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gW6qUMg8Bu.bat"
        14⤵
        
        PID:3772
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1704
        
        C:\Users\Public\Videos\csrss.exe
        
        "C:\Users\Public\Videos\csrss.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:328
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vIn8vbLsXf.bat"
        16⤵
        
        PID:5160
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:5264
        
        C:\Users\Public\Videos\csrss.exe
        
        "C:\Users\Public\Videos\csrss.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KqyXtY4PgZ.bat"
        18⤵
        
        PID:2740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2192
        
        C:\Users\Public\Videos\csrss.exe
        
        "C:\Users\Public\Videos\csrss.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5012
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"
        20⤵
        
        PID:5420
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1096
        
        C:\Users\Public\Videos\csrss.exe
        
        "C:\Users\Public\Videos\csrss.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nKCzYbro9F.bat"
        22⤵
        
        PID:4108
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:5140
        
        C:\Users\Public\Videos\csrss.exe
        
        "C:\Users\Public\Videos\csrss.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat"
        24⤵
        
        PID:5256
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\ja-JP\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\assembly\GAC_64\Microsoft.Interop.Security.AzRoles\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\INF\UGatherer\0000\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\INF\UGatherer\0000\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\INF\UGatherer\0000\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Videos\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\Offline\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\Offline\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\Offline\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\odt\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 9 /tr "'C:\providercommon\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:68

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 7 /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Policies\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Policies\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Policies\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\odt\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
096dd91502f0b058b1460d97d3ecb423

SHA1
6e6a725894fc1804b32242632891f9ed2956b9d9

SHA256
70b97ccd1c2dae28fffe256a4362667da21c9eca75293cf207273b7d07569446

SHA512
3f7b8e3d75af36ee086139303edff699ecd2f5d58561597c3bfddf7d3ea4a0de8630de1a7976f74c95e52156fb2f6f584add3fbfe80bfe308a4e1caee22bd792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
da8770d160bda48bb21a207cdbb54f3c

SHA1
96de4873cef7e33700d636c9f645e3886c5a99fd

SHA256
2bb5e86a2c112dccfb81d224e911d05377bf5df06b754012ad03df645a332fe7

SHA512
4bc7d0c3e97f14272661cb088203b078c38a4ed166b0be243827eca70bf789cf854f38116b867a8664673039c387413ce32c8045701657ff8f75266630461b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
da8770d160bda48bb21a207cdbb54f3c

SHA1
96de4873cef7e33700d636c9f645e3886c5a99fd

SHA256
2bb5e86a2c112dccfb81d224e911d05377bf5df06b754012ad03df645a332fe7

SHA512
4bc7d0c3e97f14272661cb088203b078c38a4ed166b0be243827eca70bf789cf854f38116b867a8664673039c387413ce32c8045701657ff8f75266630461b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ca89f49db499d14d331effed94c8b59d

SHA1
2881693f7fa12c9d6a485de9f615658935b02ca2

SHA256
20963fdbf4ad5754d845e41f470969fc9b4f4d28653a7c0bc5da480d7aee303c

SHA512
74c0ccd9436968eae05dc01b2769fd48df36d3010d47cc7c26810384b30a3a8e22500f5f1db87c96054df70de9648892d23330d5a4e7b4d18bd0cad3fdebd903

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f83d1c88f385ac958cfbcf5396ed129b

SHA1
8c1573bcadc2d7d14e8c95eace53506a886cfe6a

SHA256
ca5f384a07e037186c7f4bcc5a0d93e2d8b80afddf3391bbc1fe1b23c136dbe0

SHA512
f7af33c1a19833db9c1a376d1fa42b183a26df8729443acb4f6e3aa82c43b440bb2f7181e741665a1c9c74fc7ae90ef70a1924ac56b1834535afc7de5e1263fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f83d1c88f385ac958cfbcf5396ed129b

SHA1
8c1573bcadc2d7d14e8c95eace53506a886cfe6a

SHA256
ca5f384a07e037186c7f4bcc5a0d93e2d8b80afddf3391bbc1fe1b23c136dbe0

SHA512
f7af33c1a19833db9c1a376d1fa42b183a26df8729443acb4f6e3aa82c43b440bb2f7181e741665a1c9c74fc7ae90ef70a1924ac56b1834535afc7de5e1263fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b8242ba82d13d4e5c52f1f81acd32638

SHA1
0fbd9f2b4ca5c0766d11d5ff6b26be56215cbe78

SHA256
094dfcd437aef7789e589f286518252f37e843b727ad9b3950fa9ce936362f7f

SHA512
824ad86c729cb094478c48804d816e69443c0060bc649c49ff8529b8ce9483c7ef1fb03c1f7e184b7ab717911b5caedd419b5fa8117b6cc8da728916fce4fcaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
59b775c3c8b19335b1aa988d247e1853

SHA1
9277e99611e1bf5c0f2914c505ed37fd5d65818c

SHA256
20f4b9a117e647327c34790c1c5b6acbb602e8d47cba96bf4bad7413aa9ca8fc

SHA512
5d48050c7e6ad492a6c051e5ce9c8498db9bd62fdec36abffa7f60196be8d4a228f8675237fc76c4d167e39a7cddaeef0adee01cd6da94dcde4b18e3bf73cbfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c7e09daacc8c42ddeff6f9234071a792

SHA1
37be20dae7ca73bea5c3049857032e645d9ca348

SHA256
965fa59b8cd755741354630ce7b8e579e2032efe1930d62146c6661a1d56058f

SHA512
3157c9ffd5d56b6ae6c533244b4eff863fac6afbc4f8ede8406a59b5f4a3996a4c33c10cd08efd8726693edd89793c5f66f9dbed65aeaea95885ddc1020e4048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
675c6a993f9d0f8e44243ee198543804

SHA1
c4f5e7580ce0354c20e5b72a0aa15c7e64eb9323

SHA256
0f548f96dd8f3f7a29316261e6d3b52670f2d0885eeaa60fe11b02ad87ceedd6

SHA512
b0def0a3275f68cab27b05078945869d71fc3953bec886fb2113fd176c9ef87b8cf4221cffa03d77953aa9863a309bc4448f607369d4cfe3111d04e0f02a846b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
675c6a993f9d0f8e44243ee198543804

SHA1
c4f5e7580ce0354c20e5b72a0aa15c7e64eb9323

SHA256
0f548f96dd8f3f7a29316261e6d3b52670f2d0885eeaa60fe11b02ad87ceedd6

SHA512
b0def0a3275f68cab27b05078945869d71fc3953bec886fb2113fd176c9ef87b8cf4221cffa03d77953aa9863a309bc4448f607369d4cfe3111d04e0f02a846b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
477e1b24084128c66093b35102b4179a

SHA1
253fc3d5c11aedd8de21ec45a747df6139c7d225

SHA256
b17905f7a8a126e2c41e5db466de83ce3d795a6d9c106b02776e4e1c8a1cc4e3

SHA512
72cdf02c4ddbcacd37f4d206999c28bf3a562b9b2d409bc2275f3a098b907b21a93814e3a2cb4a2c34c2027587ec0611680b83bff0bafae1efbd7fce813e9cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
eda7274b77f761dea39ff5533579dddc

SHA1
9ba9de818fa97e050b5596a8447de58ff15200c0

SHA256
d62568b051d9d0f883ebc126df0bc52fd68d5a37d1940c3124dd41c670aab0f6

SHA512
6801840a0bb08989aed3583fd89eb70759f35230c1199de32fbe158647da7005b37628d7dd3e11a89d43fe0a29a790e2acde9c6bc907627b31cc6f7b6976a827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
eda7274b77f761dea39ff5533579dddc

SHA1
9ba9de818fa97e050b5596a8447de58ff15200c0

SHA256
d62568b051d9d0f883ebc126df0bc52fd68d5a37d1940c3124dd41c670aab0f6

SHA512
6801840a0bb08989aed3583fd89eb70759f35230c1199de32fbe158647da7005b37628d7dd3e11a89d43fe0a29a790e2acde9c6bc907627b31cc6f7b6976a827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8f932e994208778da5a083d0935b0853

SHA1
1113bf7d2c6a9386917de2464e19944396a61248

SHA256
dcd24aef4bc6eb1e5bd327ff3c1da4c99594cdd867063d676f769afa9a652668

SHA512
eec271f2c7baba7e5b2ebf90a6eafbc84b8659e139f22a7f897c5a36680a4d58fd092f5e05dfe0b856647fcb5e6c5b9323f19f61e33d9a81d79b9b842ff85947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8f932e994208778da5a083d0935b0853

SHA1
1113bf7d2c6a9386917de2464e19944396a61248

SHA256
dcd24aef4bc6eb1e5bd327ff3c1da4c99594cdd867063d676f769afa9a652668

SHA512
eec271f2c7baba7e5b2ebf90a6eafbc84b8659e139f22a7f897c5a36680a4d58fd092f5e05dfe0b856647fcb5e6c5b9323f19f61e33d9a81d79b9b842ff85947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8f932e994208778da5a083d0935b0853

SHA1
1113bf7d2c6a9386917de2464e19944396a61248

SHA256
dcd24aef4bc6eb1e5bd327ff3c1da4c99594cdd867063d676f769afa9a652668

SHA512
eec271f2c7baba7e5b2ebf90a6eafbc84b8659e139f22a7f897c5a36680a4d58fd092f5e05dfe0b856647fcb5e6c5b9323f19f61e33d9a81d79b9b842ff85947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
80663ddf88a18d6ae91b4fcc9e2ab174

SHA1
d828e22ea832ed74bb8028e1f3685dfa9470725b

SHA256
78b5f06cc5a909bc38e82d387465494893edaacdabbe7173fb3839cd5e455650

SHA512
20de5f13bf711f138bb526bd3d0051e4f04b8fa74253fac7402fee9ed7ef7db25bc8a343a10616e25350e2d6889adda1ff134b7464b98220209a21aa10f96d8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6b3aab2db837920e5c0de0f30e2f1ebd

SHA1
f312e757c39b48a593daded2a948e8d002692c28

SHA256
31b5105e23848a47a7ae18999c0104e764daaacc0a270a43b9d23eaa10a38f76

SHA512
8eb3b0173344b4d10729fb82dceb78610885768fbf92cfc76ac49468316d08f336df232beaaff5158cdca58b6d384b8f4829788443a5bad62601864bd9f8de9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat

Filesize
197B

MD5
e3a408ceeef2255df182b2c6c3e10bb1

SHA1
9f46a0f6564965328b213c3bea4e61f6573a0b62

SHA256
70a61aae404687d94bfd75def0d97427b8f2ca1175cc426b1e31902ad81d15bd

SHA512
647b66657dba4b4193f8fbd53c7d082d277594c03a6f1c3ce62766a4437a6c8b7c72f4b5d2d55c9b3d39578b87ddb3275ec5f4c9a7c06af9d138e68383a13b2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\79RMekxjZd.bat

Filesize
197B

MD5
7c6be37b861395d0a16e0cb2f5e28a04

SHA1
5bf5d3805e60e8ab487052ed2754db1a2ed2e777

SHA256
e0c1ca9b7b6b002553a1ccfd54bda51890d46612c972dc54f2ed436c46eee2d0

SHA512
63b907e244000573fcf42010dfb402bd13478ce57a7e627008a5d872196f1bff5739dad37a7d386acf09db42f052af3582a9839046c0c6eb50697e38f21b1c65

Download Submit
C:\Users\Admin\AppData\Local\Temp\9avng9MHpa.bat

Filesize
197B

MD5
2b57a400d7377f8e90624370178d2d79

SHA1
1f2dc286ca4e6f3b03b4e67ed2350fa665164469

SHA256
1fe6f85b416f338ba1d55ccd84d5406a75dacc05dd3846a781eade4098a17787

SHA512
0c82a79b9e69aa1a7b205621d93b591f88f85129e7f22f8ffb06fb0e3b63972c90416a6bc6823eac5aef28f005c8d166cd3c1afbb44ec055e643a62d5a020cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\KqyXtY4PgZ.bat

Filesize
197B

MD5
80129d85fbecd61168c8e5bda0a98917

SHA1
c85e7fa71b6e845a5d8ba3c7885422e01d408d48

SHA256
86ec4cccf32a85cde2ad7912fa05971b2c622dd90020921e9c4ad0fdc9573623

SHA512
49a3897ee12a5f9648b9bc2ea2dfcd681735b84a7e2fa9cc2dd4331b266e487db0e5dc48c16f0f958e4216b5c04785cb7e07797a28fe7d8d51d567fdbc25d7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat

Filesize
197B

MD5
e10b3201b547cf1e02fdd6f7585767e0

SHA1
69e57b1e1ed095d954e4a5a3df34f872dae1f89a

SHA256
cfdfa2f69cbdda64710b74bfe16a091f0213ca5c26369119fa2d39de1963f738

SHA512
fe2b8cb598e497246388b6cc3af6090e48a894bc7b72f3b6703d6f1efb39516e430f1848a546e5e4b5a28be33ca3ae7cac87a5db555e10a11b0addcd52789436

Download Submit
C:\Users\Admin\AppData\Local\Temp\gW6qUMg8Bu.bat

Filesize
197B

MD5
c2f556be4f8f2818cabcd5162b926fbc

SHA1
b9b837e3490b069cc4017fb1b3a427646721574a

SHA256
ca267e56aa47624c12bd16add57c1c7eb22a489791f88e91dd37e1a285e1f4ef

SHA512
cc78fcf85116d118e29d5395a48d4ae10913a6c41da098a90dc61894cc942a524f60347299517ecb9d6fe495adb175814f74eab26966cbab480f7c03715fe37f

Download Submit
C:\Users\Admin\AppData\Local\Temp\kOAwrWovpT.bat

Filesize
197B

MD5
f3217c33f031f728a83e8f28a6d2ad8a

SHA1
67d980a8df3afee1f2f8610bd2fa4a8f4be8f245

SHA256
60634d5343d9ccb5c6dec9492c5082198c132a5c862b202ab19dd3da457caeae

SHA512
ab1e6b80517933fa90557f389393a70b6d865d270f6f24f371767fe6b379f2aea5926c5b5a1f3949dc144f07d6f742636afca4d3ed17fb076b5f1189027edd42

Download Submit
C:\Users\Admin\AppData\Local\Temp\nKCzYbro9F.bat

Filesize
197B

MD5
363cca420c92d432c20df770967e47b5

SHA1
8eb918beca1c9ceccbf550c612ee7a7da6e7b2ab

SHA256
d9470f5538439bc280a0c3d3e8ad6119e16355a9ed698e9eed0a868116a6a206

SHA512
331f1ca897fa06d4cbc62f106fd0a6b087f090d78a3b37cbb5555ff9a74a4416123672c6882d55097961cc97cbeeb31ee855f152195498752f2a79e3196fc1db

Download Submit
C:\Users\Admin\AppData\Local\Temp\vIn8vbLsXf.bat

Filesize
197B

MD5
6103137387165645e41c8c35a0e9de37

SHA1
112bb86a979e74ac148730f27ded680a9f7de73d

SHA256
0b77b55759fe308ffab8a618d4af9b893f228e6f3c88988b388308898cd0a654

SHA512
c551b30c7927cf9b3eafdaa613f957a418d84755330bd6ad3fb260baa6e0ed5b54900b677648c95733598e9c74f0ae2f68954252d9bc41b8a3754c14b3999824

Download Submit
C:\Users\Admin\AppData\Local\Temp\zAqEIlSfAD.bat

Filesize
197B

MD5
59c059868abd7e46e3f75037b07fdc47

SHA1
0199633852759502619f653e4335ab063b6ef86a

SHA256
346be07c9a5aadfb627e02b662ca92d0c0715523e8a14699cec51d6e5bf122cd

SHA512
40aa8bcaaa65335cfd154b560c65c8e63b2addc46d28336a2aa2023e03eeecd6f4991e87b70dac2bc19a32b93b273af0c3500852d968ca00528d8899131733e8

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Videos\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/388-433-0x0000021B2F0D0000-0x0000021B2F146000-memory.dmp

Filesize
472KB

Download
memory/1144-1038-0x0000000000D60000-0x0000000000D72000-memory.dmp

Filesize
72KB

Download
memory/1484-183-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-182-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/1776-392-0x0000000000C70000-0x0000000000C82000-memory.dmp

Filesize
72KB

Download
memory/2764-1010-0x0000000000B60000-0x0000000000B72000-memory.dmp

Filesize
72KB

Download
memory/3048-117-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-169-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-159-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-157-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-160-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-161-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-156-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-180-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-155-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-179-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-178-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-154-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-163-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-177-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-153-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-152-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-162-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-176-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-118-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-151-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-175-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-174-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-173-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-172-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-171-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-150-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-170-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-149-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-148-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-147-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-168-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-158-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-146-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-145-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-167-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-144-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-143-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-142-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-141-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-140-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-139-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-138-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-137-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-136-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-135-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-134-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-133-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-132-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-131-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-130-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-129-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-128-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-127-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-126-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-125-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-166-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-122-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-123-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-120-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-119-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-165-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3048-164-0x0000000077470000-0x00000000775FE000-memory.dmp

Filesize
1.6MB

Download
memory/3800-285-0x0000000000C40000-0x0000000000C4C000-memory.dmp

Filesize
48KB

Download
memory/3800-283-0x0000000000270000-0x0000000000380000-memory.dmp

Filesize
1.1MB

Download
memory/3800-284-0x0000000000A90000-0x0000000000AA2000-memory.dmp

Filesize
72KB

Download
memory/3800-286-0x0000000000C50000-0x0000000000C5C000-memory.dmp

Filesize
48KB

Download
memory/3800-287-0x0000000000C60000-0x0000000000C6C000-memory.dmp

Filesize
48KB

Download
memory/3804-381-0x00000274799C0000-0x00000274799E2000-memory.dmp

Filesize
136KB

Download
memory/4576-1027-0x0000000000BF0000-0x0000000000C02000-memory.dmp

Filesize
72KB

Download
memory/5956-1016-0x0000000000D00000-0x0000000000D12000-memory.dmp

Filesize
72KB

Download