dcrat | 4b0077a0bd18ef31c95f97b039e2f45b42872c3c1d451b2d23e181cabc3cbff7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01-11-2022 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b0077a0bd18ef31c95f97b039e2f45b42872c3c1d451b2d23e181cabc3cbff7.exe
Size

1.3MB
MD5

82bba60312e8e0fa83b07d517d8f54f9
SHA1

b49e4616b79bf62c880e22fe8aefb12789b13d13
SHA256

4b0077a0bd18ef31c95f97b039e2f45b42872c3c1d451b2d23e181cabc3cbff7
SHA512

85d804d232d32caad773963a6bccdc6beaa353dd9ca6a3eea9d69877bcd4fe683dd560acb469d0f6e4fa01d214db8e7fedb1ca5b18e7717816d0fde2ac00b27c
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	4592	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	4592	schtasks.exe	70

DCRat payload 18 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001ac1b-280.dat	dcrat
behavioral1/files/0x000800000001ac1b-281.dat	dcrat
behavioral1/memory/4864-282-0x0000000000FE0000-0x00000000010F0000-memory.dmp	dcrat
behavioral1/files/0x000800000001ac1b-315.dat	dcrat
behavioral1/files/0x000600000001ac62-595.dat	dcrat
behavioral1/files/0x000600000001ac62-593.dat	dcrat
behavioral1/files/0x000600000001ac62-861.dat	dcrat
behavioral1/files/0x000600000001ac62-867.dat	dcrat
behavioral1/files/0x000600000001ac62-872.dat	dcrat
behavioral1/files/0x000600000001ac62-877.dat	dcrat
behavioral1/files/0x000600000001ac62-882.dat	dcrat
behavioral1/files/0x000600000001ac62-887.dat	dcrat
behavioral1/files/0x000600000001ac62-893.dat	dcrat
behavioral1/files/0x000600000001ac62-899.dat	dcrat
behavioral1/files/0x000600000001ac62-904.dat	dcrat
behavioral1/files/0x000600000001ac62-910.dat	dcrat
behavioral1/files/0x000600000001ac62-915.dat	dcrat
behavioral1/files/0x000600000001ac62-920.dat	dcrat

Executes dropped EXE 15 IoCs

pid	Process
4864	DllCommonsvc.exe
2660	DllCommonsvc.exe
3920	sihost.exe
3284	sihost.exe
3552	sihost.exe
3060	sihost.exe
2624	sihost.exe
4992	sihost.exe
4840	sihost.exe
368	sihost.exe
2996	sihost.exe
2036	sihost.exe
2616	sihost.exe
4380	sihost.exe
4036	sihost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\e978f868350d50	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\fr-FR\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\56085415360792	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\fr-FR\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\66fc9ff0ee96c2	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\AppReadiness\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Windows\AppReadiness\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Windows\Cursors\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Cursors\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\diagnostics\system\Printer\de-DE\conhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5008	schtasks.exe
5112	schtasks.exe
4580	schtasks.exe
4516	schtasks.exe
3204	schtasks.exe
3204	schtasks.exe
4684	schtasks.exe
4376	schtasks.exe
3764	schtasks.exe
3864	schtasks.exe
5100	schtasks.exe
4692	schtasks.exe
3320	schtasks.exe
3876	schtasks.exe
4688	schtasks.exe
3568	schtasks.exe
3084	schtasks.exe
4204	schtasks.exe
1488	schtasks.exe
4328	schtasks.exe
3144	schtasks.exe
4912	schtasks.exe
4604	schtasks.exe
4708	schtasks.exe
4960	schtasks.exe
3144	schtasks.exe
3084	schtasks.exe
1608	schtasks.exe
3692	schtasks.exe
4196	schtasks.exe
4664	schtasks.exe
1148	schtasks.exe
3168	schtasks.exe
4228	schtasks.exe
5076	schtasks.exe
4512	schtasks.exe
4492	schtasks.exe
4632	schtasks.exe
216	schtasks.exe
3428	schtasks.exe
4228	schtasks.exe
5092	schtasks.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	4b0077a0bd18ef31c95f97b039e2f45b42872c3c1d451b2d23e181cabc3cbff7.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sihost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
4864	DllCommonsvc.exe
488	powershell.exe
4460	powershell.exe
400	powershell.exe
1328	powershell.exe
660	powershell.exe
1592	powershell.exe
1196	powershell.exe
1052	powershell.exe
1328	powershell.exe
660	powershell.exe
1196	powershell.exe
2660	DllCommonsvc.exe
1328	powershell.exe
488	powershell.exe
4460	powershell.exe
660	powershell.exe
400	powershell.exe
1592	powershell.exe
1196	powershell.exe
488	powershell.exe
2660	DllCommonsvc.exe
2660	DllCommonsvc.exe
1052	powershell.exe
4460	powershell.exe
400	powershell.exe
1592	powershell.exe
1052	powershell.exe
2660	DllCommonsvc.exe
2660	DllCommonsvc.exe
2660	DllCommonsvc.exe
2660	DllCommonsvc.exe
2660	DllCommonsvc.exe
2660	DllCommonsvc.exe
1724	powershell.exe
656	powershell.exe
1444	powershell.exe
656	powershell.exe
3328	powershell.exe
4116	powershell.exe
1760	powershell.exe
4556	powershell.exe
3328	powershell.exe
3648	powershell.exe
656	powershell.exe
4116	powershell.exe
1724	powershell.exe
3920	sihost.exe
4556	powershell.exe
3328	powershell.exe
4116	powershell.exe
1444	powershell.exe
1760	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	DllCommonsvc.exe
Token: SeDebugPrivilege	488	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeDebugPrivilege	2660	DllCommonsvc.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	660	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeIncreaseQuotaPrivilege	1328	powershell.exe
Token: SeSecurityPrivilege	1328	powershell.exe
Token: SeTakeOwnershipPrivilege	1328	powershell.exe
Token: SeLoadDriverPrivilege	1328	powershell.exe
Token: SeSystemProfilePrivilege	1328	powershell.exe
Token: SeSystemtimePrivilege	1328	powershell.exe
Token: SeProfSingleProcessPrivilege	1328	powershell.exe
Token: SeIncBasePriorityPrivilege	1328	powershell.exe
Token: SeCreatePagefilePrivilege	1328	powershell.exe
Token: SeBackupPrivilege	1328	powershell.exe
Token: SeRestorePrivilege	1328	powershell.exe
Token: SeShutdownPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeSystemEnvironmentPrivilege	1328	powershell.exe
Token: SeRemoteShutdownPrivilege	1328	powershell.exe
Token: SeUndockPrivilege	1328	powershell.exe
Token: SeManageVolumePrivilege	1328	powershell.exe
Token: 33	1328	powershell.exe
Token: 34	1328	powershell.exe
Token: 35	1328	powershell.exe
Token: 36	1328	powershell.exe
Token: SeIncreaseQuotaPrivilege	660	powershell.exe
Token: SeSecurityPrivilege	660	powershell.exe
Token: SeTakeOwnershipPrivilege	660	powershell.exe
Token: SeLoadDriverPrivilege	660	powershell.exe
Token: SeSystemProfilePrivilege	660	powershell.exe
Token: SeSystemtimePrivilege	660	powershell.exe
Token: SeProfSingleProcessPrivilege	660	powershell.exe
Token: SeIncBasePriorityPrivilege	660	powershell.exe
Token: SeCreatePagefilePrivilege	660	powershell.exe
Token: SeBackupPrivilege	660	powershell.exe
Token: SeRestorePrivilege	660	powershell.exe
Token: SeShutdownPrivilege	660	powershell.exe
Token: SeDebugPrivilege	660	powershell.exe
Token: SeSystemEnvironmentPrivilege	660	powershell.exe
Token: SeRemoteShutdownPrivilege	660	powershell.exe
Token: SeUndockPrivilege	660	powershell.exe
Token: SeManageVolumePrivilege	660	powershell.exe
Token: 33	660	powershell.exe
Token: 34	660	powershell.exe
Token: 35	660	powershell.exe
Token: 36	660	powershell.exe
Token: SeIncreaseQuotaPrivilege	1196	powershell.exe
Token: SeSecurityPrivilege	1196	powershell.exe
Token: SeTakeOwnershipPrivilege	1196	powershell.exe
Token: SeLoadDriverPrivilege	1196	powershell.exe
Token: SeSystemProfilePrivilege	1196	powershell.exe
Token: SeSystemtimePrivilege	1196	powershell.exe
Token: SeProfSingleProcessPrivilege	1196	powershell.exe
Token: SeIncBasePriorityPrivilege	1196	powershell.exe
Token: SeCreatePagefilePrivilege	1196	powershell.exe
Token: SeBackupPrivilege	1196	powershell.exe
Token: SeRestorePrivilege	1196	powershell.exe
Token: SeShutdownPrivilege	1196	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 4292	3064	4b0077a0bd18ef31c95f97b039e2f45b42872c3c1d451b2d23e181cabc3cbff7.exe	66
PID 3064 wrote to memory of 4292	3064	4b0077a0bd18ef31c95f97b039e2f45b42872c3c1d451b2d23e181cabc3cbff7.exe	66
PID 3064 wrote to memory of 4292	3064	4b0077a0bd18ef31c95f97b039e2f45b42872c3c1d451b2d23e181cabc3cbff7.exe	66
PID 4292 wrote to memory of 4840	4292	WScript.exe	67
PID 4292 wrote to memory of 4840	4292	WScript.exe	67
PID 4292 wrote to memory of 4840	4292	WScript.exe	67
PID 4840 wrote to memory of 4864	4840	cmd.exe	69
PID 4840 wrote to memory of 4864	4840	cmd.exe	69
PID 4864 wrote to memory of 4460	4864	DllCommonsvc.exe	99
PID 4864 wrote to memory of 4460	4864	DllCommonsvc.exe	99
PID 4864 wrote to memory of 400	4864	DllCommonsvc.exe	98
PID 4864 wrote to memory of 400	4864	DllCommonsvc.exe	98
PID 4864 wrote to memory of 488	4864	DllCommonsvc.exe	96
PID 4864 wrote to memory of 488	4864	DllCommonsvc.exe	96
PID 4864 wrote to memory of 660	4864	DllCommonsvc.exe	94
PID 4864 wrote to memory of 660	4864	DllCommonsvc.exe	94
PID 4864 wrote to memory of 1328	4864	DllCommonsvc.exe	92
PID 4864 wrote to memory of 1328	4864	DllCommonsvc.exe	92
PID 4864 wrote to memory of 1592	4864	DllCommonsvc.exe	100
PID 4864 wrote to memory of 1592	4864	DllCommonsvc.exe	100
PID 4864 wrote to memory of 1196	4864	DllCommonsvc.exe	101
PID 4864 wrote to memory of 1196	4864	DllCommonsvc.exe	101
PID 4864 wrote to memory of 1052	4864	DllCommonsvc.exe	105
PID 4864 wrote to memory of 1052	4864	DllCommonsvc.exe	105
PID 4864 wrote to memory of 2660	4864	DllCommonsvc.exe	107
PID 4864 wrote to memory of 2660	4864	DllCommonsvc.exe	107
PID 2660 wrote to memory of 1724	2660	DllCommonsvc.exe	131
PID 2660 wrote to memory of 1724	2660	DllCommonsvc.exe	131
PID 2660 wrote to memory of 656	2660	DllCommonsvc.exe	132
PID 2660 wrote to memory of 656	2660	DllCommonsvc.exe	132
PID 2660 wrote to memory of 1444	2660	DllCommonsvc.exe	133
PID 2660 wrote to memory of 1444	2660	DllCommonsvc.exe	133
PID 2660 wrote to memory of 3328	2660	DllCommonsvc.exe	136
PID 2660 wrote to memory of 3328	2660	DllCommonsvc.exe	136
PID 2660 wrote to memory of 4116	2660	DllCommonsvc.exe	137
PID 2660 wrote to memory of 4116	2660	DllCommonsvc.exe	137
PID 2660 wrote to memory of 3648	2660	DllCommonsvc.exe	138
PID 2660 wrote to memory of 3648	2660	DllCommonsvc.exe	138
PID 2660 wrote to memory of 1760	2660	DllCommonsvc.exe	141
PID 2660 wrote to memory of 1760	2660	DllCommonsvc.exe	141
PID 2660 wrote to memory of 4556	2660	DllCommonsvc.exe	143
PID 2660 wrote to memory of 4556	2660	DllCommonsvc.exe	143
PID 2660 wrote to memory of 3920	2660	DllCommonsvc.exe	147
PID 2660 wrote to memory of 3920	2660	DllCommonsvc.exe	147
PID 3920 wrote to memory of 4812	3920	sihost.exe	148
PID 3920 wrote to memory of 4812	3920	sihost.exe	148
PID 4812 wrote to memory of 3124	4812	cmd.exe	150
PID 4812 wrote to memory of 3124	4812	cmd.exe	150
PID 4812 wrote to memory of 3284	4812	cmd.exe	151
PID 4812 wrote to memory of 3284	4812	cmd.exe	151
PID 3284 wrote to memory of 4884	3284	sihost.exe	152
PID 3284 wrote to memory of 4884	3284	sihost.exe	152
PID 4884 wrote to memory of 1236	4884	cmd.exe	154
PID 4884 wrote to memory of 1236	4884	cmd.exe	154
PID 4884 wrote to memory of 3552	4884	cmd.exe	155
PID 4884 wrote to memory of 3552	4884	cmd.exe	155
PID 3552 wrote to memory of 3104	3552	sihost.exe	156
PID 3552 wrote to memory of 3104	3552	sihost.exe	156
PID 3104 wrote to memory of 1592	3104	cmd.exe	158
PID 3104 wrote to memory of 1592	3104	cmd.exe	158
PID 3104 wrote to memory of 3060	3104	cmd.exe	159
PID 3104 wrote to memory of 3060	3104	cmd.exe	159
PID 3060 wrote to memory of 2556	3060	sihost.exe	160
PID 3060 wrote to memory of 2556	3060	sihost.exe	160

C:\Users\Admin\AppData\Local\Temp\4b0077a0bd18ef31c95f97b039e2f45b42872c3c1d451b2d23e181cabc3cbff7.exe
"C:\Users\Admin\AppData\Local\Temp\4b0077a0bd18ef31c95f97b039e2f45b42872c3c1d451b2d23e181cabc3cbff7.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppReadiness\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchUI.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1724
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SearchUI.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:656
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\powershell.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1444
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\fr-FR\explorer.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4116
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\powershell.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3648
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1760
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4556
      - C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3124
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1236
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9gNv7qRJ8U.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1592
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l4DYpxlgJN.bat"
        13⤵
        
        PID:2556
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3080
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LW19r029AS.bat"
        15⤵
        
        PID:1624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2208
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JGN3MoCgVZ.bat"
        17⤵
        
        PID:2080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4816
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"
        19⤵
        
        PID:4028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:3248
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hC9SSnetfo.bat"
        21⤵
        
        PID:1196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3704
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EOJxze5tr1.bat"
        23⤵
        
        PID:3512
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2148
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat"
        25⤵
        
        PID:3648
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4960
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RFyBjogktz.bat"
        27⤵
        
        PID:3484
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2604
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tiBdOqTAMf.bat"
        29⤵
        
        PID:164
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4864
        
        C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe"
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat"
        31⤵
        
        PID:4568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\AppReadiness\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\AppReadiness\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\AppReadiness\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\odt\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Cursors\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Cursors\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 11 /tr "'C:\odt\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\odt\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 11 /tr "'C:\odt\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\fr-FR\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Desktop\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Default\Desktop\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Desktop\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
b4268d8ae66fdd920476b97a1776bf85

SHA1
f920de54f7467f0970eccc053d3c6c8dd181d49a

SHA256
61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879

SHA512
03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
91cd0172b9be5d1fe9d1f369e788114f

SHA1
ee1d830874b01df96d82354afa00de51700084f4

SHA256
73aa2ebb0cf0a5960f193cbd61ad68deb6e788b38c51a8e1d1cc661d3626a325

SHA512
201129d839dcb9f123ec5a76e9b963da8a727bfb8b63029fdf7795b859fda716aae5e36fb03c4e7ea4a46e32cf8213e8b39f45f9271cdf0e04ee720090d73aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3c4ab93e3938f6d9530402115f7a8f46

SHA1
03d67897b34200c087dfcf8c9d0275fa14b9894b

SHA256
c6603e0d50a97fd4152511f110fd0534898101e768a8673aae09e7754a74c27a

SHA512
1609bea8f2b55edeaace4cda961427e891b7f553cfb2be4c605e806d692887fa19682eda9f64510f70694926ad3d96cedca0b76423d22fa97782442b98f69d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3c4ab93e3938f6d9530402115f7a8f46

SHA1
03d67897b34200c087dfcf8c9d0275fa14b9894b

SHA256
c6603e0d50a97fd4152511f110fd0534898101e768a8673aae09e7754a74c27a

SHA512
1609bea8f2b55edeaace4cda961427e891b7f553cfb2be4c605e806d692887fa19682eda9f64510f70694926ad3d96cedca0b76423d22fa97782442b98f69d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3c4ab93e3938f6d9530402115f7a8f46

SHA1
03d67897b34200c087dfcf8c9d0275fa14b9894b

SHA256
c6603e0d50a97fd4152511f110fd0534898101e768a8673aae09e7754a74c27a

SHA512
1609bea8f2b55edeaace4cda961427e891b7f553cfb2be4c605e806d692887fa19682eda9f64510f70694926ad3d96cedca0b76423d22fa97782442b98f69d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c09c261a5d43b7696036df8e846f0cca

SHA1
537aa50dd7a6998eb6836d24a8ef975d5eed612a

SHA256
b1489f1330089c696c154d2d5528cacec0302a0169a437262d938d0d3316b932

SHA512
684d657cec6a29f64cc3e5ef92c8b26d80afd46a5bad14528443d807b65ac23404a4f07b63635b19279acc2f1491037fc6ead0c107bbbf7a6a26494c8d953bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c09c261a5d43b7696036df8e846f0cca

SHA1
537aa50dd7a6998eb6836d24a8ef975d5eed612a

SHA256
b1489f1330089c696c154d2d5528cacec0302a0169a437262d938d0d3316b932

SHA512
684d657cec6a29f64cc3e5ef92c8b26d80afd46a5bad14528443d807b65ac23404a4f07b63635b19279acc2f1491037fc6ead0c107bbbf7a6a26494c8d953bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4158e99cbe1e3ae856753bdb5aac59aa

SHA1
6475a9e8d6702a78dbbcb0d23d9545bab3d644cc

SHA256
fbaa696f4925f7587e5aec17bf0791a881a2075201c74b173ab4288538225636

SHA512
ecdab10f6b01627ebdbd112c52376ad755e8d50e72bf52a231fc16970a01fa0a3e01b452877f871edeb0d50cd15e5a48a73d9b3ef8c5c98a2d3f6ec9b71dfd59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4158e99cbe1e3ae856753bdb5aac59aa

SHA1
6475a9e8d6702a78dbbcb0d23d9545bab3d644cc

SHA256
fbaa696f4925f7587e5aec17bf0791a881a2075201c74b173ab4288538225636

SHA512
ecdab10f6b01627ebdbd112c52376ad755e8d50e72bf52a231fc16970a01fa0a3e01b452877f871edeb0d50cd15e5a48a73d9b3ef8c5c98a2d3f6ec9b71dfd59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2af56f722709b0f1837e60c5d1870804

SHA1
dcdd030b7ca4a939b60865f73e346bb1d6a1a688

SHA256
1aea5f603ad25c32242cf1a83abee8391400227039040f9e52c50ca998879b5b

SHA512
5844633e5adb4c3b5f8e90cd1c21a118619f24fb65e5c786595733bf5a5a92d84ab81ae69c56d071bf86e86d5dbc1f2805461ac07b729528ed1dc542122aa6b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4debf4a712a12f5b01262cbe9c6bc620

SHA1
9574ccb15d94845153cb753d6c4c6b93739bf502

SHA256
72858576b62a5184a0aa54211edebaf7a8bd7f404392783e3af32f458861beb8

SHA512
9777247b739eb067d8fb10f4eb0f659c5f95ba653cc01dadce30568b6b7d8063f954647bfae4824e6ff9be2e9a72493580a6f973af3b50f1b588188e92034a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4debf4a712a12f5b01262cbe9c6bc620

SHA1
9574ccb15d94845153cb753d6c4c6b93739bf502

SHA256
72858576b62a5184a0aa54211edebaf7a8bd7f404392783e3af32f458861beb8

SHA512
9777247b739eb067d8fb10f4eb0f659c5f95ba653cc01dadce30568b6b7d8063f954647bfae4824e6ff9be2e9a72493580a6f973af3b50f1b588188e92034a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
13dbd5384dd05f020b6b7b93ea8e6ca7

SHA1
79945058381cb4483ce74f920494f434243760c8

SHA256
9a8133a4d436bb5a67518e9927c8516dcc5cd583b707e9b79af7776d512d685f

SHA512
f3fe95b21be61ebd05dcb178b03dea481901b4cebefc1ae59499f18f6392ba775df3c02b1f60d82a910aff6c738b75cabeab402ea531934c9ccb422bdf147e9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
13dbd5384dd05f020b6b7b93ea8e6ca7

SHA1
79945058381cb4483ce74f920494f434243760c8

SHA256
9a8133a4d436bb5a67518e9927c8516dcc5cd583b707e9b79af7776d512d685f

SHA512
f3fe95b21be61ebd05dcb178b03dea481901b4cebefc1ae59499f18f6392ba775df3c02b1f60d82a910aff6c738b75cabeab402ea531934c9ccb422bdf147e9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e4bc26382c4081d04760e4e1554484c1

SHA1
0d34819f5026e17a7af37f95fa9920e28b5df02a

SHA256
334cfd40d95a64fdc9cbc1a890e7a7b454aff3f3b85aad1db2f2ac425c7b2edc

SHA512
78987b156ecb57ae7fce60efe8023090aa8cfaa5b19bdb642f3e3faa98121421bc9316a7724796c9e4b25ece1d6471dee239334ff6c261c796d04f42c3d5db6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d75cbe0876c008dfe4682a81a91cf22a

SHA1
218964c8c9572ee4596ea413b4fcad8539b3e021

SHA256
baf442f6abfd21dad3915477f7cccd91d2c7ddd190265a3a04be68b845cad182

SHA512
1ac4b335ee9a8ad13d7617322a68f1b374cf02ea61e3db027116012090a0909334891891efbf50ada56101a3399bf3e772e7c04426aac0e362c66a509bf4edc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\9gNv7qRJ8U.bat

Filesize
226B

MD5
9586199fbe742061944d2e47a73c2e0e

SHA1
d28fda3343353e99f8f1980252ffb6e4bd52535e

SHA256
73503914478cd04f837375864bc50b000786bdd0ee2229c828662c494c01bcfc

SHA512
2d6f66d7e2f5ddb66f9f28c99eab630f5de66ff586811167ba44dc8e4b917a5b2a13dc50bf25341961088503f4223d3ed627d8d2b7df5f8438d58672b10a7201

Download Submit
C:\Users\Admin\AppData\Local\Temp\EOJxze5tr1.bat

Filesize
226B

MD5
b924f628b085a67bf65badbb9367dfcc

SHA1
8c6666521ac7d384ce55657aae5a30c4be1aac30

SHA256
5960ac49af37f63870c28884141b5bcc43d41b800d234ed42a9d4e58ec4d66ad

SHA512
1d81b5025eefa31cf6bc298f569f6bb1ab56fc18b997d0a6383760368b3e9deca28d64a1f279e0ca3941b063a5dfcf01fea1007ebd516c218e6fec4db40a48e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\JGN3MoCgVZ.bat

Filesize
226B

MD5
12222f71ff61593a4db43d35e6b687cc

SHA1
0baa6fd69ef45385600703b102b3714d574ddbf3

SHA256
c59c7f3a8e8947aa06f773114047b86d7254b15edf292d16eb3dcbf70e80d34b

SHA512
6be5713cc7aeef8d6055fcf3c33c0ef77bff41e4921804c0e6da977d493a0e4c7fc7d151cac2ef98ea4b77801a7442839285bd5a43ad653130eb578e9724e022

Download Submit
C:\Users\Admin\AppData\Local\Temp\LW19r029AS.bat

Filesize
226B

MD5
308c98cbdb5f887f3235ea8736a00942

SHA1
88333d721558f70839d931440983574ef7963d66

SHA256
a1ab3356808c2b078af083ae295dfe8322e0b0378750bebee785e1efce3b0b2f

SHA512
11b317c3379a5d46d46dbf8f3125e318eff3ea176809cabe45ec77c95d44931f692d1ca5dbe572911bc3e200dced6b8233a9f99e23fb9be52afc2a3d2df54a80

Download Submit
C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat

Filesize
226B

MD5
bf5ab1ee0ef9b9e19b57e548264de652

SHA1
655076514e99d9874421f7a002264dfaf1d4a014

SHA256
8b34068dd94afa667c828e95a9c201f244d54540181de202cd1ea675c95e507f

SHA512
3fc6a1cbae96716abb1337ab2ac202488ce3fc8156c9a8660062546eee61c0baff7ae8f9981046037b58956a3500534513421fa4bd0aeeb892710cbdee236a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\QLJ4q7S46F.bat

Filesize
226B

MD5
f96757a149afc98d9dc3c226f3ebcd10

SHA1
60726d82fd319d771d46769236a9c39ce9058e78

SHA256
51fac3abfba01d8885dac06fe015e96b3b8aeb0956414d6917091859261f0298

SHA512
3bbae0cf7a5fbb05c23d485c8d1a3674100bad372e8941faabd22f0734417df33e07a35064829d67e2dc7f96711997efa0c3d653b64e9a7ef407d069580bcea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RFyBjogktz.bat

Filesize
226B

MD5
f0928b06a104f2d59385cc6ec66c4e8e

SHA1
f3443edf7186358bc5692ee21c3a7bbfcb118512

SHA256
9d8aaa25757b5dc7e17210758ca278efa39560850f8fc51eefcd3148c602b08a

SHA512
4fc6ebc107915c89248857e606624aedacc604ff77ee2cf2fc6577061075c6ea9466773a831d9775a0588eed5f28fb6750453f2d255851dbb9507579e96fb207

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat

Filesize
226B

MD5
52f89fe0235e618d35057d11712f84d3

SHA1
b6d726e848e53cad9cce0676536ef610c7406514

SHA256
22c62d148af2856aaeb2446ef95b757f47784c145c07db1d72ace4e0b98f5105

SHA512
4284203842771895971c268c6e563b9a92e13df29ab7461c7f39b28e100fa17703d81dd1a5f97de85d0515f85bc2fc40beccacd39a317f5329b07d8b61e72d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat

Filesize
226B

MD5
8560acea905dabbc4ce0fe216296a22d

SHA1
de2e3c8ed0ed58848a6b94eac4ec1e28f688ee11

SHA256
bc1c65798da46859dd1fd400d0a810cf204c92ab5b0b4b144c074d6a51b02c24

SHA512
e4af92c098fdaaa23c9beac36b14dfbd381c0a80172f650762e4b690ea342e927056db19c1d71721ca0aa4eb8fe048ad9d0fc4fad663245e2a7589545ec6f353

Download Submit
C:\Users\Admin\AppData\Local\Temp\hC9SSnetfo.bat

Filesize
226B

MD5
f746930e0fbe588073675d1bf51d7eca

SHA1
f669d4be0d4c09a0ac72c87ed8e290f6a647eb90

SHA256
50cb7dcb9fe18b983ffe9f5ddf3d8e5bd5c0618a815735fdad9f24c2f03d3c80

SHA512
2df67498b7d0375d42bb4c14648a0fc5a50279a94de55e6869dead3ed52cd7f9e978bea82b60d72574f0766d186c18fabc688896452a1953ec62552bde589d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\l4DYpxlgJN.bat

Filesize
226B

MD5
f7cc9ab2f08d6ff02fb95855e1dd002f

SHA1
0051ac5b047965f9c18be5b780852585c0753437

SHA256
b77ddcc15c82c31a7f9bd12aa7fa7e551e27f67f5ed1c4ce948120ff43a55b68

SHA512
9aab0cd81959539199abc21522fac4f5cd9bb3c6c21cdf4c513045fdfff6c0609585c3a7d6f99ae79e19d53889f3d60a5963809df79a783a44212f8d9a46a2d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tiBdOqTAMf.bat

Filesize
226B

MD5
ff2057466ce73c3ed6acd9d302e7c2aa

SHA1
9f731f45bbf93fce2f6a29cebbc4a7693b674d0b

SHA256
c15740005942abb6ebf81bccd38f82ab7d48e866cad0a351c10bf72d711b8afa

SHA512
2a7fb3148db915b5d517ed0def76fffc9550d5fc8088c4bc0beaeff23fe0db0c7a630b40474bd2b2a6ecc9990da190354180047b0a814cbf941280726cd589d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat

Filesize
226B

MD5
bb99d2f3c129f83e22e02bf437feb5d3

SHA1
c29d4619fbbfa39a1ee581f823dcd9797f10b662

SHA256
7f2298c53b4d57304d485d884bd50f004aa5cdc09de543682eaf912a499913ef

SHA512
8d9da02c3350c23818e3e7d48b5f41d9ba262aa03bdb63e5a410f3e82bfecd53c9a0971528ada0e6a79a18d975489dcc0b919e536fa3486d05b235d1705a7501

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/368-894-0x0000000001300000-0x0000000001312000-memory.dmp

Filesize
72KB

Download
memory/488-329-0x000001FEA7060000-0x000001FEA7082000-memory.dmp

Filesize
136KB

Download
memory/1328-334-0x000001E7F1220000-0x000001E7F1296000-memory.dmp

Filesize
472KB

Download
memory/2036-905-0x0000000001010000-0x0000000001022000-memory.dmp

Filesize
72KB

Download
memory/2660-330-0x0000000000A00000-0x0000000000A12000-memory.dmp

Filesize
72KB

Download
memory/3064-147-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-182-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-173-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-174-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-178-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-172-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-171-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-166-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-167-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-169-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-170-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-168-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-165-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-164-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-117-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-163-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-162-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-118-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-119-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-121-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-122-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-124-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-125-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-161-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-160-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-158-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-159-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-175-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-126-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-154-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-127-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-156-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-157-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-155-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-153-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-152-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-146-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-151-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-128-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-150-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-148-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-130-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-149-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-129-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-131-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-145-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-132-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-144-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-143-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-135-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-142-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-176-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-140-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-134-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-179-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-141-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-116-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-138-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-177-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-136-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-139-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-133-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3064-137-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/3920-619-0x00000000010B0000-0x00000000010C2000-memory.dmp

Filesize
72KB

Download
memory/4036-921-0x0000000001370000-0x0000000001382000-memory.dmp

Filesize
72KB

Download
memory/4292-181-0x0000000076FE0000-0x000000007716E000-memory.dmp

Filesize
1.6MB

Download
memory/4840-888-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

Filesize
72KB

Download
memory/4864-285-0x000000001BC40000-0x000000001BC4C000-memory.dmp

Filesize
48KB

Download
memory/4864-283-0x000000001BC30000-0x000000001BC42000-memory.dmp

Filesize
72KB

Download
memory/4864-286-0x000000001BC50000-0x000000001BC5C000-memory.dmp

Filesize
48KB

Download
memory/4864-284-0x000000001BC60000-0x000000001BC6C000-memory.dmp

Filesize
48KB

Download
memory/4864-282-0x0000000000FE0000-0x00000000010F0000-memory.dmp

Filesize
1.1MB

Download