dcrat | 9370a7908151a19c3fbb56983e73b67df5d7bb4eb601d734506a64d87d67c99e

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9370a7908151a19c3fbb56983e73b67df5d7bb4eb601d734506a64d87d67c99e.exe
Size

1.3MB
MD5

15cba7c111e92431ea054ea50f4ce639
SHA1

fcead8d2d7c4c2169f3d6436d2bb1c14594eba46
SHA256

9370a7908151a19c3fbb56983e73b67df5d7bb4eb601d734506a64d87d67c99e
SHA512

5fb65c81e8fa59b3e4480894ae67f649807d39f92ad0ba5e584f47c43e2d0dfcf389931a72fb2138ac940e2ea85c6f989d6bfa3140c5ab08bd94e2546759edf2
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	528	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	528	schtasks.exe	71

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000022e13-137.dat	dcrat
behavioral1/files/0x0006000000022e13-138.dat	dcrat
behavioral1/memory/2324-139-0x0000000000170000-0x0000000000280000-memory.dmp	dcrat
behavioral1/files/0x0006000000022e20-155.dat	dcrat
behavioral1/files/0x0006000000022e20-154.dat	dcrat
behavioral1/files/0x0006000000022e20-196.dat	dcrat
behavioral1/files/0x0006000000022e20-204.dat	dcrat
behavioral1/files/0x0006000000022e20-211.dat	dcrat
behavioral1/files/0x0006000000022e20-218.dat	dcrat
behavioral1/files/0x0006000000022e20-225.dat	dcrat
behavioral1/files/0x0006000000022e20-232.dat	dcrat
behavioral1/files/0x0006000000022e20-239.dat	dcrat
behavioral1/files/0x0006000000022e20-246.dat	dcrat
behavioral1/files/0x0006000000022e20-253.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
2324	DllCommonsvc.exe
1868	dwm.exe
708	dwm.exe
1772	dwm.exe
2792	dwm.exe
2960	dwm.exe
4988	dwm.exe
504	dwm.exe
4484	dwm.exe
1984	dwm.exe
2436	dwm.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	9370a7908151a19c3fbb56983e73b67df5d7bb4eb601d734506a64d87d67c99e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dwm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\eddb19405b7ce1	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\BrowserCore\backgroundTaskHost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3696	schtasks.exe
4140	schtasks.exe
3420	schtasks.exe
3848	schtasks.exe
956	schtasks.exe
1860	schtasks.exe
3372	schtasks.exe
5016	schtasks.exe
4424	schtasks.exe
3536	schtasks.exe
3980	schtasks.exe
396	schtasks.exe
4568	schtasks.exe
5096	schtasks.exe
4100	schtasks.exe
4388	schtasks.exe
4504	schtasks.exe
1780	schtasks.exe
1836	schtasks.exe
4416	schtasks.exe
2632	schtasks.exe
5072	schtasks.exe
1380	schtasks.exe
3484	schtasks.exe
3496	schtasks.exe
2984	schtasks.exe
3664	schtasks.exe
2824	schtasks.exe
4304	schtasks.exe
2708	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	9370a7908151a19c3fbb56983e73b67df5d7bb4eb601d734506a64d87d67c99e.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dwm.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2324	DllCommonsvc.exe
2324	DllCommonsvc.exe
2324	DllCommonsvc.exe
2324	DllCommonsvc.exe
2324	DllCommonsvc.exe
2324	DllCommonsvc.exe
2324	DllCommonsvc.exe
2324	DllCommonsvc.exe
2324	DllCommonsvc.exe
2324	DllCommonsvc.exe
2324	DllCommonsvc.exe
5060	powershell.exe
5060	powershell.exe
4988	powershell.exe
4988	powershell.exe
332	powershell.exe
332	powershell.exe
3280	powershell.exe
3280	powershell.exe
3580	powershell.exe
3580	powershell.exe
3796	powershell.exe
3796	powershell.exe
1968	powershell.exe
1968	powershell.exe
2436	powershell.exe
2436	powershell.exe
1200	powershell.exe
1200	powershell.exe
2260	powershell.exe
2260	powershell.exe
3436	powershell.exe
3436	powershell.exe
1868	dwm.exe
1868	dwm.exe
3280	powershell.exe
4988	powershell.exe
332	powershell.exe
5060	powershell.exe
3796	powershell.exe
3580	powershell.exe
1968	powershell.exe
2436	powershell.exe
3436	powershell.exe
1200	powershell.exe
2260	powershell.exe
708	dwm.exe
1772	dwm.exe
2792	dwm.exe
2960	dwm.exe
4988	dwm.exe
504	dwm.exe
4484	dwm.exe
1984	dwm.exe
2436	dwm.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	DllCommonsvc.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	332	powershell.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	1868	dwm.exe
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	708	dwm.exe
Token: SeDebugPrivilege	1772	dwm.exe
Token: SeDebugPrivilege	2792	dwm.exe
Token: SeDebugPrivilege	2960	dwm.exe
Token: SeDebugPrivilege	4988	dwm.exe
Token: SeDebugPrivilege	504	dwm.exe
Token: SeDebugPrivilege	4484	dwm.exe
Token: SeDebugPrivilege	1984	dwm.exe
Token: SeDebugPrivilege	2436	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4116	4800	9370a7908151a19c3fbb56983e73b67df5d7bb4eb601d734506a64d87d67c99e.exe	82
PID 4800 wrote to memory of 4116	4800	9370a7908151a19c3fbb56983e73b67df5d7bb4eb601d734506a64d87d67c99e.exe	82
PID 4800 wrote to memory of 4116	4800	9370a7908151a19c3fbb56983e73b67df5d7bb4eb601d734506a64d87d67c99e.exe	82
PID 4116 wrote to memory of 4432	4116	WScript.exe	86
PID 4116 wrote to memory of 4432	4116	WScript.exe	86
PID 4116 wrote to memory of 4432	4116	WScript.exe	86
PID 4432 wrote to memory of 2324	4432	cmd.exe	88
PID 4432 wrote to memory of 2324	4432	cmd.exe	88
PID 2324 wrote to memory of 2436	2324	DllCommonsvc.exe	120
PID 2324 wrote to memory of 2436	2324	DllCommonsvc.exe	120
PID 2324 wrote to memory of 4988	2324	DllCommonsvc.exe	121
PID 2324 wrote to memory of 4988	2324	DllCommonsvc.exe	121
PID 2324 wrote to memory of 5060	2324	DllCommonsvc.exe	123
PID 2324 wrote to memory of 5060	2324	DllCommonsvc.exe	123
PID 2324 wrote to memory of 3280	2324	DllCommonsvc.exe	125
PID 2324 wrote to memory of 3280	2324	DllCommonsvc.exe	125
PID 2324 wrote to memory of 3580	2324	DllCommonsvc.exe	126
PID 2324 wrote to memory of 3580	2324	DllCommonsvc.exe	126
PID 2324 wrote to memory of 332	2324	DllCommonsvc.exe	127
PID 2324 wrote to memory of 332	2324	DllCommonsvc.exe	127
PID 2324 wrote to memory of 1968	2324	DllCommonsvc.exe	129
PID 2324 wrote to memory of 1968	2324	DllCommonsvc.exe	129
PID 2324 wrote to memory of 3796	2324	DllCommonsvc.exe	142
PID 2324 wrote to memory of 3796	2324	DllCommonsvc.exe	142
PID 2324 wrote to memory of 1200	2324	DllCommonsvc.exe	141
PID 2324 wrote to memory of 1200	2324	DllCommonsvc.exe	141
PID 2324 wrote to memory of 2260	2324	DllCommonsvc.exe	134
PID 2324 wrote to memory of 2260	2324	DllCommonsvc.exe	134
PID 2324 wrote to memory of 3436	2324	DllCommonsvc.exe	135
PID 2324 wrote to memory of 3436	2324	DllCommonsvc.exe	135
PID 2324 wrote to memory of 1868	2324	DllCommonsvc.exe	140
PID 2324 wrote to memory of 1868	2324	DllCommonsvc.exe	140
PID 1868 wrote to memory of 5080	1868	dwm.exe	145
PID 1868 wrote to memory of 5080	1868	dwm.exe	145
PID 5080 wrote to memory of 4960	5080	cmd.exe	147
PID 5080 wrote to memory of 4960	5080	cmd.exe	147
PID 5080 wrote to memory of 708	5080	cmd.exe	148
PID 5080 wrote to memory of 708	5080	cmd.exe	148
PID 708 wrote to memory of 4628	708	dwm.exe	150
PID 708 wrote to memory of 4628	708	dwm.exe	150
PID 4628 wrote to memory of 3144	4628	cmd.exe	152
PID 4628 wrote to memory of 3144	4628	cmd.exe	152
PID 4628 wrote to memory of 1772	4628	cmd.exe	153
PID 4628 wrote to memory of 1772	4628	cmd.exe	153
PID 1772 wrote to memory of 2020	1772	dwm.exe	156
PID 1772 wrote to memory of 2020	1772	dwm.exe	156
PID 2020 wrote to memory of 384	2020	cmd.exe	155
PID 2020 wrote to memory of 384	2020	cmd.exe	155
PID 2020 wrote to memory of 2792	2020	cmd.exe	157
PID 2020 wrote to memory of 2792	2020	cmd.exe	157
PID 2792 wrote to memory of 4964	2792	dwm.exe	158
PID 2792 wrote to memory of 4964	2792	dwm.exe	158
PID 4964 wrote to memory of 1620	4964	cmd.exe	160
PID 4964 wrote to memory of 1620	4964	cmd.exe	160
PID 4964 wrote to memory of 2960	4964	cmd.exe	161
PID 4964 wrote to memory of 2960	4964	cmd.exe	161
PID 2960 wrote to memory of 3796	2960	dwm.exe	162
PID 2960 wrote to memory of 3796	2960	dwm.exe	162
PID 3796 wrote to memory of 4980	3796	cmd.exe	164
PID 3796 wrote to memory of 4980	3796	cmd.exe	164
PID 3796 wrote to memory of 4988	3796	cmd.exe	165
PID 3796 wrote to memory of 4988	3796	cmd.exe	165
PID 4988 wrote to memory of 4220	4988	dwm.exe	167
PID 4988 wrote to memory of 4220	4988	dwm.exe	167

C:\Users\Admin\AppData\Local\Temp\9370a7908151a19c3fbb56983e73b67df5d7bb4eb601d734506a64d87d67c99e.exe
"C:\Users\Admin\AppData\Local\Temp\9370a7908151a19c3fbb56983e73b67df5d7bb4eb601d734506a64d87d67c99e.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3436
    - - C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe
        
        "C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1868
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aPx44ABVco.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4960
        
        C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe
        
        "C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xAFUrPKKMy.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3144
        
        C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe
        
        "C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe
        
        "C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GvLkm7sAXX.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1620
        
        C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe
        
        "C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fH1ASKIIFN.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4980
        
        C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe
        
        "C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jFR8woBO6B.bat"
        16⤵
        
        PID:4220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3136
        
        C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe
        
        "C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hD3D8PLBZ9.bat"
        18⤵
        
        PID:1836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:628
        
        C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe
        
        "C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cLz7lFEPwa.bat"
        20⤵
        
        PID:5096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:5060
        
        C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe
        
        "C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\syYKg8QxNI.bat"
        22⤵
        
        PID:1800
        
        C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe
        
        "C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe"
        23⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dXV640YnNf.bat"
        24⤵
        
        PID:3472
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\backgroundTaskHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:956

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:384

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\GvLkm7sAXX.bat

Filesize
216B

MD5
d24994a400b556c34373caab4a8b37f6

SHA1
db33b1ef63c8e242f21a555bc32ee69c3716d4a1

SHA256
7023bbfa95557f7216eae809f7464e29669bd7a4b4665a48667f74f35bbc358b

SHA512
3b0239764a6217ffc8b9549f8e61aa73144610e9d746d486d74b5e097ff077e34fe333e5cdd3722556b0c031ed3a988df0c7e2af4779eca85a581203d8e04f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\aPx44ABVco.bat

Filesize
216B

MD5
2ee358aa685831bf9481f1f4c8f8961d

SHA1
bcbd8841b39842fcdd433d245def8d33be8eaf1d

SHA256
d7ba44b5116e468509037ff24a7ef5a0a51ae5e20b62d9c6b7a37b9ddb60d5ee

SHA512
fd2cde5fe7936902c64ba1d83e7980502c1b288bdc156d6e7090df915dc9a6bdfcd011c03f4f7ae49e8fd30cd2da3ebcc456cb7ca951cc39ef63ae916fd92ad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cLz7lFEPwa.bat

Filesize
216B

MD5
4f872415a7b9829054b33275cd43251b

SHA1
1df31ff29ed345d102b993bbfd44c7be995460a3

SHA256
c173e9ac4194032fbee4b10658c6a65202f4a48151d149c81f55280f968a5c4f

SHA512
a78d6c79fff6d2a129016414fcb0083343279814e8db95c7824bd2c58f6e3fc427d88564058ae22133d5a5a888893687a13a38f5abe7e7b17fff2300258db751

Download Submit
C:\Users\Admin\AppData\Local\Temp\dXV640YnNf.bat

Filesize
216B

MD5
99654283bc8afb2969f915df525e6eab

SHA1
96efa9a708607ea1db75add570d33d00e7dbbf85

SHA256
25a04840a5a34f3b35152aab9d5ef5a3c9f73a12ce8fa1e676e8f61eeeb6b081

SHA512
10c1d17c2572626677cd034dc59741023cdc0238d48e621e57a798e75e7e1420b4837b150ecbf980aa612ce47110b9b7013925901faa89a40c395c01422cc8f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\fH1ASKIIFN.bat

Filesize
216B

MD5
6acd6073a377d2557fb2f7f92014bb7e

SHA1
c9db99798be8039832ed726f3dc4e6082083e4c5

SHA256
663f6694d4056675c94d2e922dcc3195ca170e4debe16ede32447c948e33eaeb

SHA512
e408b0d9b807fe16d8947b398b7a18126212c0e1c1f001aab337cada516098f44d767fc86653f26146dead277ac7103eecb62b4cb37ed2649a060bb08941b36d

Download Submit
C:\Users\Admin\AppData\Local\Temp\hD3D8PLBZ9.bat

Filesize
216B

MD5
e6b08a1657bfd5699e336dce1ea09e24

SHA1
9430f659bbc09fbf143f18224b422142b9211036

SHA256
0d81ab0aac46a2c5fa94f22bd5e9ad7cc7cb64cda756f1e0a858af23ea5b1505

SHA512
89c5d6a2d4a254434bc61b78b0260d68b2aa31a37c873c533c645c9439c0759772a12df293e1db9a47737ad6c7742f2e13775eb13371d70b6f97f1965491cb85

Download Submit
C:\Users\Admin\AppData\Local\Temp\jFR8woBO6B.bat

Filesize
216B

MD5
d7d1675e6eeeaa685a77bfc73354dc19

SHA1
4e47163917a6ad8cc4f58dd3d26521eee9cb639e

SHA256
7ade14b8931b4d9076275a584e0fe0ee90e0fdb579e08bf9b552cc18b2445487

SHA512
25ee10931452cb62b13007375c037f0c243813b8b248b389cc3305263e87a8f2a0462ee8174bb584a6d2b5c2904e486ea27bcf76a44ab23ea45626d1918e4ae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\syYKg8QxNI.bat

Filesize
216B

MD5
c6ff1ed33771483b8163784eb13e5550

SHA1
fa4cdac0842d88cef71ac038dad9757d62bd184d

SHA256
af4ed2ca7ce4a0d6181fa7e1ee9c5c5bb18852cc8b1e52d4a71458846e5fb8f8

SHA512
37a9be81526c4d53886b82dea79443b0243ace3a35417c9f37648ca2d558151fded8c47810639e6cd316d8db6295361b078670bdbb8bd198889abfd336cf757d

Download Submit
C:\Users\Admin\AppData\Local\Temp\xAFUrPKKMy.bat

Filesize
216B

MD5
3dd0fdd9f042e7cd7901ccab8cc747dc

SHA1
c2c7b3bf438aaa2e94ef9560409240613d91eeab

SHA256
a7148b21078f3097c0ad7dc53dc264bce74c2b2ad68962129a827fe7498e3600

SHA512
92ca358e5d76f7c1af90a01c74d11c6eb239e4c7bb3edd5a682e3d1262983d6821b745e1744ef4fdc65fa3e40c51435651d61c6ea972a1d50c29bc4188cd42fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat

Filesize
216B

MD5
243751023c1b073fb66a1a6d4ca68e9f

SHA1
c5ddf8cabc416df1fd68cf964ba52be96ae2ec3b

SHA256
eb564a0ddb6abd02995ec534abe058e5226a1f00203822fdc9d43a1ec29b1e10

SHA512
e17b51967353d5949ecda01249be1cfbf3e5fbbc0d53c1b5bd7119ef8bb97f4c35e3144b675d934b50e577374c32a06ca84d8c0ce9d63176c3676c82b58df9a0

Download Submit
C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/332-181-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/332-161-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/504-237-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/504-233-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/708-202-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/708-198-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/1200-164-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/1200-186-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/1772-209-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/1772-205-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/1868-167-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/1868-194-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/1968-162-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/1968-179-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/1984-247-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/1984-251-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2260-165-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2260-190-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2324-139-0x0000000000170000-0x0000000000280000-memory.dmp

Filesize
1.1MB

Download
memory/2324-140-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2324-158-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2436-168-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2436-176-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2436-254-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2436-258-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2792-216-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2792-212-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2960-219-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/2960-223-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/3280-159-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/3280-156-0x00000216C69F0000-0x00000216C6A12000-memory.dmp

Filesize
136KB

Download
memory/3280-183-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/3436-166-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/3436-189-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/3580-160-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/3580-182-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/3796-163-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/3796-178-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/4484-240-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/4484-244-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/4988-153-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/4988-230-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/4988-226-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/4988-184-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/5060-157-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download
memory/5060-175-0x00007FFE355A0000-0x00007FFE36061000-memory.dmp

Filesize
10.8MB

Download