dcrat | 6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc

Analysis

max time kernel
151s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe
Size

1.3MB
MD5

2ccbec0d52d71b3a44b1bb2b476a04dd
SHA1

119fc4f2fde76f08afc8f4ee62357d4f46c85146
SHA256

6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc
SHA512

8c37e9958fab698a33b5af9ab6b672495376df1147812963de02f848b545baa8051f0fdf4b3f84cedfac873ae99ed3fb1b315928a015c6151c13ed11461605ee
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	504	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	1300	schtasks.exe	54
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	1300	schtasks.exe	54

DCRat payload 16 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0003000000000727-137.dat	dcrat
behavioral1/files/0x0003000000000727-138.dat	dcrat
behavioral1/memory/1400-139-0x00000000004C0000-0x00000000005D0000-memory.dmp	dcrat
behavioral1/files/0x000200000001e59f-152.dat	dcrat
behavioral1/files/0x000200000001e59f-153.dat	dcrat
behavioral1/files/0x000200000001e59f-188.dat	dcrat
behavioral1/files/0x000200000001e59f-196.dat	dcrat
behavioral1/files/0x000200000001e59f-203.dat	dcrat
behavioral1/files/0x000200000001e59f-210.dat	dcrat
behavioral1/files/0x000200000001e59f-217.dat	dcrat
behavioral1/files/0x000200000001e59f-224.dat	dcrat
behavioral1/files/0x000200000001e59f-231.dat	dcrat
behavioral1/files/0x000200000001e59f-238.dat	dcrat
behavioral1/files/0x000200000001e59f-245.dat	dcrat
behavioral1/files/0x000200000001e59f-252.dat	dcrat
behavioral1/files/0x000200000001e59f-259.dat	dcrat

Executes dropped EXE 13 IoCs

pid	Process
1400	DllCommonsvc.exe
1432	conhost.exe
4072	conhost.exe
4732	conhost.exe
3796	conhost.exe
3412	conhost.exe
1944	conhost.exe
4400	conhost.exe
4752	conhost.exe
4028	conhost.exe
3056	conhost.exe
4772	conhost.exe
2592	conhost.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\ja-JP\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\ja-JP\RuntimeBroker.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\GameBarPresenceWriter\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\GameBarPresenceWriter\a76d7bf15d8370	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2588	schtasks.exe
4024	schtasks.exe
2504	schtasks.exe
4304	schtasks.exe
4248	schtasks.exe
2752	schtasks.exe
1944	schtasks.exe
5076	schtasks.exe
4032	schtasks.exe
740	schtasks.exe
4996	schtasks.exe
4372	schtasks.exe
3044	schtasks.exe
116	schtasks.exe
4020	schtasks.exe
4256	schtasks.exe
3576	schtasks.exe
4004	schtasks.exe
3920	schtasks.exe
4236	schtasks.exe
3772	schtasks.exe
3840	schtasks.exe
4800	schtasks.exe
504	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1400	DllCommonsvc.exe
4872	powershell.exe
4872	powershell.exe
1788	powershell.exe
1788	powershell.exe
1852	powershell.exe
1852	powershell.exe
3952	powershell.exe
3952	powershell.exe
3200	powershell.exe
3200	powershell.exe
1648	powershell.exe
3428	powershell.exe
1648	powershell.exe
3428	powershell.exe
3448	powershell.exe
3448	powershell.exe
1700	powershell.exe
1700	powershell.exe
1432	conhost.exe
1432	conhost.exe
4872	powershell.exe
1788	powershell.exe
3448	powershell.exe
1648	powershell.exe
3428	powershell.exe
1852	powershell.exe
3200	powershell.exe
3952	powershell.exe
1700	powershell.exe
4072	conhost.exe
4732	conhost.exe
3796	conhost.exe
3412	conhost.exe
1944	conhost.exe
4400	conhost.exe
4752	conhost.exe
4028	conhost.exe
3056	conhost.exe
4772	conhost.exe
2592	conhost.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	DllCommonsvc.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1432	conhost.exe
Token: SeDebugPrivilege	4072	conhost.exe
Token: SeDebugPrivilege	4732	conhost.exe
Token: SeDebugPrivilege	3796	conhost.exe
Token: SeDebugPrivilege	3412	conhost.exe
Token: SeDebugPrivilege	1944	conhost.exe
Token: SeDebugPrivilege	4400	conhost.exe
Token: SeDebugPrivilege	4752	conhost.exe
Token: SeDebugPrivilege	4028	conhost.exe
Token: SeDebugPrivilege	3056	conhost.exe
Token: SeDebugPrivilege	4772	conhost.exe
Token: SeDebugPrivilege	2592	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 420	1612	6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe	81
PID 1612 wrote to memory of 420	1612	6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe	81
PID 1612 wrote to memory of 420	1612	6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe	81
PID 420 wrote to memory of 664	420	WScript.exe	85
PID 420 wrote to memory of 664	420	WScript.exe	85
PID 420 wrote to memory of 664	420	WScript.exe	85
PID 664 wrote to memory of 1400	664	cmd.exe	87
PID 664 wrote to memory of 1400	664	cmd.exe	87
PID 1400 wrote to memory of 3428	1400	DllCommonsvc.exe	112
PID 1400 wrote to memory of 3428	1400	DllCommonsvc.exe	112
PID 1400 wrote to memory of 4872	1400	DllCommonsvc.exe	116
PID 1400 wrote to memory of 4872	1400	DllCommonsvc.exe	116
PID 1400 wrote to memory of 1788	1400	DllCommonsvc.exe	113
PID 1400 wrote to memory of 1788	1400	DllCommonsvc.exe	113
PID 1400 wrote to memory of 1852	1400	DllCommonsvc.exe	114
PID 1400 wrote to memory of 1852	1400	DllCommonsvc.exe	114
PID 1400 wrote to memory of 3448	1400	DllCommonsvc.exe	119
PID 1400 wrote to memory of 3448	1400	DllCommonsvc.exe	119
PID 1400 wrote to memory of 3952	1400	DllCommonsvc.exe	120
PID 1400 wrote to memory of 3952	1400	DllCommonsvc.exe	120
PID 1400 wrote to memory of 3200	1400	DllCommonsvc.exe	122
PID 1400 wrote to memory of 3200	1400	DllCommonsvc.exe	122
PID 1400 wrote to memory of 1648	1400	DllCommonsvc.exe	129
PID 1400 wrote to memory of 1648	1400	DllCommonsvc.exe	129
PID 1400 wrote to memory of 1700	1400	DllCommonsvc.exe	124
PID 1400 wrote to memory of 1700	1400	DllCommonsvc.exe	124
PID 1400 wrote to memory of 1432	1400	DllCommonsvc.exe	131
PID 1400 wrote to memory of 1432	1400	DllCommonsvc.exe	131
PID 1432 wrote to memory of 4308	1432	conhost.exe	135
PID 1432 wrote to memory of 4308	1432	conhost.exe	135
PID 4308 wrote to memory of 3552	4308	cmd.exe	136
PID 4308 wrote to memory of 3552	4308	cmd.exe	136
PID 4308 wrote to memory of 4072	4308	cmd.exe	137
PID 4308 wrote to memory of 4072	4308	cmd.exe	137
PID 4072 wrote to memory of 1380	4072	conhost.exe	140
PID 4072 wrote to memory of 1380	4072	conhost.exe	140
PID 1380 wrote to memory of 4772	1380	cmd.exe	141
PID 1380 wrote to memory of 4772	1380	cmd.exe	141
PID 1380 wrote to memory of 4732	1380	cmd.exe	142
PID 1380 wrote to memory of 4732	1380	cmd.exe	142
PID 4732 wrote to memory of 4980	4732	conhost.exe	143
PID 4732 wrote to memory of 4980	4732	conhost.exe	143
PID 4980 wrote to memory of 1328	4980	cmd.exe	145
PID 4980 wrote to memory of 1328	4980	cmd.exe	145
PID 4980 wrote to memory of 3796	4980	cmd.exe	146
PID 4980 wrote to memory of 3796	4980	cmd.exe	146
PID 3796 wrote to memory of 4616	3796	conhost.exe	147
PID 3796 wrote to memory of 4616	3796	conhost.exe	147
PID 4616 wrote to memory of 3872	4616	cmd.exe	149
PID 4616 wrote to memory of 3872	4616	cmd.exe	149
PID 4616 wrote to memory of 3412	4616	cmd.exe	150
PID 4616 wrote to memory of 3412	4616	cmd.exe	150
PID 3412 wrote to memory of 1436	3412	conhost.exe	151
PID 3412 wrote to memory of 1436	3412	conhost.exe	151
PID 1436 wrote to memory of 3324	1436	cmd.exe	153
PID 1436 wrote to memory of 3324	1436	cmd.exe	153
PID 1436 wrote to memory of 1944	1436	cmd.exe	154
PID 1436 wrote to memory of 1944	1436	cmd.exe	154
PID 1944 wrote to memory of 1376	1944	conhost.exe	155
PID 1944 wrote to memory of 1376	1944	conhost.exe	155
PID 1376 wrote to memory of 428	1376	cmd.exe	157
PID 1376 wrote to memory of 428	1376	cmd.exe	157
PID 1376 wrote to memory of 4400	1376	cmd.exe	158
PID 1376 wrote to memory of 4400	1376	cmd.exe	158

C:\Users\Admin\AppData\Local\Temp\6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe
"C:\Users\Admin\AppData\Local\Temp\6e453d3ba868825da6a8c05c4bf45eea5f65169952411ce7a5dca47ffea505dc.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\GameBarPresenceWriter\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\ja-JP\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
    - - C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1432
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SzaURWjxsM.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3552
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oYNvu0ZNBR.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4772
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1328
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sQQ1IAg9p0.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3872
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rn5V8mQYRH.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3324
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DFgOOKl5EO.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:428
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat"
        18⤵
        
        PID:220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4780
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\G2aNa3Lme8.bat"
        20⤵
        
        PID:3836
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4952
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kYBl3UyOdq.bat"
        22⤵
        
        PID:3576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4800
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        23⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T3kbcxG26A.bat"
        24⤵
        
        PID:1372
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4444
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        25⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cnsnMHUbNI.bat"
        26⤵
        
        PID:1716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1092
        
        C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe
        
        "C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Windows\GameBarPresenceWriter\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Windows\GameBarPresenceWriter\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\ja-JP\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Security\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\DFgOOKl5EO.bat

Filesize
230B

MD5
021662fd811ece920590ad6312ac87bc

SHA1
a37f38cc1c5d9336c69cc5b0d87cb24703cd03f1

SHA256
146fe9fc8805500dfab3ed59c297999de9bc6205af1bc4a12c358245a4690fa9

SHA512
942b6559f84428f54426f1b88388e5e916822550cb33d8fd537adccbd44ac6196975202bb136b5fa0cd38ccc945f4429bfb6480cddb76bb3de14b6dd79529095

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2aNa3Lme8.bat

Filesize
230B

MD5
20bbbb1753c93b3a7f52f0814ca2d90c

SHA1
69d4dae2e9e6bd3f0b000071c183afd5c5442567

SHA256
24d4bdaf8cd6a4f2fa1a954ee1015b3f255a801b072eace4230ef75237798c29

SHA512
4f673898bf1cc4261bc77adfab070038bf35ce5fbde40460825d60939ccd8457d26db102fb9179ef32a2347706cdc82fb1987041b5a8d77f9f4b51817aaebfc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rn5V8mQYRH.bat

Filesize
230B

MD5
021a846ca3f1c4d6f68a18934f8d4691

SHA1
708d28b25e6c994a42e0e4644b75274701f33c14

SHA256
a7509602d0af60566c732c5f2e1ed2bab3e5c4b94a759e659ce68e384247d06a

SHA512
2ff5732282840d37d818f785bdb5f6d017a87a708cc066d17f0a0fc6b5becd8008c9ea0d6344af403dd2e42147bfa972304b70ac4b81d996badaa38686988cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\SzaURWjxsM.bat

Filesize
230B

MD5
1ad529191b144fe94c675b5b5d0d7627

SHA1
f13d1097508162b73ed98780159586852fe3e9dc

SHA256
f8ee227dfe9f95c1fc26144ec997c2ee7fd408c57fab86cc37057f1cc3c058b5

SHA512
07a7458ce9c7d16e0d0b1043c4378e3c76cdd684fd23efb5976545e1e6f4d62b63a899f312626085fd56318a5a98bc4a9e84d1e1f5bbe37f0075b82d6c4c338d

Download Submit
C:\Users\Admin\AppData\Local\Temp\T3kbcxG26A.bat

Filesize
230B

MD5
cd730d14ff10646e0c0e391196a000dc

SHA1
e27bbb3b2c6c5384a47f316dc9a28d2fbd7d6cde

SHA256
66b3e4501dad2a55cfcc72dca689dd6c8a53ef73c5cd771fceddd2081bb3d37d

SHA512
dfe00e43e90a934d749c0d19be5cf71ddf2f956ed886289d3645e07a7edab945fe9578b87a206d43d9ec73d566759fce3178c2a98548a3cf11b124c2279716a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat

Filesize
230B

MD5
b803cc4f238526b513bb876998cf6602

SHA1
3cc4de7a3446ce009fd829396f0a117d07a6fd0c

SHA256
f777a0942c56e7ba42e0d9b59a28ce8b9e14270826e975651637f2ad088b5d68

SHA512
51ec7b7566c41d36c50dfc7889228e47ebac44138f6133bd0212f0f82c7b17a8098036ecfb01fc693061b2a33a85d9a9da1871137ba0073218090ded0a8f1a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cnsnMHUbNI.bat

Filesize
230B

MD5
f327f8977918e5f89fcb7ddece9a5b81

SHA1
12cfa7f7f43c7800494bd623db3bff93ae216939

SHA256
198b9d1aae9cddc1325cf444455d550e13d9085b06d71c7719eade80d6c0d1ba

SHA512
301da87c46caab1da227a57138830290e447480e7731b64e270d7e63ea9327eaeeccadb9c23e089fdd5b9da64da5bd7dc871308b479f3b711b835be6e2a629f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat

Filesize
230B

MD5
3a12e9f00db248fb719627e2f5fd439c

SHA1
fc38738124e7cf6aa7f541816e8a89cdd768e4df

SHA256
153ff93fafa25f2662a35a002ee7542f3203f791fc8a1c5fd4dd534a204b97a1

SHA512
c7279c66ee4338a81d055b653a2b01d9592212eb43159ff1e741f6d0bacfd3440bb51b121eb1accc465208a448b4887ded4379ce040f2e9e2407cdbad50cd379

Download Submit
C:\Users\Admin\AppData\Local\Temp\kYBl3UyOdq.bat

Filesize
230B

MD5
6f3e710e30d953f199cbbd03faa14c2b

SHA1
222cb02764521adca9718ec4ba7f5ca4d1cac204

SHA256
f2de9db3789462e76522805c66bae75be097795684ae3dae0b31879b68fe5089

SHA512
30285c06af5b8969ab5ffc48456873c21bbe616f120314436f7ef2d80f19c8ac9b6e6676e439924a38346f8b1d45a069388753066e882a8b8f515009c952a684

Download Submit
C:\Users\Admin\AppData\Local\Temp\oYNvu0ZNBR.bat

Filesize
230B

MD5
6da62cebb720db34af95b79259643a08

SHA1
24384d69d7659e821550a3960b0d0af31281a0b9

SHA256
cb382edc459dc06534e78c5071f374502af0fa22f7558ebc94b221e6f014d8ed

SHA512
ae71b4d3f879ace24115818aa9ef8f53ec11993f59c04210ba9d06d8742b9c1d0e9fc4a5d5e9191eb098b2ed7ccc1dd4ee6cbbbe6fc77128d3647757a52efc66

Download Submit
C:\Users\Admin\AppData\Local\Temp\sQQ1IAg9p0.bat

Filesize
230B

MD5
775a1c01ad828a28284c88b7e269c87e

SHA1
e919f8bedcf08bbcbeacde2eaec2caa77119eb0e

SHA256
999d338b2b1dd9d201fb07acf1488259e0f32c5f2aa92355850a7225172e07eb

SHA512
02568cd1bfb7c4ec306612ab4986993672b7e9cc86c3ba99b4eaa1e756913024c7f3bff153e3552f0776297c23699b891f1397ac35edf7f46fd09dac6abff1f2

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1400-139-0x00000000004C0000-0x00000000005D0000-memory.dmp

Filesize
1.1MB

Download
memory/1400-140-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1400-155-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1432-161-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1432-186-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1648-160-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1648-178-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1700-182-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1700-162-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1788-173-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1788-163-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1852-167-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1852-156-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1944-222-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/1944-218-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/2592-260-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/3056-250-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/3056-246-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/3200-158-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3200-174-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3412-215-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3412-211-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3428-159-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3428-175-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3448-154-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3448-177-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3796-204-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3796-208-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3952-164-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/3952-180-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/4028-243-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/4028-239-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/4072-190-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/4072-192-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/4400-229-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/4400-225-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/4732-197-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/4732-201-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/4752-232-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/4752-236-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/4772-253-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/4772-257-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

Filesize
10.8MB

Download
memory/4872-176-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download
memory/4872-157-0x00000236532D0000-0x00000236532F2000-memory.dmp

Filesize
136KB

Download
memory/4872-150-0x00007FFA66E70000-0x00007FFA67931000-memory.dmp

Filesize
10.8MB

Download