Malware Analysis Report

2025-08-05 17:32

Sample ID 221101-mn6xmaahe7
Target 490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d
SHA256 490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d
Tags
rat dcrat infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d

Threat Level: Known bad

The file 490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d was found to be: Known bad.

Malicious Activity Summary

rat dcrat infostealer

Process spawned unexpected child process

Dcrat family

DCRat payload

DcRat

DCRat payload

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-01 10:37

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-01 10:37

Reported

2022-11-01 10:40

Platform

win10-20220812-en

Max time kernel

31s

Max time network

82s

Command Line

"C:\Users\Admin\AppData\Local\Temp\490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe N/A

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe C:\providercommon\DllCommonsvc.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files\Windows Sidebar\Shared Gadgets\886983d96e3d3e C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\ebf1f9fa8afd6d C:\providercommon\DllCommonsvc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\servicing\ja-JP\ShellExperienceHost.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\Help\fr-FR\dwm.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\Help\fr-FR\6cb0b6c459d5d3 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\debug\sihost.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\debug\66fc9ff0ee96c2 C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\OfficeClickToRun.exe C:\providercommon\DllCommonsvc.exe N/A
File created C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\e6c9b481da804f C:\providercommon\DllCommonsvc.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings C:\providercommon\DllCommonsvc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2576 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d.exe C:\Windows\SysWOW64\WScript.exe
PID 2576 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d.exe C:\Windows\SysWOW64\WScript.exe
PID 2576 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d.exe C:\Windows\SysWOW64\WScript.exe
PID 4784 wrote to memory of 3340 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 3340 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 3340 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3340 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 3340 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 1356 wrote to memory of 1404 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 1404 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 1320 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 1320 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 1472 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 1472 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 360 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 360 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 508 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 508 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 4352 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 4352 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 3308 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 3308 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 2332 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 2332 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 2100 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 2100 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 688 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 688 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1356 wrote to memory of 4736 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 1356 wrote to memory of 4736 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\cmd.exe
PID 4736 wrote to memory of 4840 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4736 wrote to memory of 4840 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4736 wrote to memory of 4660 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe
PID 4736 wrote to memory of 4660 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe

Processes

C:\Users\Admin\AppData\Local\Temp\490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d.exe

"C:\Users\Admin\AppData\Local\Temp\490e9d222562cedc6eb9414a448c93e52c01d47c7510f932281d76e2a9c1193d.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\odt\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\fr-FR\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Help\fr-FR\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\fr-FR\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\odt\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Windows\debug\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\debug\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\debug\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\wininit.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\fr-FR\dwm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\cmd.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\CortanaListenUIApp_cw5n1h2txyewy\microsoft.system.package.metadata\OfficeClickToRun.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\sihost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4NbXwSAyXq.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe

"C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\veDg5wW3gS.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe

"C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe

"C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe

"C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
IE 20.50.73.10:443 tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 13.107.4.50:80 tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp

Files

memory/2576-115-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-116-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-117-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-118-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-120-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-121-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-123-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-124-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-125-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-126-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-127-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-128-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-130-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-131-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-132-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-133-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-129-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-134-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-136-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-135-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-137-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-138-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-139-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-140-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-141-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-142-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-143-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-144-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-145-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-146-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-148-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-147-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-149-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-150-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-151-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-152-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-153-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-154-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-155-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-156-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-157-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-158-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-159-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-160-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-161-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-162-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-163-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-164-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-166-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-165-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-167-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-168-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-169-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-170-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-171-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-172-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-173-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-174-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-175-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-176-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-177-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/2576-178-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/4784-179-0x0000000000000000-mapping.dmp

memory/4784-180-0x00000000775B0000-0x000000007773E000-memory.dmp

memory/4784-181-0x00000000775B0000-0x000000007773E000-memory.dmp

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

memory/3340-255-0x0000000000000000-mapping.dmp

memory/1356-278-0x0000000000000000-mapping.dmp

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/1356-281-0x0000000000ED0000-0x0000000000FE0000-memory.dmp

memory/1356-282-0x000000001BB20000-0x000000001BB32000-memory.dmp

memory/1356-283-0x000000001BB30000-0x000000001BB3C000-memory.dmp

memory/1356-284-0x000000001C150000-0x000000001C15C000-memory.dmp

memory/1356-285-0x000000001C160000-0x000000001C16C000-memory.dmp

memory/1404-286-0x0000000000000000-mapping.dmp

memory/360-289-0x0000000000000000-mapping.dmp

memory/1472-288-0x0000000000000000-mapping.dmp

memory/4352-291-0x0000000000000000-mapping.dmp

memory/2100-294-0x0000000000000000-mapping.dmp

memory/2332-293-0x0000000000000000-mapping.dmp

memory/3308-292-0x0000000000000000-mapping.dmp

memory/688-297-0x0000000000000000-mapping.dmp

memory/508-290-0x0000000000000000-mapping.dmp

memory/1320-287-0x0000000000000000-mapping.dmp

memory/4736-324-0x0000000000000000-mapping.dmp

memory/1404-337-0x0000023D6CFD0000-0x0000023D6CFF2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4NbXwSAyXq.bat

MD5 425bc34a6861288302e84a733ec6f18b
SHA1 e375cdfd4f952bba6d85465d824934e224e0dd5a
SHA256 174a5591c2356c746e64c8cc9ecc381dc7b55f80430b098bffcd5116705794a5
SHA512 52a0180e4a814befa2dc3391a1ce84f604214b6340d768df875fecd18e539bcda80ec7abab6dcfc3b9344ed0efebd5e0e98c8535e7b8cae6fa555e557421a6b6

memory/4840-356-0x0000000000000000-mapping.dmp

memory/1320-360-0x0000027053F60000-0x0000027053FD6000-memory.dmp

memory/4660-587-0x0000000000000000-mapping.dmp

C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/4660-604-0x0000000000EB0000-0x0000000000EC2000-memory.dmp

memory/4072-625-0x0000000000000000-mapping.dmp

memory/3584-627-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\veDg5wW3gS.bat

MD5 bcf905bd2264d23ed4f05a988c985fa5
SHA1 4d6d35311b19dd82c3ffcc39bb9ee3399d6530dd
SHA256 e5a5a0230eb758a8a9e1285a00bddcad5e039541c8f6abed290d2ca5b6faa3ab
SHA512 e878cd7efe587313f2a80db58e11527b4ba017d5b2f88ecbe5481bc646dce9c95d152dad83c52e34bb1a57db199ec993bd69d8c74f43b91f263b8dc48ad35fc2

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 736d1356ca893b1b9a91a3a583bb993e
SHA1 33e11792346f27377b314361bf7c9607f573ad08
SHA256 76ccf1504533d4340aea0a2674e6397108a57bbade578bca68018529a7f8d98e
SHA512 bee294d6db0718566e6184627cf6d9f53289d72e7872121a940a52ccd9b8e7944c255cbafa21bbb076b0583ee1d1f02be2156b83d62bb0078ccf698995ffbee6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8f01ca0d95ea19e19929f3efaa52f6c1
SHA1 9a73d20198ab36bec846182ef8e66fe6b351ed9e
SHA256 f7e1d7f3d27bb3f51324c92bd7618cb4bc37d4f1f84f3dde838cddb3cb764519
SHA512 961d0693a4ecf3c95d9555b553ef6722df7f54de0f0ac6159193f1e207051a0ab386a1c7e408e393b6b022a8e4ba32019c90b44a5190c0e2d578dc922bef6273

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 46c320488b813afd61c0e95b62f39434
SHA1 fffce41d82622db8efaac66b433915a6fb813b92
SHA256 cdfbc1a6deeec9bf1fda50ef3d1dd6716963b9e00421a1b613cc493f50aa3018
SHA512 5fc54265ffd04019cb536943e69410feab8af919aa77d46c2c564f47ed4ee33345e87d13f300a52074f16f8bc668011abe580ecf582e41e87b233e23bc596590

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fc0fc79be6552eeb5019dcdcb54d2e47
SHA1 5175c9e3bd726ff9358fb22077b220163b5469fb
SHA256 43d69e20f5c01b01d16d18f0c7384e0fe98902e6a7010dfae9e6abf954f702f6
SHA512 7141afbf67526875fb0bd8e55300da80977afa072d1e74feb3c3115bd33c8bcc7bc6d9b5aa53166ad647895e76d9ad085caf41dd0c75e01b980dda6cea126d6a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fc0fc79be6552eeb5019dcdcb54d2e47
SHA1 5175c9e3bd726ff9358fb22077b220163b5469fb
SHA256 43d69e20f5c01b01d16d18f0c7384e0fe98902e6a7010dfae9e6abf954f702f6
SHA512 7141afbf67526875fb0bd8e55300da80977afa072d1e74feb3c3115bd33c8bcc7bc6d9b5aa53166ad647895e76d9ad085caf41dd0c75e01b980dda6cea126d6a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b5edd2b4210b3b789325c21d089f7203
SHA1 5e6616a0c16f9d7844a7203f1dc16323f33c2302
SHA256 59424b5a7db4f8f326d44e6b362d79a069119286244be26cd40d0d4e57d0edf8
SHA512 1bf632b838cfe722f30f86be9558648c56331ea70e46be1a6c021ad2b6d53632efa7f93e74f0057d87e92d4905558e4a5da20b1559874bd0674ae7f1e4d4e7f9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c2e75ae62d491e34cb4ce8a01fcf3c13
SHA1 7921cfb6520a9b29b5884b0426a8e8272d037c4e
SHA256 36fc891bdb5e99f28a7547f2b6343cc70af433e886375a0255a29f37ccda25c7
SHA512 a91e04d7956b31ca2100c0b9491ff3ecaa5946800c7fc7a26944e1d23d992479855eaf4162d90c436dfac64a493f942085ae4fe4e491eb351c94b227ca4be675

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 34a2daea7c465cb8c993532892989928
SHA1 d51cb342644344c5102bcd7a03523c9077a6cc74
SHA256 0a9756940e78577974604ccf4cff47f4d6ed50d1bb21b3ab5a8220011dc48a35
SHA512 ec6610287cb02d218f88d21bacd9f1b820c6ee5fd19043bc76b874e5c0ff3977d6cb070c447eabe0995df0408c83690d4fde8ef76002100db54dd87c73e8cf1f

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 34a2daea7c465cb8c993532892989928
SHA1 d51cb342644344c5102bcd7a03523c9077a6cc74
SHA256 0a9756940e78577974604ccf4cff47f4d6ed50d1bb21b3ab5a8220011dc48a35
SHA512 ec6610287cb02d218f88d21bacd9f1b820c6ee5fd19043bc76b874e5c0ff3977d6cb070c447eabe0995df0408c83690d4fde8ef76002100db54dd87c73e8cf1f

memory/3200-648-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/4904-651-0x0000000000000000-mapping.dmp

memory/5084-653-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\IPU7rAfrPc.bat

MD5 43a1a9e1fe92857152921c1ba5d805f9
SHA1 b3537d069f17ee3682cad93a34cc24ed39838445
SHA256 bbe56d5b9d8cf255aab2fbda4716a01bce9caa70ca97dc2eb304e6edea5caa00
SHA512 d4e667a693093d47e6292148ad7027f668e92946280ec72c2a1ccfaf817c0f717a7dffb861241208983376a3079d5df16df0313db755bd5243dbbca3f08604ef

memory/5076-654-0x0000000000000000-mapping.dmp

C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/4436-656-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\0WHmS6dpJ0.bat

MD5 3918e04cdaa684046241e355ff45cf3d
SHA1 f7a0d54901a433ba905aed51d82f4990c848a439
SHA256 93dad48f06b0499a9ac6a76fec73b07a3809a27a6a3e436dc5230a5dfd18368f
SHA512 f93ce9771e776c932943035383bd35f45055c9637abc8c22479bdd7edffd8f5304a0b36c5a4ddc211f4ac5caea490efe227c429e9461b16d28f562975a25c0f8

memory/364-658-0x0000000000000000-mapping.dmp

memory/1700-659-0x0000000000000000-mapping.dmp

C:\Program Files\Windows Sidebar\Shared Gadgets\csrss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/2444-661-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat

MD5 764324d74a2730d3664d3547263a6aa0
SHA1 a4ff10af10d0fd3122733be48a2cb6d1520b7540
SHA256 083dcfe4a606d2d8c5990ef93ee7bf37b146b46d9bced12c888d5db39a47f75c
SHA512 c5b893f7598d205455006c86f423e6b0a3c860cfa4c713b8a2d904c12682f0030a8ac7dc37048e67352a831fab747128405c8b91d6456d104051bfc7d65e0873

memory/4080-663-0x0000000000000000-mapping.dmp