Malware Analysis Report

2025-08-10 23:16

Sample ID 221101-nr36kscdhl
Target cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc
SHA256 cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc
Tags
rat dcrat infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc

Threat Level: Known bad

The file cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc was found to be: Known bad.

Malicious Activity Summary

rat dcrat infostealer

Dcrat family

DCRat payload

Process spawned unexpected child process

DcRat

DCRat payload

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies registry class

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-01 11:38

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-01 11:38

Reported

2022-11-01 11:41

Platform

win10-20220901-en

Max time kernel

146s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings C:\Users\All Users\Microsoft OneDrive\smss.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\providercommon\DllCommonsvc.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
N/A N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\providercommon\DllCommonsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\All Users\Microsoft OneDrive\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1748 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc.exe C:\Windows\SysWOW64\WScript.exe
PID 1748 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc.exe C:\Windows\SysWOW64\WScript.exe
PID 1748 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc.exe C:\Windows\SysWOW64\WScript.exe
PID 5016 wrote to memory of 736 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 5016 wrote to memory of 736 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 5016 wrote to memory of 736 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 736 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 736 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\providercommon\DllCommonsvc.exe
PID 3976 wrote to memory of 3052 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 3052 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 4308 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 4308 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 3152 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 3152 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 2052 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 2052 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 956 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 956 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 2580 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 2580 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 1528 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 1528 N/A C:\providercommon\DllCommonsvc.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 160 N/A C:\providercommon\DllCommonsvc.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 3976 wrote to memory of 160 N/A C:\providercommon\DllCommonsvc.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 160 wrote to memory of 2620 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 160 wrote to memory of 2620 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 2620 wrote to memory of 2328 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2620 wrote to memory of 2328 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2620 wrote to memory of 1448 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 2620 wrote to memory of 1448 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 1448 wrote to memory of 5096 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 1448 wrote to memory of 5096 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 5096 wrote to memory of 1260 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 5096 wrote to memory of 1260 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 5096 wrote to memory of 3552 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 5096 wrote to memory of 3552 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 3552 wrote to memory of 4300 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 3552 wrote to memory of 4300 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 4300 wrote to memory of 4908 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4300 wrote to memory of 4908 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4300 wrote to memory of 3096 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 4300 wrote to memory of 3096 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 3096 wrote to memory of 4008 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 3096 wrote to memory of 4008 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 4008 wrote to memory of 3160 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4008 wrote to memory of 3160 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4008 wrote to memory of 3184 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 4008 wrote to memory of 3184 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 3184 wrote to memory of 4560 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 3184 wrote to memory of 4560 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 4560 wrote to memory of 4408 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4560 wrote to memory of 4408 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4560 wrote to memory of 344 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 4560 wrote to memory of 344 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 344 wrote to memory of 292 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 344 wrote to memory of 292 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 292 wrote to memory of 64 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 292 wrote to memory of 64 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 292 wrote to memory of 3784 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 292 wrote to memory of 3784 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Microsoft OneDrive\smss.exe
PID 3784 wrote to memory of 2832 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 3784 wrote to memory of 2832 N/A C:\Users\All Users\Microsoft OneDrive\smss.exe C:\Windows\System32\cmd.exe
PID 2832 wrote to memory of 1636 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2832 wrote to memory of 1636 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc.exe

"C:\Users\Admin\AppData\Local\Temp\cd96e018ede868542bbe9e7d53466fe9061ba41096852ab0421aff7be4cf8afc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "

C:\providercommon\DllCommonsvc.exe

"C:\providercommon\DllCommonsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\odt\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\odt\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 9 /tr "'C:\providercommon\SearchUI.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 12 /tr "'C:\providercommon\SearchUI.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Pictures\Camera Roll\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Camera Roll\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Pictures\Camera Roll\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft OneDrive\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Microsoft OneDrive\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Videos\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Videos\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Videos\dwm.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\System.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures\Camera Roll\conhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchUI.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\smss.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Videos\dwm.exe'

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jlvf1Vq2YP.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DiMaLaQqUm.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NczlPfxoCy.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TfYr4aOzGb.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jClCs9nEU3.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\00pP7nIBMq.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aTd08pZfDw.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Users\All Users\Microsoft OneDrive\smss.exe

"C:\Users\All Users\Microsoft OneDrive\smss.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 52.182.143.208:443 tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 209.197.3.8:80 tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp

Files

memory/1748-120-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-121-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-122-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-123-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-125-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-126-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-128-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-129-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-130-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-131-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-132-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-133-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-134-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-135-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-136-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-137-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-138-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-139-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-140-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-141-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-142-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-143-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-144-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-145-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-146-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-147-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-148-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-149-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-150-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-151-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-152-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-153-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-154-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-155-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-156-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-157-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-158-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-159-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-160-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-161-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-162-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-163-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-164-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-165-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-166-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-167-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-168-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-169-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-171-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-170-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-172-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-173-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-174-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-175-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-176-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-177-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-178-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-179-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-180-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-181-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-182-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/1748-183-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/5016-184-0x0000000000000000-mapping.dmp

memory/5016-185-0x0000000076F50000-0x00000000770DE000-memory.dmp

memory/5016-186-0x0000000076F50000-0x00000000770DE000-memory.dmp

C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

MD5 8088241160261560a02c84025d107592
SHA1 083121f7027557570994c9fc211df61730455bb5
SHA256 2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA512 20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

C:\providercommon\1zu9dW.bat

MD5 6783c3ee07c7d151ceac57f1f9c8bed7
SHA1 17468f98f95bf504cc1f83c49e49a78526b3ea03
SHA256 8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512 c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

memory/736-260-0x0000000000000000-mapping.dmp

memory/3976-283-0x0000000000000000-mapping.dmp

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

C:\providercommon\DllCommonsvc.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/3976-286-0x0000000000E20000-0x0000000000F30000-memory.dmp

memory/3976-287-0x0000000001640000-0x0000000001652000-memory.dmp

memory/3976-288-0x0000000003050000-0x000000000305C000-memory.dmp

memory/3976-289-0x00000000031C0000-0x00000000031CC000-memory.dmp

memory/3976-290-0x000000001BAA0000-0x000000001BAAC000-memory.dmp

memory/3052-291-0x0000000000000000-mapping.dmp

memory/3152-293-0x0000000000000000-mapping.dmp

memory/4308-292-0x0000000000000000-mapping.dmp

memory/956-295-0x0000000000000000-mapping.dmp

memory/2052-294-0x0000000000000000-mapping.dmp

memory/2580-296-0x0000000000000000-mapping.dmp

memory/1528-297-0x0000000000000000-mapping.dmp

memory/160-306-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

C:\Users\All Users\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/4308-329-0x00000226D0C10000-0x00000226D0C32000-memory.dmp

memory/160-330-0x00000000012B0000-0x00000000012C2000-memory.dmp

memory/4308-336-0x00000226D0DC0000-0x00000226D0E36000-memory.dmp

memory/2620-500-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Jlvf1Vq2YP.bat

MD5 f5b63874cb9596cac257798ec7a0ed86
SHA1 d89289ab1f9830b33a2017c669d51b79a20a1950
SHA256 5ed3fd90ca9bb9218d50f40e9f21629e4d6932eae69357659a5a3a4466753ded
SHA512 ff6febdbba932bf8447293362704ec86c42446d771331b1c42e9073e5e7b69d448e073ff765d566938127e9a67df32f87fd06d3ec9c483b8dd13a28dadfb4c30

memory/2328-502-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c5889e910d85f6fc04bac8bc6b3df0bd
SHA1 a987aeda06fa9a78a79a1cea9e283399c26d1591
SHA256 70330dbf040aa90ebcd0c602e38f416f4920bfae98b019467508542f905c342b
SHA512 6ca3f2e2779eddf009e5b491c501bb0d62dfe3eae191becb4bc9878ff3fcd87c0b85022936927760d2eaa510557b524261f4fad6e64e4f4d56678a20c9718000

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 64245ffda31b0f515760818cbe0597b3
SHA1 bbc8351c7cb0d43bfbcbd7de0f4b39ed740ec3cb
SHA256 f38e565c7b7c836fb45bbcdf10eca782e9ae85f91226f173dce609779fa9ad44
SHA512 15ff51063e8f8585c7ed3f1ad4f18dcf07b6f949f894d9a835b92362f7c33484f2f238a11509f4c1fcf37dfc79e4b3c9f8d361971673e6c8fff44c15f208bf64

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 83f501f880b6d62601073e5b4973129f
SHA1 3829e5273099b53648706cda4aed03d5dc986078
SHA256 3d19604daaa072b37108a1d7360c2a34dde1d5316c336e42939c9ae83996410b
SHA512 c7076323e4304250564f7c3347b22dcffd6a6823b496152f5d2976c76ab37f7b78886174c5f78b09fdda9e9bdc5de02e69de185a181cda22d2020a70d5ab5344

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 83f501f880b6d62601073e5b4973129f
SHA1 3829e5273099b53648706cda4aed03d5dc986078
SHA256 3d19604daaa072b37108a1d7360c2a34dde1d5316c336e42939c9ae83996410b
SHA512 c7076323e4304250564f7c3347b22dcffd6a6823b496152f5d2976c76ab37f7b78886174c5f78b09fdda9e9bdc5de02e69de185a181cda22d2020a70d5ab5344

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 34447e0189dc3b78c1d3551cd7658da1
SHA1 768b6fed5a1cc0d2902c18af48b80010e37c875e
SHA256 26546c2ceab97e94b5884028a45a7e810b6d90fc38dfa7a5c8e70780f8ae16c4
SHA512 2f5d79873aea0458f9a37a4eddf09e36da559dbe8c09c40fe0c70994acfdf45054594110badbe10784bd42725be4118e8d20d22dddd6b4330b0349310ddde78e

memory/1448-527-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smss.exe.log

MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

memory/5096-530-0x0000000000000000-mapping.dmp

memory/1260-532-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat

MD5 a7bf8e3040bcf21855a6effd11a2d02a
SHA1 3b3ef7c06b8376baa813a5563845ec2744407247
SHA256 cce73722f6b4d370c23a806a8b0ac61075c120cdf7fdaa7337d66df307c33d14
SHA512 e9c3326f69a6e6f244934d1b202e5fb09f8944e1152364094ff34db8afe6313209613caec15b79fa5e94927cb19f0330d877b925c807612a4ec349ab6ede6bab

memory/3552-533-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/3552-535-0x0000000000EF0000-0x0000000000F02000-memory.dmp

memory/4300-536-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat

MD5 b55f4e814f20ec10c97e438221c60361
SHA1 7f9e2c684ff5af9107472948570547b024c06e2f
SHA256 16041447c0d3d4ec6526d260f082b860638b6dff6276f8e61adf3901fee615af
SHA512 7e0898750b200dc35952bc992df4d263a3d94d8c89c8de38ddb4606de7d04c05e9abe7c15ca7d7315aabde73269daf3c15a9ede0b3a3e4d1ee79ad94bffc6dbd

memory/4908-538-0x0000000000000000-mapping.dmp

memory/3096-539-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/4008-541-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\DiMaLaQqUm.bat

MD5 03841f00a58d6b066014f4b7c491ea7d
SHA1 2e1442cf87c45dc24e825fe6a745f8b61356a388
SHA256 4afe45496fff23ef888a60f4dfa98a6f88952176a2247803bcd09bdceacd6290
SHA512 cbc829202481d5387c5db702239d336d65aabb7c7dff1f96fc64a96a7d4550ec710c8b2cb80cd9f02c83c567a42c8d41b31106c18555915cad59f52edb63b80b

memory/3160-543-0x0000000000000000-mapping.dmp

memory/3184-544-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/3184-546-0x0000000000C90000-0x0000000000CA2000-memory.dmp

memory/4560-547-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat

MD5 233be693e91100e61825a4b4b1aa4505
SHA1 2a206f6c22dc2f554c83a46a1ac5f464d52031ba
SHA256 3e6484126f0e863c5bba21ba02c4fd4cb2c1d0b2ce434938232dd67ed02ee7d3
SHA512 25cd1ecc549966dcee03823afa95b4c04bcd83d467cdf2a46a8b465be0dd3eeaa2bc5d8424a1f3ffba8f374d786aa99b7fac15fddcac9a146f13bde4436bd47e

memory/4408-549-0x0000000000000000-mapping.dmp

memory/344-550-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/292-552-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\NczlPfxoCy.bat

MD5 1eaf8ffe6bd8e596e10eb28bc50be30f
SHA1 cc458f671054ebfd0afba5e2d2d218c68c833f33
SHA256 69fdd28cb657e6fdce25c640b03641926355965fd2ae76e89b7aff35d26d92fb
SHA512 0ef53773f3112f48a941d11e84d128849eb91f2681443ac93f89077c5f5097bad36bf2fd3d590ae18ebbf523155a7d16bd046dd126ca04c28a02c57f45ba369a

memory/64-554-0x0000000000000000-mapping.dmp

memory/3784-555-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/3784-557-0x00000000015A0000-0x00000000015B2000-memory.dmp

memory/2832-558-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\TfYr4aOzGb.bat

MD5 b3e48da705f2ba3edfc5e00eff2e077e
SHA1 fe26fdd1cf2452551ca6f9605b9a62066a67b6cd
SHA256 d6a336c0f39854ab6ccf98269b636965158360127fdeab0fe7be3c56ee787bf7
SHA512 80ef3887173b32c7306ed8c7b5bae51f0b8b931a0d7f78db9bbfe49deaca6236275886aff3982ac83990f13ee0c4e66e1e24e3d60c339f7e49a6a07555979482

memory/1636-560-0x0000000000000000-mapping.dmp

memory/1108-561-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/2916-563-0x0000000000000000-mapping.dmp

memory/1168-565-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\jClCs9nEU3.bat

MD5 45544bbb181fef0f5d134692f183d504
SHA1 cbed5c64ee55108fe73da5c60fc9f6ac4a8d1df6
SHA256 1e1deb6e3e950a358dc84c2e1032494d720e8743671448a1b05970b4104e2057
SHA512 acc9b0af455e17d402c1ceae5b22105c2034f58286e9779c3454eb3b7a53f32357972bd6bbabdfc3706915033328cbd5a51e9bde7ddb4f9073faa28645134bc3

memory/3372-566-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/2140-568-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\00pP7nIBMq.bat

MD5 4feb36c10539c6958970642eb61d92d8
SHA1 272ce0b3336343be7aaff78708c805cddcaedfc6
SHA256 f07d8c2b3cc641ef73f936d562c166072f0f16b57bfffde5b896c12416a699e0
SHA512 100225693d7cbdddcaf519cdd7096a76ebc66493cb9497d2bd8e801801b794fbf7332a33cb15d0c3ad20a7be9385d52c546fcff322b0f07ce51848a7c9bb608b

memory/5080-570-0x0000000000000000-mapping.dmp

memory/1528-571-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/3836-573-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\aTd08pZfDw.bat

MD5 ae29f427dfd95b674b15e8d618fdb23b
SHA1 0c4e47d73150ceccd03b97004c327f45ab548081
SHA256 63fca2c1e7fe50fa35fc116ab4cafbd50055d8fc2b0f479a6085b36e3e154fca
SHA512 75b57c0ad41f121ecb5639fed0511e4697cdbfa1208cc13f7354f90b5f08eb06cd4e5db87f171a92ab19807693ae9aeef2fa23d9e0a3572cdb4f736d8c89b0b4

memory/1804-575-0x0000000000000000-mapping.dmp

memory/504-576-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

memory/2088-578-0x0000000000000000-mapping.dmp

memory/4884-580-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat

MD5 233be693e91100e61825a4b4b1aa4505
SHA1 2a206f6c22dc2f554c83a46a1ac5f464d52031ba
SHA256 3e6484126f0e863c5bba21ba02c4fd4cb2c1d0b2ce434938232dd67ed02ee7d3
SHA512 25cd1ecc549966dcee03823afa95b4c04bcd83d467cdf2a46a8b465be0dd3eeaa2bc5d8424a1f3ffba8f374d786aa99b7fac15fddcac9a146f13bde4436bd47e

memory/3076-581-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft OneDrive\smss.exe

MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394