dcrat | 56bd01fbbdd219814c8d8378f76ad89032b660cbea437d96d8d0fa27a82b9e51

Analysis

max time kernel
145s
max time network
141s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56bd01fbbdd219814c8d8378f76ad89032b660cbea437d96d8d0fa27a82b9e51.exe
Size

1.3MB
MD5

289b7008bfb0b63c5d41b2adefad08b1
SHA1

b3078e5fd1eafe218a8dad41557e6b9048999d38
SHA256

56bd01fbbdd219814c8d8378f76ad89032b660cbea437d96d8d0fa27a82b9e51
SHA512

4c21bde26f99451baf47a258b8c480a68bb9e538029e4ad2528967d2752ea16a0f1cbb31c72343ca588b69e24c3c3c7d73c07c4f6f9d121b104ae431b62d3369
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3212	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	312	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	240	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	3412	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	3412	schtasks.exe	70

DCRat payload 16 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000900000001ac1a-281.dat	dcrat
behavioral1/files/0x000900000001ac1a-282.dat	dcrat
behavioral1/memory/4228-283-0x0000000000950000-0x0000000000A60000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac5a-354.dat	dcrat
behavioral1/files/0x000600000001ac5a-353.dat	dcrat
behavioral1/files/0x000600000001ac5a-886.dat	dcrat
behavioral1/files/0x000600000001ac5a-892.dat	dcrat
behavioral1/files/0x000600000001ac5a-897.dat	dcrat
behavioral1/files/0x000600000001ac5a-902.dat	dcrat
behavioral1/files/0x000600000001ac5a-907.dat	dcrat
behavioral1/files/0x000600000001ac5a-912.dat	dcrat
behavioral1/files/0x000600000001ac5a-917.dat	dcrat
behavioral1/files/0x000600000001ac5a-923.dat	dcrat
behavioral1/files/0x000600000001ac5a-929.dat	dcrat
behavioral1/files/0x000600000001ac5a-935.dat	dcrat
behavioral1/files/0x000600000001ac5a-941.dat	dcrat

Executes dropped EXE 13 IoCs

pid	Process
4228	DllCommonsvc.exe
4812	System.exe
5340	System.exe
5524	System.exe
5700	System.exe
5876	System.exe
6052	System.exe
4348	System.exe
4904	System.exe
3800	System.exe
3904	System.exe
5268	System.exe
2232	System.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\f8c8f1285d826b	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\smss.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\ShellExperienceHost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\cmd.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\Videos\services.exe	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Videos\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\Prefetch\ReadyBoot\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Prefetch\ReadyBoot\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3956	schtasks.exe
4568	schtasks.exe
820	schtasks.exe
5052	schtasks.exe
2268	schtasks.exe
4972	schtasks.exe
4036	schtasks.exe
4500	schtasks.exe
4468	schtasks.exe
1252	schtasks.exe
1432	schtasks.exe
2260	schtasks.exe
3172	schtasks.exe
2640	schtasks.exe
1264	schtasks.exe
240	schtasks.exe
1908	schtasks.exe
4596	schtasks.exe
4512	schtasks.exe
4516	schtasks.exe
4556	schtasks.exe
1884	schtasks.exe
312	schtasks.exe
3260	schtasks.exe
4336	schtasks.exe
5072	schtasks.exe
4668	schtasks.exe
816	schtasks.exe
3212	schtasks.exe
376	schtasks.exe
1612	schtasks.exe
216	schtasks.exe
332	schtasks.exe
5068	schtasks.exe
4340	schtasks.exe
668	schtasks.exe
212	schtasks.exe
3924	schtasks.exe
4608	schtasks.exe
4376	schtasks.exe
3144	schtasks.exe
3140	schtasks.exe
388	schtasks.exe
3844	schtasks.exe
3992	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	56bd01fbbdd219814c8d8378f76ad89032b660cbea437d96d8d0fa27a82b9e51.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	System.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
4228	DllCommonsvc.exe
2284	powershell.exe
2284	powershell.exe
2216	powershell.exe
2216	powershell.exe
2188	powershell.exe
2188	powershell.exe
1740	powershell.exe
1740	powershell.exe
452	powershell.exe
452	powershell.exe
1996	powershell.exe
1996	powershell.exe
2388	powershell.exe
2388	powershell.exe
2124	powershell.exe
2124	powershell.exe
2696	powershell.exe
2696	powershell.exe
2756	powershell.exe
2756	powershell.exe
4736	powershell.exe
4736	powershell.exe
4768	powershell.exe
4768	powershell.exe
2152	powershell.exe
2152	powershell.exe
4864	powershell.exe
4864	powershell.exe
4796	powershell.exe
4796	powershell.exe
4272	powershell.exe
4272	powershell.exe
4768	powershell.exe
2124	powershell.exe
4812	System.exe
4812	System.exe
2284	powershell.exe
2284	powershell.exe
2216	powershell.exe
2216	powershell.exe
452	powershell.exe
4768	powershell.exe
1740	powershell.exe
2696	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4228	DllCommonsvc.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4812	System.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeIncreaseQuotaPrivilege	4768	powershell.exe
Token: SeSecurityPrivilege	4768	powershell.exe
Token: SeTakeOwnershipPrivilege	4768	powershell.exe
Token: SeLoadDriverPrivilege	4768	powershell.exe
Token: SeSystemProfilePrivilege	4768	powershell.exe
Token: SeSystemtimePrivilege	4768	powershell.exe
Token: SeProfSingleProcessPrivilege	4768	powershell.exe
Token: SeIncBasePriorityPrivilege	4768	powershell.exe
Token: SeCreatePagefilePrivilege	4768	powershell.exe
Token: SeBackupPrivilege	4768	powershell.exe
Token: SeRestorePrivilege	4768	powershell.exe
Token: SeShutdownPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeSystemEnvironmentPrivilege	4768	powershell.exe
Token: SeRemoteShutdownPrivilege	4768	powershell.exe
Token: SeUndockPrivilege	4768	powershell.exe
Token: SeManageVolumePrivilege	4768	powershell.exe
Token: 33	4768	powershell.exe
Token: 34	4768	powershell.exe
Token: 35	4768	powershell.exe
Token: 36	4768	powershell.exe
Token: SeIncreaseQuotaPrivilege	2124	powershell.exe
Token: SeSecurityPrivilege	2124	powershell.exe
Token: SeTakeOwnershipPrivilege	2124	powershell.exe
Token: SeLoadDriverPrivilege	2124	powershell.exe
Token: SeSystemProfilePrivilege	2124	powershell.exe
Token: SeSystemtimePrivilege	2124	powershell.exe
Token: SeProfSingleProcessPrivilege	2124	powershell.exe
Token: SeIncBasePriorityPrivilege	2124	powershell.exe
Token: SeCreatePagefilePrivilege	2124	powershell.exe
Token: SeBackupPrivilege	2124	powershell.exe
Token: SeRestorePrivilege	2124	powershell.exe
Token: SeShutdownPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeSystemEnvironmentPrivilege	2124	powershell.exe
Token: SeRemoteShutdownPrivilege	2124	powershell.exe
Token: SeUndockPrivilege	2124	powershell.exe
Token: SeManageVolumePrivilege	2124	powershell.exe
Token: 33	2124	powershell.exe
Token: 34	2124	powershell.exe
Token: 35	2124	powershell.exe
Token: 36	2124	powershell.exe
Token: SeIncreaseQuotaPrivilege	452	powershell.exe
Token: SeSecurityPrivilege	452	powershell.exe
Token: SeTakeOwnershipPrivilege	452	powershell.exe
Token: SeLoadDriverPrivilege	452	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4808	2584	56bd01fbbdd219814c8d8378f76ad89032b660cbea437d96d8d0fa27a82b9e51.exe	66
PID 2584 wrote to memory of 4808	2584	56bd01fbbdd219814c8d8378f76ad89032b660cbea437d96d8d0fa27a82b9e51.exe	66
PID 2584 wrote to memory of 4808	2584	56bd01fbbdd219814c8d8378f76ad89032b660cbea437d96d8d0fa27a82b9e51.exe	66
PID 4808 wrote to memory of 3620	4808	WScript.exe	67
PID 4808 wrote to memory of 3620	4808	WScript.exe	67
PID 4808 wrote to memory of 3620	4808	WScript.exe	67
PID 3620 wrote to memory of 4228	3620	cmd.exe	69
PID 3620 wrote to memory of 4228	3620	cmd.exe	69
PID 4228 wrote to memory of 2284	4228	DllCommonsvc.exe	116
PID 4228 wrote to memory of 2284	4228	DllCommonsvc.exe	116
PID 4228 wrote to memory of 2216	4228	DllCommonsvc.exe	120
PID 4228 wrote to memory of 2216	4228	DllCommonsvc.exe	120
PID 4228 wrote to memory of 2188	4228	DllCommonsvc.exe	119
PID 4228 wrote to memory of 2188	4228	DllCommonsvc.exe	119
PID 4228 wrote to memory of 1740	4228	DllCommonsvc.exe	124
PID 4228 wrote to memory of 1740	4228	DllCommonsvc.exe	124
PID 4228 wrote to memory of 452	4228	DllCommonsvc.exe	123
PID 4228 wrote to memory of 452	4228	DllCommonsvc.exe	123
PID 4228 wrote to memory of 1996	4228	DllCommonsvc.exe	127
PID 4228 wrote to memory of 1996	4228	DllCommonsvc.exe	127
PID 4228 wrote to memory of 2388	4228	DllCommonsvc.exe	125
PID 4228 wrote to memory of 2388	4228	DllCommonsvc.exe	125
PID 4228 wrote to memory of 2124	4228	DllCommonsvc.exe	129
PID 4228 wrote to memory of 2124	4228	DllCommonsvc.exe	129
PID 4228 wrote to memory of 2696	4228	DllCommonsvc.exe	131
PID 4228 wrote to memory of 2696	4228	DllCommonsvc.exe	131
PID 4228 wrote to memory of 2756	4228	DllCommonsvc.exe	132
PID 4228 wrote to memory of 2756	4228	DllCommonsvc.exe	132
PID 4228 wrote to memory of 4736	4228	DllCommonsvc.exe	133
PID 4228 wrote to memory of 4736	4228	DllCommonsvc.exe	133
PID 4228 wrote to memory of 4768	4228	DllCommonsvc.exe	134
PID 4228 wrote to memory of 4768	4228	DllCommonsvc.exe	134
PID 4228 wrote to memory of 2152	4228	DllCommonsvc.exe	137
PID 4228 wrote to memory of 2152	4228	DllCommonsvc.exe	137
PID 4228 wrote to memory of 4864	4228	DllCommonsvc.exe	141
PID 4228 wrote to memory of 4864	4228	DllCommonsvc.exe	141
PID 4228 wrote to memory of 4796	4228	DllCommonsvc.exe	142
PID 4228 wrote to memory of 4796	4228	DllCommonsvc.exe	142
PID 4228 wrote to memory of 4272	4228	DllCommonsvc.exe	143
PID 4228 wrote to memory of 4272	4228	DllCommonsvc.exe	143
PID 4228 wrote to memory of 4812	4228	DllCommonsvc.exe	148
PID 4228 wrote to memory of 4812	4228	DllCommonsvc.exe	148
PID 4812 wrote to memory of 4968	4812	System.exe	150
PID 4812 wrote to memory of 4968	4812	System.exe	150
PID 4968 wrote to memory of 1828	4968	cmd.exe	152
PID 4968 wrote to memory of 1828	4968	cmd.exe	152
PID 4968 wrote to memory of 5340	4968	cmd.exe	153
PID 4968 wrote to memory of 5340	4968	cmd.exe	153
PID 5340 wrote to memory of 5444	5340	System.exe	154
PID 5340 wrote to memory of 5444	5340	System.exe	154
PID 5444 wrote to memory of 5500	5444	cmd.exe	156
PID 5444 wrote to memory of 5500	5444	cmd.exe	156
PID 5444 wrote to memory of 5524	5444	cmd.exe	157
PID 5444 wrote to memory of 5524	5444	cmd.exe	157
PID 5524 wrote to memory of 5624	5524	System.exe	158
PID 5524 wrote to memory of 5624	5524	System.exe	158
PID 5624 wrote to memory of 5680	5624	cmd.exe	160
PID 5624 wrote to memory of 5680	5624	cmd.exe	160
PID 5624 wrote to memory of 5700	5624	cmd.exe	161
PID 5624 wrote to memory of 5700	5624	cmd.exe	161
PID 5700 wrote to memory of 5800	5700	System.exe	162
PID 5700 wrote to memory of 5800	5700	System.exe	162
PID 5800 wrote to memory of 5856	5800	cmd.exe	164
PID 5800 wrote to memory of 5856	5800	cmd.exe	164

C:\Users\Admin\AppData\Local\Temp\56bd01fbbdd219814c8d8378f76ad89032b660cbea437d96d8d0fa27a82b9e51.exe
"C:\Users\Admin\AppData\Local\Temp\56bd01fbbdd219814c8d8378f76ad89032b660cbea437d96d8d0fa27a82b9e51.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\Videos\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\ShellExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Start Menu\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\it-IT\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
    - - C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4812
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8xeM6k5O3T.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1828
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5444
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:5500
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:5680
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5800
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:5856
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FBiR4PpyYA.bat"
        14⤵
        
        PID:5976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:6032
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F4MZx53eLu.bat"
        16⤵
        
        PID:380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:5072
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8xeM6k5O3T.bat"
        18⤵
        
        PID:2228
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3048
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PliZKNaLvF.bat"
        20⤵
        
        PID:4652
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3828
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat"
        22⤵
        
        PID:5272
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1464
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjtq3MYUh4.bat"
        24⤵
        
        PID:4868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3024
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5268
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat"
        26⤵
        
        PID:3028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4400
        
        C:\Users\All Users\Start Menu\System.exe
        
        "C:\Users\All Users\Start Menu\System.exe"
        27⤵
        Executes dropped EXE
        
        PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\ShellExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\NetworkService\Videos\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\Videos\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\NetworkService\Videos\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\odt\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Start Menu\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Start Menu\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\ReadyBoot\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Prefetch\ReadyBoot\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b4e049f15ea374a88c4508cc4272a9ea

SHA1
12cb8d9523fe884f47deea2d7cd3608a2a2a3081

SHA256
3104f6f22526403c27ac573a0245625203d0b2c47339c066c42ccbd113e92a25

SHA512
cd9a6b4663c3526064b05628724de69ff7bc841f204dc93b50f064642c49b007da21e8351b21f925251a5c16aa4ecb10cb7b2ef22dc588e3e227da00284a67c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7af48ae245b8278d334b2cc8a3516ceb

SHA1
08b5f73aa0746c4faa81fb9f79e9ad71e334b0c3

SHA256
13b1bd43056f5e7692fb1f6f8d4cc9ee865eb6ffb3bafe515548266ae5c05856

SHA512
b4db8e2b68b72cd5e3c340c757baa119702329400289b12eaacae776e69c64ab4e41706af9e4f32c485685a52f95cd9b3074fa650a3f9a19e774198ee6acea93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5aa9eb90ff0f773639feea8016bab7af

SHA1
d81282e565284408106ff2a38ef79eea3a7e56cf

SHA256
552ee36052248c59b5db3cd56da30d3ce025e877726d055af0fd5d46d9d73060

SHA512
a06ef0df72e225f40b556743269d06bce33fbbe3cbddbc127e5d01656fd7bf3a73155abb6b0b54f91604a362e353f09aa1b8f8ff9d50ded41d15913bbe4b6c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9803fcefb5acd0be10adb8de1f961700

SHA1
e9322f23857dc84d46fb55d4607233f99f9be5ab

SHA256
3f5237fc912aa4baf19aff899ab763cf2a89ff23b64dcd3c94dc7443c5cb6afe

SHA512
19e34eda6cd2080cf3b5fc0b96c6f92509f6d3dfcaf74dbb1e489bf66c5f0d31830e4a97772e16ce92cf3a37abd76a3211de1c93822ecd23625cf01008d3c83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9803fcefb5acd0be10adb8de1f961700

SHA1
e9322f23857dc84d46fb55d4607233f99f9be5ab

SHA256
3f5237fc912aa4baf19aff899ab763cf2a89ff23b64dcd3c94dc7443c5cb6afe

SHA512
19e34eda6cd2080cf3b5fc0b96c6f92509f6d3dfcaf74dbb1e489bf66c5f0d31830e4a97772e16ce92cf3a37abd76a3211de1c93822ecd23625cf01008d3c83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9803fcefb5acd0be10adb8de1f961700

SHA1
e9322f23857dc84d46fb55d4607233f99f9be5ab

SHA256
3f5237fc912aa4baf19aff899ab763cf2a89ff23b64dcd3c94dc7443c5cb6afe

SHA512
19e34eda6cd2080cf3b5fc0b96c6f92509f6d3dfcaf74dbb1e489bf66c5f0d31830e4a97772e16ce92cf3a37abd76a3211de1c93822ecd23625cf01008d3c83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
754c29885a91889d54e37ff5501b2c64

SHA1
4dc3c40717cd0fae4a04f53e54a5bd80f3bfc319

SHA256
2f6b1a2b6ce7d300327567e9e1f1247a7b7a5c180b2c9ae4a4a55d2104ef9f64

SHA512
c754fd14dd55993c0ff29cb272a46b5c2b3168915c9a462da3c2fe2b99a9ae23c082f086ec5df95bc5f3b8a6f0db6a08414311b1c586e2d4b3e712298ff7057d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5aa9eb90ff0f773639feea8016bab7af

SHA1
d81282e565284408106ff2a38ef79eea3a7e56cf

SHA256
552ee36052248c59b5db3cd56da30d3ce025e877726d055af0fd5d46d9d73060

SHA512
a06ef0df72e225f40b556743269d06bce33fbbe3cbddbc127e5d01656fd7bf3a73155abb6b0b54f91604a362e353f09aa1b8f8ff9d50ded41d15913bbe4b6c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0c12ae6c0ae954ba41f714442dbb3ec7

SHA1
33f10e0170434a491dd612a708976b1e48f524db

SHA256
27b497dfff6c64331e74387da006531281e5e951738d597a15e2bd1501303651

SHA512
1087d4a96b1442c2421e2c4fdf6391fb06b93cfdf11d077ee22ffd3c7ea7959eced3ff29ca4e86579923e6850d56f22a6c35dd89972200f5399c6d0d7780ba19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0fb99751b563554d0d05c1fb86bc6739

SHA1
378c3e2019a04929bca97332079decd82b5461b0

SHA256
e442bcbde2c14d925e90cf79508b2a1dd579e2a0e32184b38b9c008883eb49ad

SHA512
ea1151a69457517d32725f407ba1209df0092e4d56f1ed7745fcf57b752cef17e85b803724743b0c0ac3efa20327022d0b12634ef2a10f5621758c363070350f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0fb99751b563554d0d05c1fb86bc6739

SHA1
378c3e2019a04929bca97332079decd82b5461b0

SHA256
e442bcbde2c14d925e90cf79508b2a1dd579e2a0e32184b38b9c008883eb49ad

SHA512
ea1151a69457517d32725f407ba1209df0092e4d56f1ed7745fcf57b752cef17e85b803724743b0c0ac3efa20327022d0b12634ef2a10f5621758c363070350f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0fb99751b563554d0d05c1fb86bc6739

SHA1
378c3e2019a04929bca97332079decd82b5461b0

SHA256
e442bcbde2c14d925e90cf79508b2a1dd579e2a0e32184b38b9c008883eb49ad

SHA512
ea1151a69457517d32725f407ba1209df0092e4d56f1ed7745fcf57b752cef17e85b803724743b0c0ac3efa20327022d0b12634ef2a10f5621758c363070350f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3ca8e3f4769632a978c839091e0f236a

SHA1
a1de6896274d9175ed020f79d5207f0ea860cc92

SHA256
72b7d5de4b588b78ae3a5915d28e5b53c90deeec9a70a4220507d6e5122f2b4f

SHA512
f4bb51306f8cf990af05f411d97a3435b802e82753f8dfa012e8376f881c3246a12c9ddd9e3ea39aee8009bd35da6cd82dad8600386b3b91cf681026dd78caee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f320f6202566a667986fed4b1f808b34

SHA1
19228b4d20a0650f429e7b5723eb7c47c2a81862

SHA256
639229fa867fcb0acd2ec47de8fcb98c7c819e9073f86e389958ff0486136fef

SHA512
d9b58dcf2c45727845b33dd6c93f0e0e1bbf4a8a56988e7df8e2e1272232290f34611a66dfc7990721a2a7d0459f6401e3d896aa2b9a51af965d0405e44c2644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
104B

MD5
c6f6eb97fc8e3e9d1d2bb2bcaccc9749

SHA1
36d94bbdffc0bc604aa34fffb64601508cd3f06a

SHA256
7c0bee49c4b1ebef057dd49dba476eb670aa649ed26c42dde8434e024be87d91

SHA512
3f11493940ee6d80a8b57c335ec72ba95158547beca003f389557df0cfe4d50dfc629ea834ac35d8c964277672831f353734a55381a04e51ec41caca907377b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\8xeM6k5O3T.bat

Filesize
205B

MD5
2dada7c477df1999f18ca4d79e6af33b

SHA1
64d93030384b10196efb13da1551b42531999037

SHA256
20e481a368c34299bf5c16555fa479db20ac42d9a66cc8a3c38db24c74d6d47e

SHA512
15be23df78d8133b7fa8ad04e8125a14579cd315e86e70d624a4d25e46abca4ed0318ac4a1b4facac1f3cea1343882dbca63508247d8d05c6127dbfdf6ad0f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8xeM6k5O3T.bat

Filesize
205B

MD5
2dada7c477df1999f18ca4d79e6af33b

SHA1
64d93030384b10196efb13da1551b42531999037

SHA256
20e481a368c34299bf5c16555fa479db20ac42d9a66cc8a3c38db24c74d6d47e

SHA512
15be23df78d8133b7fa8ad04e8125a14579cd315e86e70d624a4d25e46abca4ed0318ac4a1b4facac1f3cea1343882dbca63508247d8d05c6127dbfdf6ad0f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\F4MZx53eLu.bat

Filesize
205B

MD5
461459b2b992dd474a7b6eebb87735ef

SHA1
8debb73f187624c14c1820b9dc5e847424e7846b

SHA256
3f60e3f957c4e1ec8108d3463d64e029beb41125f4f9a898cd5a9b391ac6788f

SHA512
1708f336362e2f264ea1f34236c96fcb5aa17b88140d23f01deb81a9ce5b8453af93bbecc3d8af64d94a98980b12d39d0317a7d3178d82d8b00c851d127333e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBiR4PpyYA.bat

Filesize
205B

MD5
8fc2192f4c7bd5992a352a6ce44f1bb5

SHA1
f129f2c7bc470fa4aae9909af9165ef3e9850124

SHA256
0326a03dcac2892404a751df219c4b41024efe56ff1ae8d5d3df2229d7f36de1

SHA512
d78463ab3b971dcbeda20fde58f6434ef30b73cfefeff6bd6add6aa3665fe25d13165ebb269fcdc3dd22fc703b51138832e0aade0583f35a4584ee3a0bb1e852

Download Submit
C:\Users\Admin\AppData\Local\Temp\PliZKNaLvF.bat

Filesize
205B

MD5
bbcb314e33fe2d4c52215ee69609f3a3

SHA1
b3963c6a645314cb24aa5cfb02e2aa6ad95025f0

SHA256
475466f846d4cf9e9edae9d50fa657e4ca40705fb5a21f5bd57cc8162d92aa63

SHA512
7df2e7118ee9d390ad7d4243b0cf723335c296fac6fb1fae8e607ae7377b7ea2014a1cf80c72977354e18746a6fde84652c37510885e08791b692083628b9e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat

Filesize
205B

MD5
199a0370b788284a918f9cb2e2289bef

SHA1
06336564beb7147abcd8535e31403a2036910a80

SHA256
5d8c20a10b7456f3fe026ce0f84adc4f01455b30b1f7c3fd4cf0f8c398511aad

SHA512
bdffada25cebf50f71595012cf39e731c0f3821d064fd9e458bb1e05fb898a3773ff08d9ba055186c813d9d786233b717a36289a46311489a9051c1fff5de6ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\XkJigN4PJf.bat

Filesize
205B

MD5
777593f002354e05a0a4a55dcdb4abe8

SHA1
3484f10dbf2a11d4a30130705da999f9dba887ae

SHA256
9eff49e909b3c9106a3ca0c212f515da94620d9ecdd14240d4729af8e45af25e

SHA512
77b87619c22d98f6b145eb73e23d00163fff70c861d6d1d31c7459354fd5c3bce837a27bce0b7a04fd12632022783800f0b4ba8b10df1602116334dd8b159e00

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjtq3MYUh4.bat

Filesize
205B

MD5
dd1c327082799de4c9650e289d7e539b

SHA1
3d8b1f24c3f90234974db44df86adef33dc73224

SHA256
d47f881417e90ed0cd04e323aea79d63cde9fd38f70d55c10419bcffc46752a4

SHA512
7d42ea4402b9658f37c444c4391b189f757d41c2def60dd85cdf52171d702b45fcdb2555f2b35b9aca5fa61abf56dc0b5fee9b65d5f6d3caefe8a53c368a2f46

Download Submit
C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat

Filesize
205B

MD5
05141975012a682633b3a4210f7cd5af

SHA1
93ae6db5a323ff6a365efc5a0c100fa220e028e6

SHA256
5fdbc8243f6d6cc576f92185754ecc4741b4887d8ec797adffa4afbc3a9d3749

SHA512
466bc6127c59e0ae99f791883ad970b9000e8c5071484a9f63403ae4707d5fcdd2d384190fb25f8f3620907acff896384e3ab4fe378de069dbae756ab6660653

Download Submit
C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat

Filesize
205B

MD5
9c23e3d262eac4e32e8a535a493234e0

SHA1
880a0998f9bcc3345d754b7da82ba8db06beb249

SHA256
a005359bcc0b4cc16acbfcd9fb552248968eb268a80b60100937af896a4f7241

SHA512
6a6a3e1cb35d599943c68cb7abca98be63db773668d336daf0491329255ca1bd5a994984d04293ec48aa40bc42655ea0412a4db9cf946936fb9ce6b2bc3e6453

Download Submit
C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat

Filesize
205B

MD5
a6007c96f6bf5e0c8afdc2a0dda5669d

SHA1
d27ec23433eec238ee95dff7cb7a85aa9e2ac629

SHA256
bcdfdb2f8740618b0313709df123571fe81ada9b88f318d5809612778a010b8c

SHA512
85fd19c98e2d4de8384fe16e5f3787f9fbd07255e27aba058c68e57763a8b236cbde737c23c75aca76475af03dc8ae4a83506f609528b36df8db94685f85b985

Download Submit
C:\Users\All Users\Start Menu\System.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/2232-942-0x0000000001510000-0x0000000001522000-memory.dmp

Filesize
72KB

Download
memory/2284-371-0x000001A42D600000-0x000001A42D622000-memory.dmp

Filesize
136KB

Download
memory/2584-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-179-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-173-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-172-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-157-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-117-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-155-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-180-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-132-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-131-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-130-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-129-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-128-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-127-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-126-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/2584-118-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3800-924-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/3904-930-0x00000000016D0000-0x00000000016E2000-memory.dmp

Filesize
72KB

Download
memory/4228-284-0x0000000002B70000-0x0000000002B82000-memory.dmp

Filesize
72KB

Download
memory/4228-285-0x0000000002B80000-0x0000000002B8C000-memory.dmp

Filesize
48KB

Download
memory/4228-286-0x000000001B570000-0x000000001B57C000-memory.dmp

Filesize
48KB

Download
memory/4228-287-0x000000001B580000-0x000000001B58C000-memory.dmp

Filesize
48KB

Download
memory/4228-283-0x0000000000950000-0x0000000000A60000-memory.dmp

Filesize
1.1MB

Download
memory/4768-390-0x000001B979730000-0x000001B9797A6000-memory.dmp

Filesize
472KB

Download
memory/4808-182-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4808-183-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/4812-382-0x0000000001400000-0x0000000001412000-memory.dmp

Filesize
72KB

Download
memory/4904-918-0x0000000000650000-0x0000000000662000-memory.dmp

Filesize
72KB

Download
memory/5268-936-0x0000000001260000-0x0000000001272000-memory.dmp

Filesize
72KB

Download