dcrat | ef04e639f3be87a95e31fad75b1c1125c4eae666cff1cae21b3f68e12ebfa4b0

Analysis

max time kernel
147s
max time network
149s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ef04e639f3be87a95e31fad75b1c1125c4eae666cff1cae21b3f68e12ebfa4b0.exe
Size

1.3MB
MD5

356af3cc852ed6aba6b37cf607153ddf
SHA1

c5f1cb3b173fa21984fa41e99a5a3dbd30097287
SHA256

ef04e639f3be87a95e31fad75b1c1125c4eae666cff1cae21b3f68e12ebfa4b0
SHA512

2135f1ffd2fcc9932000edcaeaae68958f6fceeba92dcb25faaee0980fd69ef0f4b3d6e78fd81b3e8d39af107a33a50a49f7148b9f3e0157a59bc3fde2e62fd7
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	164	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2436	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	2436	schtasks.exe	70

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001abec-279.dat	dcrat
behavioral1/files/0x000800000001abec-280.dat	dcrat
behavioral1/memory/4936-281-0x0000000000B80000-0x0000000000C90000-memory.dmp	dcrat
behavioral1/files/0x000800000001abec-331.dat	dcrat
behavioral1/files/0x000200000001ac05-601.dat	dcrat
behavioral1/files/0x000800000001abec-894.dat	dcrat
behavioral1/files/0x000200000001ac05-1053.dat	dcrat
behavioral1/files/0x000600000001ac52-1342.dat	dcrat
behavioral1/files/0x000600000001ac52-1358.dat	dcrat
behavioral1/files/0x000600000001ac52-1513.dat	dcrat
behavioral1/files/0x000600000001ac52-1519.dat	dcrat
behavioral1/files/0x000600000001ac52-1524.dat	dcrat
behavioral1/files/0x000600000001ac52-1529.dat	dcrat
behavioral1/files/0x000600000001ac52-1535.dat	dcrat

Executes dropped EXE 9 IoCs

pid	Process
4936	DllCommonsvc.exe
1636	DllCommonsvc.exe
2900	DllCommonsvc.exe
5732	services.exe
5552	services.exe
5300	services.exe
4476	services.exe
5748	services.exe
5812	services.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\services.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\e978f868350d50	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\de-DE\dab4d89cac03ec	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\de-DE\SearchUI.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\services.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\smss.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\sppsvc.exe	DllCommonsvc.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\de-DE\DllCommonsvc.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\de-DE\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\de-DE\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\Tasks\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Windows\MiracastView\Assets\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\MiracastView\Assets\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\Fonts\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\Logs\WindowsUpdate\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\Logs\WindowsUpdate\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\Tasks\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Windows\Fonts\088424020bedd6	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
164	schtasks.exe
4556	schtasks.exe
3608	schtasks.exe
2864	schtasks.exe
1608	schtasks.exe
4840	schtasks.exe
3128	schtasks.exe
4188	schtasks.exe
584	schtasks.exe
1188	schtasks.exe
4688	schtasks.exe
5056	schtasks.exe
5068	schtasks.exe
5732	schtasks.exe
2684	schtasks.exe
5908	schtasks.exe
3028	schtasks.exe
4220	schtasks.exe
2872	schtasks.exe
2252	schtasks.exe
4504	schtasks.exe
684	schtasks.exe
196	schtasks.exe
5900	schtasks.exe
4656	schtasks.exe
1560	schtasks.exe
6112	schtasks.exe
5556	schtasks.exe
4920	schtasks.exe
4500	schtasks.exe
3716	schtasks.exe
4968	schtasks.exe
3736	schtasks.exe
512	schtasks.exe
2900	schtasks.exe
4724	schtasks.exe
876	schtasks.exe
2252	schtasks.exe
5036	schtasks.exe
1768	schtasks.exe
5832	schtasks.exe
1396	schtasks.exe
1284	schtasks.exe
2820	schtasks.exe
2824	schtasks.exe
4816	schtasks.exe
5044	schtasks.exe
4396	schtasks.exe
2008	schtasks.exe
4524	schtasks.exe
3960	schtasks.exe
1396	schtasks.exe
3496	schtasks.exe
2132	schtasks.exe
3680	schtasks.exe
1812	schtasks.exe
5048	schtasks.exe
4972	schtasks.exe
4684	schtasks.exe
4988	schtasks.exe
5172	schtasks.exe
4664	schtasks.exe
4180	schtasks.exe
3168	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	ef04e639f3be87a95e31fad75b1c1125c4eae666cff1cae21b3f68e12ebfa4b0.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	services.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4936	DllCommonsvc.exe
4936	DllCommonsvc.exe
4936	DllCommonsvc.exe
4936	DllCommonsvc.exe
4936	DllCommonsvc.exe
4936	DllCommonsvc.exe
4936	DllCommonsvc.exe
1068	powershell.exe
1068	powershell.exe
772	powershell.exe
772	powershell.exe
1540	powershell.exe
1540	powershell.exe
1540	powershell.exe
4628	powershell.exe
4628	powershell.exe
648	powershell.exe
648	powershell.exe
1768	powershell.exe
1768	powershell.exe
1428	powershell.exe
1428	powershell.exe
3192	powershell.exe
3192	powershell.exe
3308	powershell.exe
3308	powershell.exe
2228	powershell.exe
2228	powershell.exe
1428	powershell.exe
772	powershell.exe
1540	powershell.exe
1068	powershell.exe
1636	DllCommonsvc.exe
1636	DllCommonsvc.exe
1428	powershell.exe
4628	powershell.exe
648	powershell.exe
1768	schtasks.exe
3192	powershell.exe
772	powershell.exe
3308	powershell.exe
1068	powershell.exe
2228	powershell.exe
4628	powershell.exe
648	powershell.exe
1768	schtasks.exe
3192	powershell.exe
1636	DllCommonsvc.exe
1636	DllCommonsvc.exe
3308	powershell.exe
2228	powershell.exe
2132	powershell.exe
2132	powershell.exe
2132	powershell.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
4364	powershell.exe
4364	powershell.exe
2132	powershell.exe
3776	powershell.exe
3776	powershell.exe
3992	powershell.exe
1576	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	DllCommonsvc.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	648	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	1636	DllCommonsvc.exe
Token: SeDebugPrivilege	3308	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeIncreaseQuotaPrivilege	1540	powershell.exe
Token: SeSecurityPrivilege	1540	powershell.exe
Token: SeTakeOwnershipPrivilege	1540	powershell.exe
Token: SeLoadDriverPrivilege	1540	powershell.exe
Token: SeSystemProfilePrivilege	1540	powershell.exe
Token: SeSystemtimePrivilege	1540	powershell.exe
Token: SeProfSingleProcessPrivilege	1540	powershell.exe
Token: SeIncBasePriorityPrivilege	1540	powershell.exe
Token: SeCreatePagefilePrivilege	1540	powershell.exe
Token: SeBackupPrivilege	1540	powershell.exe
Token: SeRestorePrivilege	1540	powershell.exe
Token: SeShutdownPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeSystemEnvironmentPrivilege	1540	powershell.exe
Token: SeRemoteShutdownPrivilege	1540	powershell.exe
Token: SeUndockPrivilege	1540	powershell.exe
Token: SeManageVolumePrivilege	1540	powershell.exe
Token: 33	1540	powershell.exe
Token: 34	1540	powershell.exe
Token: 35	1540	powershell.exe
Token: 36	1540	powershell.exe
Token: SeIncreaseQuotaPrivilege	1428	powershell.exe
Token: SeSecurityPrivilege	1428	powershell.exe
Token: SeTakeOwnershipPrivilege	1428	powershell.exe
Token: SeLoadDriverPrivilege	1428	powershell.exe
Token: SeSystemProfilePrivilege	1428	powershell.exe
Token: SeSystemtimePrivilege	1428	powershell.exe
Token: SeProfSingleProcessPrivilege	1428	powershell.exe
Token: SeIncBasePriorityPrivilege	1428	powershell.exe
Token: SeCreatePagefilePrivilege	1428	powershell.exe
Token: SeBackupPrivilege	1428	powershell.exe
Token: SeRestorePrivilege	1428	powershell.exe
Token: SeShutdownPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeSystemEnvironmentPrivilege	1428	powershell.exe
Token: SeRemoteShutdownPrivilege	1428	powershell.exe
Token: SeUndockPrivilege	1428	powershell.exe
Token: SeManageVolumePrivilege	1428	powershell.exe
Token: 33	1428	powershell.exe
Token: 34	1428	powershell.exe
Token: 35	1428	powershell.exe
Token: 36	1428	powershell.exe
Token: SeIncreaseQuotaPrivilege	1068	powershell.exe
Token: SeSecurityPrivilege	1068	powershell.exe
Token: SeTakeOwnershipPrivilege	1068	powershell.exe
Token: SeLoadDriverPrivilege	1068	powershell.exe
Token: SeSystemProfilePrivilege	1068	powershell.exe
Token: SeSystemtimePrivilege	1068	powershell.exe
Token: SeProfSingleProcessPrivilege	1068	powershell.exe
Token: SeIncBasePriorityPrivilege	1068	powershell.exe
Token: SeCreatePagefilePrivilege	1068	powershell.exe
Token: SeBackupPrivilege	1068	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 4860	2688	ef04e639f3be87a95e31fad75b1c1125c4eae666cff1cae21b3f68e12ebfa4b0.exe	66
PID 2688 wrote to memory of 4860	2688	ef04e639f3be87a95e31fad75b1c1125c4eae666cff1cae21b3f68e12ebfa4b0.exe	66
PID 2688 wrote to memory of 4860	2688	ef04e639f3be87a95e31fad75b1c1125c4eae666cff1cae21b3f68e12ebfa4b0.exe	66
PID 4860 wrote to memory of 3932	4860	WScript.exe	67
PID 4860 wrote to memory of 3932	4860	WScript.exe	67
PID 4860 wrote to memory of 3932	4860	WScript.exe	67
PID 3932 wrote to memory of 4936	3932	cmd.exe	69
PID 3932 wrote to memory of 4936	3932	cmd.exe	69
PID 4936 wrote to memory of 1540	4936	DllCommonsvc.exe	98
PID 4936 wrote to memory of 1540	4936	DllCommonsvc.exe	98
PID 4936 wrote to memory of 1068	4936	DllCommonsvc.exe	99
PID 4936 wrote to memory of 1068	4936	DllCommonsvc.exe	99
PID 4936 wrote to memory of 772	4936	DllCommonsvc.exe	100
PID 4936 wrote to memory of 772	4936	DllCommonsvc.exe	100
PID 4936 wrote to memory of 1768	4936	DllCommonsvc.exe	102
PID 4936 wrote to memory of 1768	4936	DllCommonsvc.exe	102
PID 4936 wrote to memory of 648	4936	DllCommonsvc.exe	104
PID 4936 wrote to memory of 648	4936	DllCommonsvc.exe	104
PID 4936 wrote to memory of 4628	4936	DllCommonsvc.exe	106
PID 4936 wrote to memory of 4628	4936	DllCommonsvc.exe	106
PID 4936 wrote to memory of 1428	4936	DllCommonsvc.exe	108
PID 4936 wrote to memory of 1428	4936	DllCommonsvc.exe	108
PID 4936 wrote to memory of 3308	4936	DllCommonsvc.exe	109
PID 4936 wrote to memory of 3308	4936	DllCommonsvc.exe	109
PID 4936 wrote to memory of 3192	4936	DllCommonsvc.exe	110
PID 4936 wrote to memory of 3192	4936	DllCommonsvc.exe	110
PID 4936 wrote to memory of 2228	4936	DllCommonsvc.exe	113
PID 4936 wrote to memory of 2228	4936	DllCommonsvc.exe	113
PID 4936 wrote to memory of 1636	4936	DllCommonsvc.exe	118
PID 4936 wrote to memory of 1636	4936	DllCommonsvc.exe	118
PID 1636 wrote to memory of 2132	1636	DllCommonsvc.exe	157
PID 1636 wrote to memory of 2132	1636	DllCommonsvc.exe	157
PID 1636 wrote to memory of 3992	1636	DllCommonsvc.exe	158
PID 1636 wrote to memory of 3992	1636	DllCommonsvc.exe	158
PID 1636 wrote to memory of 4364	1636	DllCommonsvc.exe	160
PID 1636 wrote to memory of 4364	1636	DllCommonsvc.exe	160
PID 1636 wrote to memory of 3776	1636	DllCommonsvc.exe	161
PID 1636 wrote to memory of 3776	1636	DllCommonsvc.exe	161
PID 1636 wrote to memory of 1576	1636	DllCommonsvc.exe	162
PID 1636 wrote to memory of 1576	1636	DllCommonsvc.exe	162
PID 1636 wrote to memory of 1560	1636	DllCommonsvc.exe	163
PID 1636 wrote to memory of 1560	1636	DllCommonsvc.exe	163
PID 1636 wrote to memory of 3484	1636	DllCommonsvc.exe	167
PID 1636 wrote to memory of 3484	1636	DllCommonsvc.exe	167
PID 1636 wrote to memory of 4204	1636	DllCommonsvc.exe	168
PID 1636 wrote to memory of 4204	1636	DllCommonsvc.exe	168
PID 1636 wrote to memory of 3956	1636	DllCommonsvc.exe	170
PID 1636 wrote to memory of 3956	1636	DllCommonsvc.exe	170
PID 1636 wrote to memory of 5088	1636	DllCommonsvc.exe	178
PID 1636 wrote to memory of 5088	1636	DllCommonsvc.exe	178
PID 1636 wrote to memory of 5068	1636	DllCommonsvc.exe	177
PID 1636 wrote to memory of 5068	1636	DllCommonsvc.exe	177
PID 1636 wrote to memory of 4508	1636	DllCommonsvc.exe	176
PID 1636 wrote to memory of 4508	1636	DllCommonsvc.exe	176
PID 1636 wrote to memory of 4308	1636	DllCommonsvc.exe	179
PID 1636 wrote to memory of 4308	1636	DllCommonsvc.exe	179
PID 1636 wrote to memory of 4784	1636	DllCommonsvc.exe	183
PID 1636 wrote to memory of 4784	1636	DllCommonsvc.exe	183
PID 4784 wrote to memory of 5044	4784	cmd.exe	185
PID 4784 wrote to memory of 5044	4784	cmd.exe	185
PID 4784 wrote to memory of 2900	4784	cmd.exe	186
PID 4784 wrote to memory of 2900	4784	cmd.exe	186
PID 2900 wrote to memory of 4924	2900	DllCommonsvc.exe	220
PID 2900 wrote to memory of 4924	2900	DllCommonsvc.exe	220

C:\Users\Admin\AppData\Local\Temp\ef04e639f3be87a95e31fad75b1c1125c4eae666cff1cae21b3f68e12ebfa4b0.exe
"C:\Users\Admin\AppData\Local\Temp\ef04e639f3be87a95e31fad75b1c1125c4eae666cff1cae21b3f68e12ebfa4b0.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\System\Ole DB\de-DE\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Services\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1636
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2132
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\DllCommonsvc.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\ja-JP\powershell.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4364
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\sppsvc.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3776
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1576
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Media Renderer\csrss.exe'
        6⤵
        
        PID:1560
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Cookies\conhost.exe'
        6⤵
        
        PID:3484
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        6⤵
        
        PID:4204
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\conhost.exe'
        6⤵
        
        PID:3956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
        6⤵
        
        PID:4508
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\fontdrvhost.exe'
        6⤵
        
        PID:5068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\de-DE\SearchUI.exe'
        6⤵
        
        PID:5088
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\conhost.exe'
        6⤵
        
        PID:4308
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fzhvnpfF0N.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5044
        
        C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        8⤵
        
        PID:4924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\powershell.exe'
        8⤵
        
        PID:2332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\MiracastView\Assets\conhost.exe'
        8⤵
        
        PID:4392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        8⤵
        
        PID:3524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\services.exe'
        8⤵
        
        PID:6048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\conhost.exe'
        8⤵
        
        PID:5384
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\csrss.exe'
        8⤵
        
        PID:308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\USOPrivate\services.exe'
        8⤵
        
        PID:4360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\powershell.exe'
        8⤵
        
        PID:1132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\conhost.exe'
        8⤵
        
        PID:5888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\WindowsUpdate\conhost.exe'
        8⤵
        
        PID:1932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
        8⤵
        
        PID:192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HXd7sDD6Ri.bat"
        8⤵
        
        PID:3932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1884
        
        C:\Users\All Users\USOPrivate\services.exe
        
        "C:\Users\All Users\USOPrivate\services.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat"
        10⤵
        
        PID:2280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:6064
        
        C:\Users\All Users\USOPrivate\services.exe
        
        "C:\Users\All Users\USOPrivate\services.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"
        12⤵
        
        PID:756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4972
        
        C:\Users\All Users\USOPrivate\services.exe
        
        "C:\Users\All Users\USOPrivate\services.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DemtbJLPzJ.bat"
        14⤵
        
        PID:4868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2020
        
        C:\Users\All Users\USOPrivate\services.exe
        
        "C:\Users\All Users\USOPrivate\services.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat"
        16⤵
        
        PID:4068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4912
        
        C:\Users\All Users\USOPrivate\services.exe
        
        "C:\Users\All Users\USOPrivate\services.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MNu5MeZyGQ.bat"
        18⤵
        
        PID:1900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1396
        
        C:\Users\All Users\USOPrivate\services.exe
        
        "C:\Users\All Users\USOPrivate\services.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LdN2yJpTNi.bat"
        20⤵
        
        PID:3892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:5660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\System\Ole DB\de-DE\services.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\Ole DB\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\System\Ole DB\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Desktop\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Desktop\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Services\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Services\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Windows\de-DE\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\de-DE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Cookies\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Cookies\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\de-DE\SearchUI.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\de-DE\SearchUI.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\Tasks\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Tasks\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Admin\powershell.exe'" /rl HIGHEST /f
1⤵
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\powershell.exe'" /rl HIGHEST /f
1⤵
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Windows\MiracastView\Assets\conhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:5732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\MiracastView\Assets\conhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\MiracastView\Assets\conhost.exe'" /rl HIGHEST /f
1⤵
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\services.exe'" /f
1⤵
- Creates scheduled task(s)
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\services.exe'" /rl HIGHEST /f
1⤵
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\services.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\conhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
1⤵
PID:5560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Creates scheduled task(s)
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\USOPrivate\services.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\USOPrivate\services.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\USOPrivate\services.exe'" /rl HIGHEST /f
1⤵
PID:5800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Users\Public\powershell.exe'" /f
1⤵
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Public\powershell.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\Users\Public\powershell.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\conhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:5832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Fonts\conhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\conhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\Logs\WindowsUpdate\conhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:6112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Logs\WindowsUpdate\conhost.exe'" /rl HIGHEST /f
1⤵
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Windows\Logs\WindowsUpdate\conhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
1⤵
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\USOPrivate\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\USOPrivate\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\USOPrivate\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\USOPrivate\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\USOPrivate\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\ProgramData\USOPrivate\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
b4268d8ae66fdd920476b97a1776bf85

SHA1
f920de54f7467f0970eccc053d3c6c8dd181d49a

SHA256
61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879

SHA512
03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7bf5e538e9f63f92f7028b22ee070ec6

SHA1
348735543b366d60f02f537dafc581905b0e1c84

SHA256
7f417088f56aed169c28627357f045cc3fae3b577134911568b6aeed616c8d73

SHA512
7dc9f94399fbfd248a848b6bd56b5c01b89c4a04f3577513f8628a61e4094583b0a87320d7880b32075dc269e083dbea8ecdbe82048275386a9a7614c2f6860e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4f09ae73aecef8253e517dfd0ccfe5f1

SHA1
52afae247ffe075fbe094fe77878eb8632952440

SHA256
201aeb79eb5f2ef276706bb6fd74b7570225485a62ab6ccc724f0950c42ffee0

SHA512
75c9169e9397439a25a166535dbe87ef1858768ee336f344169dea9dedc848a7e30e59bab5a836e80b0014ff4d8b2ced25a5eda8767dc4469293f858ca95e4ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4f09ae73aecef8253e517dfd0ccfe5f1

SHA1
52afae247ffe075fbe094fe77878eb8632952440

SHA256
201aeb79eb5f2ef276706bb6fd74b7570225485a62ab6ccc724f0950c42ffee0

SHA512
75c9169e9397439a25a166535dbe87ef1858768ee336f344169dea9dedc848a7e30e59bab5a836e80b0014ff4d8b2ced25a5eda8767dc4469293f858ca95e4ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4f09ae73aecef8253e517dfd0ccfe5f1

SHA1
52afae247ffe075fbe094fe77878eb8632952440

SHA256
201aeb79eb5f2ef276706bb6fd74b7570225485a62ab6ccc724f0950c42ffee0

SHA512
75c9169e9397439a25a166535dbe87ef1858768ee336f344169dea9dedc848a7e30e59bab5a836e80b0014ff4d8b2ced25a5eda8767dc4469293f858ca95e4ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b000a6c8248e5231a73b6da38e86dec0

SHA1
b031a840f65e740807cc906ad4b5ee8f613c812e

SHA256
3765d65e536e558baed30cd1fd701f4bb7a111cafcc0323268e2c6cec34bac06

SHA512
0a1bc8beacaf01943b11251a59766f954e02df24e01e1c4341abac1d06394c96f3dc4f831176b04f5abead2622af299bc733c08ee18cffe5b034af8ea0db4e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4e85b30512ca6fb95c98ca26ecae37e

SHA1
d564514d696ce0405c142ae26a96824bc7f96053

SHA256
7912d476b91d52c9e51d605e1ce57b3b7924cdcf3be29d325101c828cacd3b61

SHA512
e79db828756d32b89ec0b651ad4cb65228d033776e6312a1235aac198e43170d055fd9fb5481b854a1dadd2e04828c5b66ee0014f2cd59649a0945795230a996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
960f16fa1521e7c97b1ae6098e276026

SHA1
c76a2bace4226f6c8139f22f75fcfec825ae68f1

SHA256
2d3d7d283beb80d0d2d5303b0fabc4740b755d21eaae5e4baaa4010e800f66c3

SHA512
320ff1c734f898dcea6ce4d632a40b4d92e875a8c51b92caec93b1550967f1dc5890784610426be7dfdcf4eb0f2587e9e91d3c894273fad183fa3725e96551dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
666645396c2ed47289bcde84115d9d2c

SHA1
1dacfec155d8a12dcc82fe379065a2e8c40f0f2c

SHA256
2913fcb0ba9c883a39984545cc43be1a35b2cc4675304f109aec03ce197be6c5

SHA512
01f79e028aa30418f6e37f420fb16ec7102c4a02a0051bec89528d42743ac1861e859125636024fe83de58a3dd97d31f468e5070a579706b42846f9499fd2efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0c09987fe2e338760a78d9563cd95044

SHA1
b97a65ca35f49879a682500666378775382d788c

SHA256
b49dea66df6ed650cf6d631346cd37522442af59a431bc705d7e783425e930eb

SHA512
dbf54cffcf80ea472ac4d7a7845acff153bc1f5c312d6b3925044fad3044f11af81e71dd84cd4b7c5a74f8dd11dde1dd7b438abec36f334f26555f1144e3e8d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0d1043203a42a9605ec9aad0bac38a32

SHA1
c164bdd1842ec1dee356695bed0922190cc8a3fd

SHA256
29c8c762e3d3d24c6a904ce1c4427480d9034dadb88200604cb0dd3e197257bc

SHA512
cceb77ef877b3efc187b0b844e3f8fd2f0a90a305371d94c1177ed42f499fa6ae7c662892a7801cd2a641f501c25dd3e8919b33a8285f6a3616ef894671e78cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ea41c95395a8f25291e6d03918570760

SHA1
6596eabc4e8d5ced1a1e49322bdeffbea7036743

SHA256
293fb469c78177fda37ef60c89226612c2a0fb60b6d8d8bca901090bf9287133

SHA512
4ac87b9f2013886afde05ce87af50e850a94b4eaeebb3b213563897561692765299bbb9d19bbcf6a388c7bc1b90f961496c4dd14e0a14af6def8151900f4c6ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
38e0ba7444f76bdde54f83e32ee5c97b

SHA1
9574cd823b3c6c7ff38faf0e8dd5836b0e7ccb7a

SHA256
f0a4f7eba7058d83e082a4c594dc805f98eed05a2a4475fd7b4c371bd3614bfe

SHA512
cb49fe2fc505afde59ee23cd695e1dfea2a6b5b831571fd5ba5b0999bad6132f8934432ad0300e73a5f0d326a4b26c0208a48086902bb76f01421971e8560136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5e69d36be9b59a0f668d0ccac047e783

SHA1
9d45dd2c3d5f2f4ff6cf7758556d5402afa37f41

SHA256
a6f0ebee03ad91ced093f024c516bfb22bb7455c79c549e1ddc56d685f0d86c1

SHA512
01ba73078c219bb2d3610d8c7ed2562027857a8f09e785ea2828316fcd5cc0e6df39e0c4455b60169467c9c4ffba8ba0124492ae6761f93d58c815d236337135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
85e7029c2a67ef7c0bb43318ced7af45

SHA1
b46dd97daac127699650239319cf86431a84169e

SHA256
bc8db241920d6227617accb5ba655e739a222296c9572baa08f21dee099f3ad7

SHA512
b71142b88ee59d9c38b6b4a188635a9aa0f87c6d94feaedc1a91c9b08bc3a04850a99803ac6c8a899609f2f56b0ddfe90ddd261185635ecd2286dcadabb3c556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
09718c854757bd0c54a5abd149131f00

SHA1
cbbe8cdad4109d75ab1460630f9f0b23995746e9

SHA256
97c578c23fdb4624bbe88b25392210cd0ab88467b908b2e6092b7fe10ea6d5a3

SHA512
57654bd01deb91661ce01df637708fc767534b4b6fd7f16a88a71afbd1b566a7c24483a1c7b4ca041184b169828cfe6c1fe460fa2d38bc3306246a105fc318dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
880af00931a56784c16f623407e27eef

SHA1
f0760841d65e3c94a9c88ffc00215e9497c7d64d

SHA256
916fa5f8a492bdab3b335b7bd2162afa2946c25bf7aae75f712bf2f86bf7461f

SHA512
38693e712db75125eeeab92b7f7d8763059dcc490f833af82be26d24c3e2228fd19140fa3e13dc3babae811b80dfff38c23129b91fa48dc2593dccf7eab15540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
880af00931a56784c16f623407e27eef

SHA1
f0760841d65e3c94a9c88ffc00215e9497c7d64d

SHA256
916fa5f8a492bdab3b335b7bd2162afa2946c25bf7aae75f712bf2f86bf7461f

SHA512
38693e712db75125eeeab92b7f7d8763059dcc490f833af82be26d24c3e2228fd19140fa3e13dc3babae811b80dfff38c23129b91fa48dc2593dccf7eab15540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
27ad228c70ae7ed2c578e9dedca4fb82

SHA1
6fd8b36b653d537f5c4762a2dde7dac65ca1885a

SHA256
589b452b1840a8da9efc7553cb967c38304f8a59df8c5791b9ab14ee9b7a72a3

SHA512
b7d4cbe8536b1d96809e9ba2e101df3bf1b294f5075ffb6a9438202d8bc07276f14c132609fa19fc94873ebece51421b16ea5c8467137f29b476265d699e9a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
27ad228c70ae7ed2c578e9dedca4fb82

SHA1
6fd8b36b653d537f5c4762a2dde7dac65ca1885a

SHA256
589b452b1840a8da9efc7553cb967c38304f8a59df8c5791b9ab14ee9b7a72a3

SHA512
b7d4cbe8536b1d96809e9ba2e101df3bf1b294f5075ffb6a9438202d8bc07276f14c132609fa19fc94873ebece51421b16ea5c8467137f29b476265d699e9a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8da1f4fe51359529fddd126ce3d71e0b

SHA1
752962a6a94f7d72ed8d171b7540d9023e21cbfc

SHA256
745f3a1af0c607a64f92936a1f7e7989816020cf765f654be34deaafd0e1005c

SHA512
62434698115e81cf2ebce7c221743108767fac34c6927082f2cab4c2f53abc82a44ec778fd9db80139d3e9acaf59552ed1e3dcfb1561256571fc5a7a80da88e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8491d473fe973fd15a3606fa1cf2336b

SHA1
4f79a84b7228dc8298e5a396e92d586302bc830d

SHA256
6bc30d7816e82d542a9dd7507da4271e1459de9900aa2a1fe73db911216957dd

SHA512
3b244b2c6ed2602f188596a11a55407f27d7ecb159cdf8557b2440b0552e5aeda50c7fe5d29c2ead98023147f31f635a72fdebae8f665c2100c33fe1233a3733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
75c7f49ec4ac8c6caa22c71e1e5ac725

SHA1
4da70231b095127448158a3f4e5e1af04d1fa87c

SHA256
1481df5407184d12f18382ecb18475eb76ad9db29e8b01f62be36974928ad7e0

SHA512
50e89680a362167f476968edca1edacfa9914730f348d12d8cafe0ba21c9ef937ccf568418d0258fc48fd88d9c28c95b44b013d6eefbd546147ae46f4115c760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f4ca99e52cfe24964fe8853782bea4eb

SHA1
346c5968dcf5718291bdd991e7e9ac7318b98184

SHA256
009a24a7dce298875d4ff3452acf2a91309010d8588848df4962148835bf1281

SHA512
e3b8735b8f9332eb817e956cac5c2dd23aecc86b028e4af8dfcab6b376123a473331f6c60fdf77551b3c1e77151dd31bc6d5c649078c1835d2567176cc021228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0fb2a9a15939456ff2791cf32fe51a49

SHA1
7d9d6c03ee48adc9170acf00694f09688db840ce

SHA256
8cd06f1203afa2873b5005020b2f194775eba7e0280cc7efe3d1487592470009

SHA512
6a9013a14297892edadfde41627fac7bd45478d3ae70858d763e772b874c97accd3bc05dbd30fc273dba574086db9155af199d86dee8bdf34b889941747c7cd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b4c7daf857ece25891f26f8d4155d3c8

SHA1
31f23b354f95134a176a261a50b02e42f4da2ae0

SHA256
09c7b3468042499795bbe4a59e30121983945207119567712f000ea8b42bdfb8

SHA512
98a10af2bfc4ce4f412f48c785f6cde8754aa6bb505dc246c83a016fa0e437abd6f222bc5dce935fd6708058192f8eddfc9e81b2d76a9932200487010ed11549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
eb8d8b38026c4e1b5dc5e80dc091bc98

SHA1
c0ed0da28b43c1041426e75ff9a731f95ba19b6b

SHA256
e1fcdec165a82d2f2e57efb8a09eb52fed9195ba5470255950fc3f23cf9a9f46

SHA512
df663dc20313d3f8f5f20bf38107010575a42836caca8939c30c738c2e1c6c5112f3a9724e1b92889cd4fcde2a2a730c00a4a5b8e9ee83481802bef462825e24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2d8a9b8f14847af8775d74f92ebada8a

SHA1
de1d11577b0191a237a857e94c95c441ae9a414c

SHA256
2aef2883b47b8459d9b8a2199686e49469683b74b2fea48c552ded5a5ccc754c

SHA512
437eb1d83ce70c544a6a81ba1b109abb8dd832f6846806b5f1f75def4f744463b5346f178b9a067b0c715158716b2f074515467c85d05489d9c2e0a4751edfed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
45dc3ae57328a922ac47367a013b0abe

SHA1
552cf6e5a183b2009b3c66c30fbaa2fbaa74de33

SHA256
95cab7239b3dac4b4f2a9e75797fbe8266f09358d7d9d024ed0f6b20631f000e

SHA512
50075ebac1db3e4dbbd11da8c7c9e46ce0e63c281104e6754d60d9c1f6291bb4f2a5ff1308814ea28a12df7e4fa51268591bad4b3fb28a238d86a021a040424f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f1484c2cbfc074b36185fb242831796d

SHA1
bcaeeda7151d21347934a73debdbf071df9d150a

SHA256
243dd472708694ae8e1119ee908e4000809d2ced78deaca338efbd0dcd646978

SHA512
fd4c0e574a8940838d6d55742cc80addf95218a8bb33366295d41c8c842cf9d53e258bcbad06cb2a74189fdf35b63d99109ef8bcb51a5ccba21218f932ea5e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
41dc48833775ee3b4f95e3640a6fbad4

SHA1
32e229a7e6088ae2364e7d7b253b0b885bc398f1

SHA256
3908d95cdd3d8cccd2317d84b361a93ff245ba41eda8e6397dd7e9d7bb84173d

SHA512
e9da37ae4808312388e6b9154acb17acf26144a2e7d4f44722392e6d2601f3b81e6a07d27cad9e17159d58200e8b7d6812d8fe7550b2488b2e761cd75ccd8b31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0bdfaa14d7814b541a77f4e97920dfd6

SHA1
c239720eee47db7f7136bb78e37c539b9e735c4c

SHA256
4c8946ef444ac60d731d674ad3d32a42edcd2a8d5fc984366f7c09eb24f5a272

SHA512
dfa795a1fd4fc852064cfdf93602899685bf9c13c7c326feca76fc7f97f92662342c52b79b447bcbc20cd55ea724742a499ad8da8e7770377a3e04ae52351608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7bf5e538e9f63f92f7028b22ee070ec6

SHA1
348735543b366d60f02f537dafc581905b0e1c84

SHA256
7f417088f56aed169c28627357f045cc3fae3b577134911568b6aeed616c8d73

SHA512
7dc9f94399fbfd248a848b6bd56b5c01b89c4a04f3577513f8628a61e4094583b0a87320d7880b32075dc269e083dbea8ecdbe82048275386a9a7614c2f6860e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7bf5e538e9f63f92f7028b22ee070ec6

SHA1
348735543b366d60f02f537dafc581905b0e1c84

SHA256
7f417088f56aed169c28627357f045cc3fae3b577134911568b6aeed616c8d73

SHA512
7dc9f94399fbfd248a848b6bd56b5c01b89c4a04f3577513f8628a61e4094583b0a87320d7880b32075dc269e083dbea8ecdbe82048275386a9a7614c2f6860e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DemtbJLPzJ.bat

Filesize
207B

MD5
4858af3fc572ec4d2c2956ce3a5fae54

SHA1
336e67d54f049e3b5cb4fd1013aa727d232cf25b

SHA256
f0aaec366654a57a47beb398121d207b8403dc295b8679a505c851a87385f64a

SHA512
f3d7dbe697a7c2d3ffee3b737dc078f134a9c0679ab97ccf887768d7f8338a59b3556a2c606771bcd5792fae87a09fffb1f97a976e3b7ddc591d03af09720a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\HXd7sDD6Ri.bat

Filesize
207B

MD5
e401723a0fa1b7e177dd6ba774836392

SHA1
5c9ccbf5a318bf6f550d2bd564dfad1294479bf0

SHA256
8d564a3303976ef4f91a7a7d91e4161ce67e257959b51d8186546d0092c8b071

SHA512
d689606e0b440667628565dc10bbd5145844f6da6615a3cb244491927bafefc36bdccfcc45df9e8bc5b354a61e2254c54d429613008b69b6bd4de79f698421ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\LdN2yJpTNi.bat

Filesize
207B

MD5
dc8f0c2e77d7d9269a70443ab4e3bc2e

SHA1
b3edd71f5625e716ac9f5823f371c08b9cb7b35e

SHA256
7d76f8c0f04b554376a5bcd0cdfade992a5d5aa541beb99b404da1cf8063683b

SHA512
f49a9d205d0a506e9e74d319568d6be26e099c01245f00cd0280890b461b1b00376a247c8baf2524a036e194fb74cfb130bc2a442495e7b44b59d4888fc6e678

Download Submit
C:\Users\Admin\AppData\Local\Temp\MNu5MeZyGQ.bat

Filesize
207B

MD5
2fdb645e9e96a5757755e74706d292f5

SHA1
3b74e63d9819fcc1ab216d996880c0cdb0c8e436

SHA256
de7ac1b8f5b50adf3b31af75a224e2d9908136337495366543d912fafb2578d4

SHA512
5124b00452bf286ea71c2226df989528e933776706d9c16d87dd6404e5b65496b9a4f8298a8dad9684b1d38acc3280c6a3c5dd16e614c50b0da1afaad09d4997

Download Submit
C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat

Filesize
207B

MD5
3af7b226f11c56e54be2c9682e7af51d

SHA1
21816ad5240141e2c62d669eed5f1544629fa585

SHA256
75542f74b029264d817c7ae2718309abb2230804e2f51d7cf10135c190a2f9c0

SHA512
32ca2bd162a7f0ee6f4975026c2905f52441acddbb87dc2c16c9433249a757eecc93387c25b909d965c7b6264993731fcd6d50ac35730bcbcde5af3c450a505e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fzhvnpfF0N.bat

Filesize
199B

MD5
a204f7b4a97fd487f2f280f6f642e293

SHA1
d86e99769ff45c210cdf4ef8e84bc64fdc242a99

SHA256
14b633f3764fd5137c2a3e9887c608c31f096a8b7c68cb3cc2148f8a761de4b9

SHA512
8c2276e866bca3117963f628342de8a94bc828df1bc655b2c33372d62c62488e22d466b0e457b7b863fc4827ff96a60cf31c23b29fdf51edf7f1ccf772058c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat

Filesize
207B

MD5
eb2555c2e77e5fac392587491585ee97

SHA1
d52a0690c91c7857b3ad995d1d7d9c0c16e83db6

SHA256
e841c56952ebabcf6bcca28a256f6adcec53ecf0f9edd9510826d53e2a7e7c95

SHA512
1b8f4b25d9cb1bf47fec02922e05cf9c829f6ee9d184b7102af4b464ed8bda6be94422ef65d8f42a2582cfe8c1feba1f4dade105616d68bb8fa9bf143d3e0ed7

Download Submit
C:\Users\All Users\USOPrivate\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\5940a34987c991

Filesize
623B

MD5
87748e409c25d95ed7d6f2f1ff99d9ae

SHA1
d0967053f7f1b34413b63a1c8c7a226715f313d1

SHA256
111a51d64e58eb65c2e041c80dbd8f64dbfa21c23cfd4a1d07cc156d69fc59de

SHA512
f6899fb6ecc943c9a953047e768a41cbe70f9f2f05b1a5d8d484c6962b5c4cb96fdb5eb3ce77915d1b921444308c8070be495c206c29d0232d50ebe651217bf6

Download Submit
C:\odt\5940a34987c991

Filesize
256B

MD5
348cb55390d45731717eff534ab5e5f0

SHA1
f826b008f69083d3031faeb75c6ee68fa39bbe0d

SHA256
f2c84052f6415f4777d535522b52ba90e3d584fdac5520e8ba1e33ba788c086b

SHA512
29f6dfa60401f14b6e15d30ec7e9004ecd4859693ca31cfe70eff7b016b094d3a39df0dd7090ac3b42ef5b54a15ab5579c83a261f1f6a934352e420fe46e99a1

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/772-338-0x0000023C54610000-0x0000023C54632000-memory.dmp

Filesize
136KB

Download
memory/1540-341-0x0000019545200000-0x0000019545276000-memory.dmp

Filesize
472KB

Download
memory/1636-342-0x0000000001060000-0x0000000001072000-memory.dmp

Filesize
72KB

Download
memory/2688-166-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-152-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-116-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-117-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-118-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-120-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-121-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-123-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-124-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-125-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-126-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-127-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-128-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-129-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-130-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-131-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-132-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-133-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-134-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-135-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-136-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-137-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-138-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-139-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-140-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-141-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-142-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-143-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-178-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-177-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-176-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-175-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-174-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-173-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-172-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-171-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-170-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-169-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-165-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-168-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-167-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-115-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-164-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-163-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-162-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-161-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-160-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-159-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-157-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-158-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-156-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-155-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-154-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-144-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-145-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-153-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-146-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-147-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-149-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-151-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-148-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2688-150-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2900-930-0x0000000000A40000-0x0000000000A52000-memory.dmp

Filesize
72KB

Download
memory/4860-180-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/4860-181-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/4936-285-0x0000000002D00000-0x0000000002D0C000-memory.dmp

Filesize
48KB

Download
memory/4936-284-0x0000000002CE0000-0x0000000002CEC000-memory.dmp

Filesize
48KB

Download
memory/4936-283-0x0000000002CF0000-0x0000000002CFC000-memory.dmp

Filesize
48KB

Download
memory/4936-282-0x0000000001320000-0x0000000001332000-memory.dmp

Filesize
72KB

Download
memory/4936-281-0x0000000000B80000-0x0000000000C90000-memory.dmp

Filesize
1.1MB

Download
memory/5732-1401-0x0000000002940000-0x0000000002952000-memory.dmp

Filesize
72KB

Download
memory/5748-1530-0x00000000012F0000-0x0000000001302000-memory.dmp

Filesize
72KB

Download