dcrat | 3234d3a460e83d91445fecb02710a9bcfe3365019ccb66ec68ee45f94537bed3

Analysis

max time kernel
147s
max time network
150s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
02-11-2022 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3234d3a460e83d91445fecb02710a9bcfe3365019ccb66ec68ee45f94537bed3.exe
Size

1.3MB
MD5

25615b21221a4b853d8352f1a25cabc2
SHA1

313a306fe89d3a01d486d09ec60b4752976d4833
SHA256

3234d3a460e83d91445fecb02710a9bcfe3365019ccb66ec68ee45f94537bed3
SHA512

cb7cdac5f31afe619441d24b129d0a0919c0e202baab1246cc2ec1644177f65b28fcb06b45c1ab844b32ad1b433cd8eee825246434fe45ac23482797c554df9e
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	424	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	420	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	3520	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	3520	schtasks.exe	70

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001abf6-284.dat	dcrat
behavioral1/files/0x000800000001abf6-285.dat	dcrat
behavioral1/memory/4200-286-0x0000000000120000-0x0000000000230000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac2b-367.dat	dcrat
behavioral1/files/0x000600000001ac2b-368.dat	dcrat
behavioral1/files/0x000600000001ac2b-931.dat	dcrat
behavioral1/files/0x000600000001ac2b-938.dat	dcrat
behavioral1/files/0x000600000001ac2b-944.dat	dcrat
behavioral1/files/0x000600000001ac2b-950.dat	dcrat
behavioral1/files/0x000600000001ac2b-956.dat	dcrat
behavioral1/files/0x000600000001ac2b-961.dat	dcrat
behavioral1/files/0x000600000001ac2b-966.dat	dcrat
behavioral1/files/0x000600000001ac2b-971.dat	dcrat
behavioral1/files/0x000600000001ac2b-976.dat	dcrat
behavioral1/files/0x000600000001ac2b-981.dat	dcrat

Executes dropped EXE 12 IoCs

pid	Process
4200	DllCommonsvc.exe
4932	Idle.exe
5828	Idle.exe
6020	Idle.exe
5864	Idle.exe
4724	Idle.exe
920	Idle.exe
5024	Idle.exe
2104	Idle.exe
4608	Idle.exe
6016	Idle.exe
4592	Idle.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\winlogon.exe	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\LiveKernelReports\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\LiveKernelReports\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Windows\diagnostics\index\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\Speech\Common\de-DE\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\System\Speech\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\7a0fd90576e088	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4976	schtasks.exe
4324	schtasks.exe
1044	schtasks.exe
4784	schtasks.exe
4808	schtasks.exe
4820	schtasks.exe
4428	schtasks.exe
4264	schtasks.exe
4932	schtasks.exe
4912	schtasks.exe
4564	schtasks.exe
3148	schtasks.exe
4740	schtasks.exe
4924	schtasks.exe
32	schtasks.exe
3300	schtasks.exe
1744	schtasks.exe
2084	schtasks.exe
424	schtasks.exe
1900	schtasks.exe
4592	schtasks.exe
2892	schtasks.exe
2248	schtasks.exe
4632	schtasks.exe
2088	schtasks.exe
4160	schtasks.exe
1924	schtasks.exe
4940	schtasks.exe
4772	schtasks.exe
4704	schtasks.exe
4552	schtasks.exe
4964	schtasks.exe
1112	schtasks.exe
3960	schtasks.exe
4228	schtasks.exe
2204	schtasks.exe
868	schtasks.exe
1104	schtasks.exe
1548	schtasks.exe
3852	schtasks.exe
1016	schtasks.exe
1460	schtasks.exe
420	schtasks.exe
1508	schtasks.exe
2292	schtasks.exe
3884	schtasks.exe
1644	schtasks.exe
1792	schtasks.exe
2220	schtasks.exe
4236	schtasks.exe
4828	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	3234d3a460e83d91445fecb02710a9bcfe3365019ccb66ec68ee45f94537bed3.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	Idle.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
4200	DllCommonsvc.exe
2660	powershell.exe
2660	powershell.exe
2888	powershell.exe
2888	powershell.exe
2700	powershell.exe
2700	powershell.exe
2480	powershell.exe
2480	powershell.exe
3860	powershell.exe
3860	powershell.exe
2380	powershell.exe
2380	powershell.exe
2668	powershell.exe
2668	powershell.exe
3772	powershell.exe
3772	powershell.exe
5028	powershell.exe
5028	powershell.exe
4472	powershell.exe
4472	powershell.exe
3504	powershell.exe
3504	powershell.exe
2852	powershell.exe
2852	powershell.exe
2136	powershell.exe
2136	powershell.exe
1188	powershell.exe
1188	powershell.exe
4360	powershell.exe
4360	powershell.exe
2080	powershell.exe
2080	powershell.exe
2768	powershell.exe
2768	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	DllCommonsvc.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	4932	Idle.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeIncreaseQuotaPrivilege	2768	powershell.exe
Token: SeSecurityPrivilege	2768	powershell.exe
Token: SeTakeOwnershipPrivilege	2768	powershell.exe
Token: SeLoadDriverPrivilege	2768	powershell.exe
Token: SeSystemProfilePrivilege	2768	powershell.exe
Token: SeSystemtimePrivilege	2768	powershell.exe
Token: SeProfSingleProcessPrivilege	2768	powershell.exe
Token: SeIncBasePriorityPrivilege	2768	powershell.exe
Token: SeCreatePagefilePrivilege	2768	powershell.exe
Token: SeBackupPrivilege	2768	powershell.exe
Token: SeRestorePrivilege	2768	powershell.exe
Token: SeShutdownPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeSystemEnvironmentPrivilege	2768	powershell.exe
Token: SeRemoteShutdownPrivilege	2768	powershell.exe
Token: SeUndockPrivilege	2768	powershell.exe
Token: SeManageVolumePrivilege	2768	powershell.exe
Token: 33	2768	powershell.exe
Token: 34	2768	powershell.exe
Token: 35	2768	powershell.exe
Token: 36	2768	powershell.exe
Token: SeIncreaseQuotaPrivilege	2080	powershell.exe
Token: SeSecurityPrivilege	2080	powershell.exe
Token: SeTakeOwnershipPrivilege	2080	powershell.exe
Token: SeLoadDriverPrivilege	2080	powershell.exe
Token: SeSystemProfilePrivilege	2080	powershell.exe
Token: SeSystemtimePrivilege	2080	powershell.exe
Token: SeProfSingleProcessPrivilege	2080	powershell.exe
Token: SeIncBasePriorityPrivilege	2080	powershell.exe
Token: SeCreatePagefilePrivilege	2080	powershell.exe
Token: SeBackupPrivilege	2080	powershell.exe
Token: SeRestorePrivilege	2080	powershell.exe
Token: SeShutdownPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeSystemEnvironmentPrivilege	2080	powershell.exe
Token: SeRemoteShutdownPrivilege	2080	powershell.exe
Token: SeUndockPrivilege	2080	powershell.exe
Token: SeManageVolumePrivilege	2080	powershell.exe
Token: 33	2080	powershell.exe
Token: 34	2080	powershell.exe
Token: 35	2080	powershell.exe
Token: 36	2080	powershell.exe
Token: SeIncreaseQuotaPrivilege	2660	powershell.exe
Token: SeSecurityPrivilege	2660	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2348	2744	3234d3a460e83d91445fecb02710a9bcfe3365019ccb66ec68ee45f94537bed3.exe	66
PID 2744 wrote to memory of 2348	2744	3234d3a460e83d91445fecb02710a9bcfe3365019ccb66ec68ee45f94537bed3.exe	66
PID 2744 wrote to memory of 2348	2744	3234d3a460e83d91445fecb02710a9bcfe3365019ccb66ec68ee45f94537bed3.exe	66
PID 2348 wrote to memory of 3524	2348	WScript.exe	67
PID 2348 wrote to memory of 3524	2348	WScript.exe	67
PID 2348 wrote to memory of 3524	2348	WScript.exe	67
PID 3524 wrote to memory of 4200	3524	cmd.exe	69
PID 3524 wrote to memory of 4200	3524	cmd.exe	69
PID 4200 wrote to memory of 2660	4200	DllCommonsvc.exe	122
PID 4200 wrote to memory of 2660	4200	DllCommonsvc.exe	122
PID 4200 wrote to memory of 2888	4200	DllCommonsvc.exe	158
PID 4200 wrote to memory of 2888	4200	DllCommonsvc.exe	158
PID 4200 wrote to memory of 2700	4200	DllCommonsvc.exe	156
PID 4200 wrote to memory of 2700	4200	DllCommonsvc.exe	156
PID 4200 wrote to memory of 2480	4200	DllCommonsvc.exe	124
PID 4200 wrote to memory of 2480	4200	DllCommonsvc.exe	124
PID 4200 wrote to memory of 2380	4200	DllCommonsvc.exe	125
PID 4200 wrote to memory of 2380	4200	DllCommonsvc.exe	125
PID 4200 wrote to memory of 3860	4200	DllCommonsvc.exe	126
PID 4200 wrote to memory of 3860	4200	DllCommonsvc.exe	126
PID 4200 wrote to memory of 2668	4200	DllCommonsvc.exe	127
PID 4200 wrote to memory of 2668	4200	DllCommonsvc.exe	127
PID 4200 wrote to memory of 3772	4200	DllCommonsvc.exe	128
PID 4200 wrote to memory of 3772	4200	DllCommonsvc.exe	128
PID 4200 wrote to memory of 5028	4200	DllCommonsvc.exe	129
PID 4200 wrote to memory of 5028	4200	DllCommonsvc.exe	129
PID 4200 wrote to memory of 4472	4200	DllCommonsvc.exe	131
PID 4200 wrote to memory of 4472	4200	DllCommonsvc.exe	131
PID 4200 wrote to memory of 3504	4200	DllCommonsvc.exe	132
PID 4200 wrote to memory of 3504	4200	DllCommonsvc.exe	132
PID 4200 wrote to memory of 2852	4200	DllCommonsvc.exe	133
PID 4200 wrote to memory of 2852	4200	DllCommonsvc.exe	133
PID 4200 wrote to memory of 2136	4200	DllCommonsvc.exe	148
PID 4200 wrote to memory of 2136	4200	DllCommonsvc.exe	148
PID 4200 wrote to memory of 1188	4200	DllCommonsvc.exe	135
PID 4200 wrote to memory of 1188	4200	DllCommonsvc.exe	135
PID 4200 wrote to memory of 4360	4200	DllCommonsvc.exe	136
PID 4200 wrote to memory of 4360	4200	DllCommonsvc.exe	136
PID 4200 wrote to memory of 2080	4200	DllCommonsvc.exe	137
PID 4200 wrote to memory of 2080	4200	DllCommonsvc.exe	137
PID 4200 wrote to memory of 2768	4200	DllCommonsvc.exe	138
PID 4200 wrote to memory of 2768	4200	DllCommonsvc.exe	138
PID 4200 wrote to memory of 4596	4200	DllCommonsvc.exe	139
PID 4200 wrote to memory of 4596	4200	DllCommonsvc.exe	139
PID 4200 wrote to memory of 4932	4200	DllCommonsvc.exe	143
PID 4200 wrote to memory of 4932	4200	DllCommonsvc.exe	143
PID 4932 wrote to memory of 5812	4932	Idle.exe	160
PID 4932 wrote to memory of 5812	4932	Idle.exe	160
PID 5812 wrote to memory of 1712	5812	cmd.exe	162
PID 5812 wrote to memory of 1712	5812	cmd.exe	162
PID 5812 wrote to memory of 5828	5812	cmd.exe	163
PID 5812 wrote to memory of 5828	5812	cmd.exe	163
PID 5828 wrote to memory of 5076	5828	Idle.exe	164
PID 5828 wrote to memory of 5076	5828	Idle.exe	164
PID 5076 wrote to memory of 5984	5076	cmd.exe	166
PID 5076 wrote to memory of 5984	5076	cmd.exe	166
PID 5076 wrote to memory of 6020	5076	cmd.exe	167
PID 5076 wrote to memory of 6020	5076	cmd.exe	167
PID 6020 wrote to memory of 5728	6020	Idle.exe	168
PID 6020 wrote to memory of 5728	6020	Idle.exe	168
PID 5728 wrote to memory of 1476	5728	cmd.exe	170
PID 5728 wrote to memory of 1476	5728	cmd.exe	170
PID 5728 wrote to memory of 5864	5728	cmd.exe	171
PID 5728 wrote to memory of 5864	5728	cmd.exe	171

C:\Users\Admin\AppData\Local\Temp\3234d3a460e83d91445fecb02710a9bcfe3365019ccb66ec68ee45f94537bed3.exe
"C:\Users\Admin\AppData\Local\Temp\3234d3a460e83d91445fecb02710a9bcfe3365019ccb66ec68ee45f94537bed3.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\en-US\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4360
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\sihost.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
    - - C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4932
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QOz0umrEhM.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5812
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1712
        
        C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:5984
        
        C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6020
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FjqlTNZm6T.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5728
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1476
        
        C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5864
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7lFc7N4hi3.bat"
        12⤵
        
        PID:4172
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:5364
        
        C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x4tck5X09i.bat"
        14⤵
        
        PID:5540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4324
        
        C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SRNviAgREO.bat"
        16⤵
        
        PID:1028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2660
        
        C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat"
        18⤵
        
        PID:2888
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2172
        
        C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat"
        20⤵
        
        PID:5096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4808
        
        C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat"
        22⤵
        
        PID:5680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4920
        
        C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat"
        24⤵
        
        PID:5596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4072
        
        C:\Users\Public\Pictures\Idle.exe
        
        "C:\Users\Public\Pictures\Idle.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat"
        26⤵
        
        PID:2304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\ShellExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\ShellExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\en-US\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\LiveKernelReports\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\LiveKernelReports\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\odt\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8b6b875638660cbb8a5b440d306d0ea5

SHA1
d0b9b770730535853c2094c76a253ddca1fdaec1

SHA256
6772660898b7353bd6922d5aa13e5bc40c02d1c782c8d8ff4a9b709689de24a2

SHA512
5fe3e4979fd3e5d5c45acce1d56e32c9ea1b9a18d22c3d7e8986e1f149da9783b2b2d4287c96494b30c74488d95017488175fd39c337beb5a3d5c65cfc32f31e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
322d316a6aba7762ab158aa6bd74a6dc

SHA1
50ebd7e728c499b786a22192498eb476ebfef140

SHA256
6866897c15059c9a1a342b0c04db5b87ea152c41050dfd2566475ee3c9e46d17

SHA512
4664ce70d2004242bbccb68631f694148bc066a4d3371599b0586ffb880b09f188ed489ebc616c930d2d09bf380b1918cc3279e4e99eab2201f18372c8477cd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
41f0a96f6e8282a937084591ff8044bc

SHA1
2ebfb670ac69ccff7f09cafb7fe513353bd8f6ec

SHA256
9c6a36eb579f22af404b8188807ab3ebe3ca3061a7cd907fafb29c482a3b4b62

SHA512
07ad31222f48ca61aa3af0cdd2c0f075764ef61ef1988fd10e485b0531d18436539e60a827c26ed2a10b18b8bb31f43ab3b4ed64b61dad3d9b7646e7bf397871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1936caa6f91163feb82561104476215a

SHA1
4361fe651f8bdafed7fb4110fd5a2e40082b43f4

SHA256
a18ca9555311a5cc456701af285e9196b185d00e98ead63298f2c4aa393516d6

SHA512
909ca6fc658e5a7492fe177e8e291aac8ba12df048a34d7e2fa544bc25797b2666adc06ea7cccd7b6862893a15ddff95d2bb138d718b2e292591be993b7542ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9ef5b3ddc65c2244141534ef355a9f94

SHA1
c832698b04242aa9cafa70c3a40e261f0b791a17

SHA256
19a175abde1ec8e012c076e71240f382ea4f09b8059e9e5c790840570ea61b03

SHA512
566af73fdea2d785a1a202c2fc344eba1b2292e6afba55520a0c8c83b536a138e2211766d1a139eb5c9ada832c8c0be52092820fcea47deee0b28ddd02e29e38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
966316597cf39c31a34288d8b0576fd3

SHA1
f7911921fbcfef99e54feebb2f80e7874a089f50

SHA256
79842750907a7be8d70a224a558eca5eb49b0ffe9068933485bee21f2f6d1e73

SHA512
58b19e851cfa85f6d5b7b286ee9fc42eb5a4a7b47be28f92fb589284d3541caad42e799d4ab8ab851f10846a7885c3da8d7186062855295960a83e6e124d8c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
327d7b49583d5ab17615d612fd06fafb

SHA1
1fbe6fdb739c63387ab19cb6c1cbaf7f08b84332

SHA256
80875220329c1d18529e3882ce0ccc06d51e88c4d9387a85af13b2d7e88cd0af

SHA512
98025299c98ea1b520fee330e18c3c7c2a03f336bd1e6982d0caed8bb8c89721a33cf11bad7a5c766ed03bb424b329c28d490f97846d5bb0b873e05ce84fa708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c757717f776a9620375a1a9cbd7c1f7b

SHA1
f3faf4783c643293b5b3b02c46c70dd39d1aa1ed

SHA256
7cb38fd35b385e15f1a4dc5aa678c3dda0f0407ae9bcc241241fe234e58cf4a3

SHA512
278b6e8b65a359dc5449a1e3462ac6cf72668c251f533da2de4f050aa05603667de723ccb6e87c2329eef848db59b49d7f2f32dcdee4372857796e01cbca62d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
58c6d8a6cf0d5017e2fa457780c54202

SHA1
bb6aeccb0cf5e658c3f780abb824461c16906db7

SHA256
790befa66562b70821dafc12cca69c71c14ca0a5b8d83cafcfb4f55fd2b5bd89

SHA512
43a40eee8cefe33e15da2288c0be5d11504d1218d33df66b35372c373985b6efa2a850e797a7cba71e1ef9c7429de4a38b0122af7e860a77db58bda46bb5b1d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5e0970ad3973933a90f8bea3c1a36a0e

SHA1
3dc7decda262546159e59b7bb41157b203a40665

SHA256
44aca47e45edb627879eaf20c8f4d0a805683d98a74df0e576754b57c40c74d6

SHA512
08132219298e00888929c689a58df042c99666d9b23fcd390b6a929ed38f48273c167aecd977302a196cb921482bf6d0b24927990c0503acd5d4edeec129498a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5e0970ad3973933a90f8bea3c1a36a0e

SHA1
3dc7decda262546159e59b7bb41157b203a40665

SHA256
44aca47e45edb627879eaf20c8f4d0a805683d98a74df0e576754b57c40c74d6

SHA512
08132219298e00888929c689a58df042c99666d9b23fcd390b6a929ed38f48273c167aecd977302a196cb921482bf6d0b24927990c0503acd5d4edeec129498a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6a7b0146514eff49e22022b99ce3cb4e

SHA1
f2d880c3fa6ff38e79581dd03948caab86cc86c3

SHA256
41b4d1a6405eb9156b0233a7a0fd775fd57d996a70d11605aef9f0d3c60abd1e

SHA512
6d2807b9de12f726701bbfb80a8cd83ddf2279b3c1bce6f25d0faff72baa4a67383c63faa778feea8cc3a65d33967634a8e83b9c2ec8a3ff729062fe90a94a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
91e0d2b35d3e9a8d9479a184b47acd06

SHA1
81f9d1fc5ca25639c961eebae25e3b63e3bedcc7

SHA256
e9450b0e6058334df4d856544fd0edfbb3155bd61e73e62567de1007e0e39321

SHA512
0aba9c5e7a9f23c6e83fe557271b7f5a64271e5fdf6fa7bb78780c826e7d25759f03a5bc02d490cee1e4de3dbb7ee3285dd87f06a23dff03964ba3a8d6c508a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
060d706ccb4e116c68736178badeaf04

SHA1
07ae3d16f8fc092ae713afd0858375962413fe58

SHA256
3cd10237bd8954382bf10af866b0b2c2cc17d97a4f3d5423b2c0f5bc2a9f3fba

SHA512
affd0119603af796305b4860c4ae233377e998ca63acf0969940f8102755b0e4bd09c63ea4ee82d31c0bc5c69d5cf56881d1d22d3106f45009444e4dd01a8cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0cf0636ddd1aa9c7a83be5b14ba5c555

SHA1
ce63496eb19c97414e0fc5207f019d14b790d8f0

SHA256
36614b9fbde42f9df856620b411be3ee55ec0bfdb7a98d4b20e86e1a689942e3

SHA512
ef8a95467fe81503a0d23409d876d204119d66330885ff699d96ba96968fa8908e84deb70339662cff025291577b8f0cacd542413aba863102f3eb6681d2e0da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0cf0636ddd1aa9c7a83be5b14ba5c555

SHA1
ce63496eb19c97414e0fc5207f019d14b790d8f0

SHA256
36614b9fbde42f9df856620b411be3ee55ec0bfdb7a98d4b20e86e1a689942e3

SHA512
ef8a95467fe81503a0d23409d876d204119d66330885ff699d96ba96968fa8908e84deb70339662cff025291577b8f0cacd542413aba863102f3eb6681d2e0da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0cf0636ddd1aa9c7a83be5b14ba5c555

SHA1
ce63496eb19c97414e0fc5207f019d14b790d8f0

SHA256
36614b9fbde42f9df856620b411be3ee55ec0bfdb7a98d4b20e86e1a689942e3

SHA512
ef8a95467fe81503a0d23409d876d204119d66330885ff699d96ba96968fa8908e84deb70339662cff025291577b8f0cacd542413aba863102f3eb6681d2e0da

Download Submit
C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat

Filesize
198B

MD5
f3070ae43c5e23ed9c5b27b39fa22109

SHA1
53801ad66806c41cd84fd08ac61165c0a95feecb

SHA256
e925c679a571c05e922dc7fc3961f6475ca7d13a87128aad982b6071c7ee3eba

SHA512
8cb47705c3bb2785280b7dc43b6fae4e41d78aa08519a35f08c75000e8b903cdfbca3f7dc9022863cd9d81a5e80a98d6f225934dbdf97bf5f6d62a371164b01b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7lFc7N4hi3.bat

Filesize
198B

MD5
f03d226ac9d434f89f89edc261c7d1f7

SHA1
90b06aa46b0db70a8cf46ac16c414e98960949c5

SHA256
b92c8fe39ebf5fa766342ea109ee5195e90e39c6111da0bd6c2fa0cec384098a

SHA512
a0962419af6c5f3e23df3c993d79d572a6e5b0de31faec25111c928d3ef15ce09c3a735d7c07435f9ead3ee9b3e39b717b6a6a809971538f1121514c2549e4d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\8pOjIocmws.bat

Filesize
198B

MD5
fc5175c96140eeb1f4321ace753a5a9d

SHA1
2ace4af1777e8fbdb2fffe7f186be6ab7325201d

SHA256
9fcc9beca71d4363a53608ec1b5885aa2ef9cb42aea362427b142041a4134235

SHA512
7fe1a5b58004285b59fff9750ed8e318d55e5221d224d25407947c69198dfc8261faf1cfb3bcdce796bbd43be72094b88b18e2b73be7667330f8b61a78151afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\EYKlAcFNfO.bat

Filesize
198B

MD5
108a1ac47fd05f3b7544529996ff241d

SHA1
f3af1c5e465f9797ccde3bf8a7a14402cf903a8d

SHA256
264ae45175a04d53bd21c34d4932cd429fcb073e222518eb74192b7944fd3303

SHA512
4be11db1f4ae3c9338c1d5fc11b4ed90a0e5cbc693a3ddde1add1357207425873b70c4aeb0a334812728780fdf086d8e76f76080d35fc77e1e763628bb5781b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\FjqlTNZm6T.bat

Filesize
198B

MD5
0fc6f2c1454b3864a71bea4ca26944fc

SHA1
17fb1d17b574e139091e92f9d77cc9882e157bc5

SHA256
958995345844e65f79f5e022869f3d2184cecf619dd67fbb64cc4e0e3564c664

SHA512
4acfc0049a43db61b8ba67905d877996beb9f7777e070728ecc762c391551675a2592298c5b97b8029af866a96af6d8081b02326fcbea1bbe7c9be1403b59293

Download Submit
C:\Users\Admin\AppData\Local\Temp\NiQtqM3qVs.bat

Filesize
198B

MD5
5f3f1bef2a93fa4f887d46540503b176

SHA1
8fcbb1a52c2ec72f479575d886e37a37685edf93

SHA256
9aa0d9114746806bceb2b81d09e151ec414d9a697d9746d853b33469062deb3c

SHA512
1dff92096d24e01148ff1d0fc50d0684d9e9c16017b91b680abf4027ee322d1d9b6e67b0caaed6a6f1b2d40c1d37800bf30413004d92ceba246a3d7930643a35

Download Submit
C:\Users\Admin\AppData\Local\Temp\QOz0umrEhM.bat

Filesize
198B

MD5
21d22fff4a7c74910c25e04abcd4b665

SHA1
72ba7d8400353d756ef55d75cd6292f23ce546a1

SHA256
9f6285266a0352dfea9090df40c878429627c5f527bf53c094c3f6516d9a0272

SHA512
269a8496cbf60f9b17f5474610cfee41e4faefc94d3628a259991ee18b090a80bce5f5d5db89bfe4a76bea2bb571e81896304edc6f4e165076b576cb07f45421

Download Submit
C:\Users\Admin\AppData\Local\Temp\SRNviAgREO.bat

Filesize
198B

MD5
82aff87aba4f3eed03d1d72972181635

SHA1
065af868f8a30dff071c809c976fc71deab8c727

SHA256
50ea150045ac6913f5a8c55830d54d23bf4233f413787b848cd5f9a582464a67

SHA512
7f9850c983e13e61a7c7535940cd10694dc713a998595a9d6abe0c3eb5fa7d713712a6a5c0c8580872fb4d1d6418c5235b66b8d13eb0a24f99943d9cd3badd74

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat

Filesize
198B

MD5
d3512157b391c05cd902e4c6ff87783e

SHA1
e65648859867d04cfea6d5e5f576441d26204a68

SHA256
1181a885d52ab23a38794ee08d616c80610db21dc22d49e8f921aa0094200bff

SHA512
36d0aa8dbd7edb7695f7cb14198400533c98d7aa96245a33edb7d5231768cdb8a0975d51171b5569540dac0f56efb7656db016c916c44bdcdf4c787883a9906c

Download Submit
C:\Users\Admin\AppData\Local\Temp\x4tck5X09i.bat

Filesize
198B

MD5
2faca1641858c2110154a62865922cd3

SHA1
960017bbdb573eabfd0b9c74fa0c16829996c6e2

SHA256
e92a6b20376b64e5d7a8cdbe71775b60296d721ee3b7e489e0ef8033c1c3c17f

SHA512
97c59b0857b513651236df800368c1323f1b2fa8c4fcaaf7ad64257a31d77529afa58ae41441b9792838695d9b3728924fc4601c71f7a2ea68ed74ddbfbed0ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\z6HXYUNDfk.bat

Filesize
198B

MD5
996bc776897cd9f89d5bd20d10d88b75

SHA1
011123782a38313c1a1ed90c876fe7deb5823b27

SHA256
9ba7bf2fc65df0a2117ae6260dd7a200efba99b09748c67d44032c9401194425

SHA512
79dd9ffae40430d2212b6f0fe153f7ea4f54a516b1deb13545b1dcff7ca3b8f8a8c6626e39f4b868ec21453e766ec43c85c75ac3aebcca92353a06e527ddbcd0

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Public\Pictures\Idle.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/920-955-0x0000000000000000-mapping.dmp

Download
memory/1028-957-0x0000000000000000-mapping.dmp

Download
memory/1188-320-0x0000000000000000-mapping.dmp

Download
memory/1476-942-0x0000000000000000-mapping.dmp

Download
memory/1712-855-0x0000000000000000-mapping.dmp

Download
memory/2080-422-0x000001BDEE720000-0x000001BDEE796000-memory.dmp

Filesize
472KB

Download
memory/2080-330-0x0000000000000000-mapping.dmp

Download
memory/2104-965-0x0000000000000000-mapping.dmp

Download
memory/2136-313-0x0000000000000000-mapping.dmp

Download
memory/2172-964-0x0000000000000000-mapping.dmp

Download
memory/2200-985-0x0000000000000000-mapping.dmp

Download
memory/2304-983-0x0000000000000000-mapping.dmp

Download
memory/2348-186-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2348-184-0x0000000000000000-mapping.dmp

Download
memory/2348-185-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2380-295-0x0000000000000000-mapping.dmp

Download
memory/2480-294-0x0000000000000000-mapping.dmp

Download
memory/2660-959-0x0000000000000000-mapping.dmp

Download
memory/2660-291-0x0000000000000000-mapping.dmp

Download
memory/2660-377-0x000001C5E8060000-0x000001C5E8082000-memory.dmp

Filesize
136KB

Download
memory/2668-297-0x0000000000000000-mapping.dmp

Download
memory/2700-293-0x0000000000000000-mapping.dmp

Download
memory/2744-153-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-122-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-173-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-178-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-121-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-179-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-146-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-123-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-125-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-126-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-128-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-129-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-130-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-131-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-180-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-172-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-132-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-171-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-170-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-169-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-133-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-120-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-181-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-134-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-175-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-135-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-136-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-176-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-183-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-182-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-137-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-168-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-138-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-167-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-166-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-165-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-164-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-163-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-162-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-161-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-160-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-159-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-158-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-147-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-156-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-155-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-154-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-177-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-152-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-151-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-150-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-149-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-148-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-139-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-157-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-174-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-140-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-141-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-145-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-142-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-143-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2744-144-0x0000000077660000-0x00000000777EE000-memory.dmp

Filesize
1.6MB

Download
memory/2768-335-0x0000000000000000-mapping.dmp

Download
memory/2852-310-0x0000000000000000-mapping.dmp

Download
memory/2888-962-0x0000000000000000-mapping.dmp

Download
memory/2888-292-0x0000000000000000-mapping.dmp

Download
memory/3504-306-0x0000000000000000-mapping.dmp

Download
memory/3524-260-0x0000000000000000-mapping.dmp

Download
memory/3772-299-0x0000000000000000-mapping.dmp

Download
memory/3860-296-0x0000000000000000-mapping.dmp

Download
memory/4072-979-0x0000000000000000-mapping.dmp

Download
memory/4172-946-0x0000000000000000-mapping.dmp

Download
memory/4200-289-0x0000000000990000-0x000000000099C000-memory.dmp

Filesize
48KB

Download
memory/4200-288-0x0000000000980000-0x000000000098C000-memory.dmp

Filesize
48KB

Download
memory/4200-286-0x0000000000120000-0x0000000000230000-memory.dmp

Filesize
1.1MB

Download
memory/4200-290-0x00000000009A0000-0x00000000009AC000-memory.dmp

Filesize
48KB

Download
memory/4200-287-0x0000000000770000-0x0000000000782000-memory.dmp

Filesize
72KB

Download
memory/4200-283-0x0000000000000000-mapping.dmp

Download
memory/4324-954-0x0000000000000000-mapping.dmp

Download
memory/4360-325-0x0000000000000000-mapping.dmp

Download
memory/4472-303-0x0000000000000000-mapping.dmp

Download
memory/4592-980-0x0000000000000000-mapping.dmp

Download
memory/4592-982-0x0000000001200000-0x0000000001212000-memory.dmp

Filesize
72KB

Download
memory/4596-340-0x0000000000000000-mapping.dmp

Download
memory/4608-970-0x0000000000000000-mapping.dmp

Download
memory/4724-951-0x0000000003010000-0x0000000003022000-memory.dmp

Filesize
72KB

Download
memory/4724-949-0x0000000000000000-mapping.dmp

Download
memory/4808-969-0x0000000000000000-mapping.dmp

Download
memory/4920-974-0x0000000000000000-mapping.dmp

Download
memory/4932-385-0x00000000011D0000-0x00000000011E2000-memory.dmp

Filesize
72KB

Download
memory/4932-359-0x0000000000000000-mapping.dmp

Download
memory/5024-960-0x0000000000000000-mapping.dmp

Download
memory/5028-301-0x0000000000000000-mapping.dmp

Download
memory/5076-934-0x0000000000000000-mapping.dmp

Download
memory/5096-967-0x0000000000000000-mapping.dmp

Download
memory/5364-948-0x0000000000000000-mapping.dmp

Download
memory/5540-952-0x0000000000000000-mapping.dmp

Download
memory/5596-977-0x0000000000000000-mapping.dmp

Download
memory/5680-972-0x0000000000000000-mapping.dmp

Download
memory/5728-940-0x0000000000000000-mapping.dmp

Download
memory/5812-795-0x0000000000000000-mapping.dmp

Download
memory/5828-933-0x0000000001470000-0x0000000001482000-memory.dmp

Filesize
72KB

Download
memory/5828-930-0x0000000000000000-mapping.dmp

Download
memory/5864-945-0x0000000001540000-0x0000000001552000-memory.dmp

Filesize
72KB

Download
memory/5864-943-0x0000000000000000-mapping.dmp

Download
memory/5984-936-0x0000000000000000-mapping.dmp

Download
memory/6016-975-0x0000000000000000-mapping.dmp

Download
memory/6020-939-0x0000000000820000-0x0000000000832000-memory.dmp

Filesize
72KB

Download
memory/6020-937-0x0000000000000000-mapping.dmp

Download