dcrat | d5fe95aec7cfedf5c186a1eafe79507fded1a71a13c4ef403a8d90cce09e278c

Analysis

max time kernel
146s
max time network
142s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
02/11/2022, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d5fe95aec7cfedf5c186a1eafe79507fded1a71a13c4ef403a8d90cce09e278c.exe
Size

1.3MB
MD5

ec4531d024701c609b18c72ba480c949
SHA1

baa8936840a7913bbdcea10347f3773ebbb5c8c0
SHA256

d5fe95aec7cfedf5c186a1eafe79507fded1a71a13c4ef403a8d90cce09e278c
SHA512

1e211f072d41053bd3842ab0e3697ccf2345fc2d2f332937d553051cb04665e3bea2619357db559f0e4ab502bf978c8b9583c14e42c174b2e6815a875ae7c1f3
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	300	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	352	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	164	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4024	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	4024	schtasks.exe	70

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001ac32-284.dat	dcrat
behavioral1/files/0x000800000001ac32-285.dat	dcrat
behavioral1/memory/3076-286-0x00000000005F0000-0x0000000000700000-memory.dmp	dcrat
behavioral1/files/0x000800000001ac32-367.dat	dcrat
behavioral1/files/0x000600000001ac94-470.dat	dcrat
behavioral1/files/0x000600000001ac94-472.dat	dcrat
behavioral1/files/0x000600000001ac94-1016.dat	dcrat
behavioral1/files/0x000600000001ac94-1063.dat	dcrat
behavioral1/files/0x000600000001ac94-1080.dat	dcrat
behavioral1/files/0x000600000001ac94-1151.dat	dcrat
behavioral1/files/0x000600000001ac94-1156.dat	dcrat
behavioral1/files/0x000600000001ac94-1162.dat	dcrat
behavioral1/files/0x000600000001ac94-1168.dat	dcrat

Executes dropped EXE 10 IoCs

pid	Process
3076	DllCommonsvc.exe
3108	DllCommonsvc.exe
5224	powershell.exe
5660	powershell.exe
4620	powershell.exe
5972	powershell.exe
3336	powershell.exe
400	powershell.exe
252	powershell.exe
5948	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Java\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\e978f868350d50	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Java\conhost.exe	DllCommonsvc.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\authman\e978f868350d50	DllCommonsvc.exe
File created	C:\Windows\MiracastView\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\MiracastView\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\en-US\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\Panther\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\Tasks\ShellExperienceHost.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\Microsoft.NET\authman\powershell.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\MiracastView\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\en-US\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Windows\Panther\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\Tasks\f8c8f1285d826b	DllCommonsvc.exe
File created	C:\Windows\Microsoft.NET\authman\powershell.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
352	schtasks.exe
4808	schtasks.exe
760	schtasks.exe
2216	schtasks.exe
4564	schtasks.exe
1500	schtasks.exe
4676	schtasks.exe
4504	schtasks.exe
4776	schtasks.exe
4800	schtasks.exe
4976	schtasks.exe
4468	schtasks.exe
4060	schtasks.exe
1432	schtasks.exe
4508	schtasks.exe
4796	schtasks.exe
1248	schtasks.exe
5088	schtasks.exe
4368	schtasks.exe
4972	schtasks.exe
4448	schtasks.exe
4572	schtasks.exe
408	schtasks.exe
164	schtasks.exe
304	schtasks.exe
208	schtasks.exe
3524	schtasks.exe
5020	schtasks.exe
4436	schtasks.exe
4596	schtasks.exe
3108	schtasks.exe
4028	schtasks.exe
1872	schtasks.exe
4624	schtasks.exe
212	schtasks.exe
308	schtasks.exe
2168	schtasks.exe
976	schtasks.exe
2016	schtasks.exe
5076	schtasks.exe
64	schtasks.exe
3588	schtasks.exe
660	schtasks.exe
4812	schtasks.exe
4820	schtasks.exe
4680	schtasks.exe
2616	schtasks.exe
2132	schtasks.exe
1928	schtasks.exe
2920	schtasks.exe
3584	schtasks.exe
4496	schtasks.exe
4804	schtasks.exe
4700	schtasks.exe
2884	schtasks.exe
748	schtasks.exe
2184	schtasks.exe
1684	schtasks.exe
4500	schtasks.exe
4164	schtasks.exe
4664	schtasks.exe
300	schtasks.exe
644	schtasks.exe
952	schtasks.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	d5fe95aec7cfedf5c186a1eafe79507fded1a71a13c4ef403a8d90cce09e278c.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3076	DllCommonsvc.exe
3076	DllCommonsvc.exe
3076	DllCommonsvc.exe
3076	DllCommonsvc.exe
3076	DllCommonsvc.exe
3076	DllCommonsvc.exe
3076	DllCommonsvc.exe
3864	powershell.exe
3864	powershell.exe
3940	powershell.exe
3940	powershell.exe
1844	powershell.exe
1844	powershell.exe
4612	powershell.exe
4612	powershell.exe
1436	powershell.exe
1436	powershell.exe
2208	powershell.exe
2208	powershell.exe
2644	powershell.exe
2644	powershell.exe
2708	powershell.exe
2708	powershell.exe
968	powershell.exe
968	powershell.exe
3876	powershell.exe
3876	powershell.exe
4960	powershell.exe
4960	powershell.exe
3052	powershell.exe
3052	powershell.exe
3016	powershell.exe
3016	powershell.exe
2124	powershell.exe
2124	powershell.exe
4920	powershell.exe
4920	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
3108	DllCommonsvc.exe
3108	DllCommonsvc.exe
4040	powershell.exe
4040	powershell.exe
3864	powershell.exe
3864	powershell.exe
3940	powershell.exe
3940	powershell.exe
3956	powershell.exe
3956	powershell.exe
2208	powershell.exe
1844	powershell.exe
1844	powershell.exe
2644	powershell.exe
2708	powershell.exe
968	powershell.exe
3876	powershell.exe
3016	powershell.exe
4612	powershell.exe
1436	powershell.exe
2124	powershell.exe
4920	powershell.exe
4488	powershell.exe
3940	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	DllCommonsvc.exe
Token: SeDebugPrivilege	3864	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	3108	DllCommonsvc.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	5224	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	308	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeIncreaseQuotaPrivilege	3940	powershell.exe
Token: SeSecurityPrivilege	3940	powershell.exe
Token: SeTakeOwnershipPrivilege	3940	powershell.exe
Token: SeLoadDriverPrivilege	3940	powershell.exe
Token: SeSystemProfilePrivilege	3940	powershell.exe
Token: SeSystemtimePrivilege	3940	powershell.exe
Token: SeProfSingleProcessPrivilege	3940	powershell.exe
Token: SeIncBasePriorityPrivilege	3940	powershell.exe
Token: SeCreatePagefilePrivilege	3940	powershell.exe
Token: SeBackupPrivilege	3940	powershell.exe
Token: SeRestorePrivilege	3940	powershell.exe
Token: SeShutdownPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeSystemEnvironmentPrivilege	3940	powershell.exe
Token: SeRemoteShutdownPrivilege	3940	powershell.exe
Token: SeUndockPrivilege	3940	powershell.exe
Token: SeManageVolumePrivilege	3940	powershell.exe
Token: 33	3940	powershell.exe
Token: 34	3940	powershell.exe
Token: 35	3940	powershell.exe
Token: 36	3940	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeIncreaseQuotaPrivilege	4488	powershell.exe
Token: SeSecurityPrivilege	4488	powershell.exe
Token: SeTakeOwnershipPrivilege	4488	powershell.exe
Token: SeLoadDriverPrivilege	4488	powershell.exe
Token: SeSystemProfilePrivilege	4488	powershell.exe
Token: SeSystemtimePrivilege	4488	powershell.exe
Token: SeProfSingleProcessPrivilege	4488	powershell.exe
Token: SeIncBasePriorityPrivilege	4488	powershell.exe
Token: SeCreatePagefilePrivilege	4488	powershell.exe
Token: SeBackupPrivilege	4488	powershell.exe
Token: SeRestorePrivilege	4488	powershell.exe
Token: SeShutdownPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeSystemEnvironmentPrivilege	4488	powershell.exe
Token: SeRemoteShutdownPrivilege	4488	powershell.exe
Token: SeUndockPrivilege	4488	powershell.exe
Token: SeManageVolumePrivilege	4488	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 4868	2124	d5fe95aec7cfedf5c186a1eafe79507fded1a71a13c4ef403a8d90cce09e278c.exe	66
PID 2124 wrote to memory of 4868	2124	d5fe95aec7cfedf5c186a1eafe79507fded1a71a13c4ef403a8d90cce09e278c.exe	66
PID 2124 wrote to memory of 4868	2124	d5fe95aec7cfedf5c186a1eafe79507fded1a71a13c4ef403a8d90cce09e278c.exe	66
PID 4868 wrote to memory of 4304	4868	WScript.exe	67
PID 4868 wrote to memory of 4304	4868	WScript.exe	67
PID 4868 wrote to memory of 4304	4868	WScript.exe	67
PID 4304 wrote to memory of 3076	4304	cmd.exe	69
PID 4304 wrote to memory of 3076	4304	cmd.exe	69
PID 3076 wrote to memory of 3864	3076	DllCommonsvc.exe	125
PID 3076 wrote to memory of 3864	3076	DllCommonsvc.exe	125
PID 3076 wrote to memory of 3940	3076	DllCommonsvc.exe	126
PID 3076 wrote to memory of 3940	3076	DllCommonsvc.exe	126
PID 3076 wrote to memory of 2208	3076	DllCommonsvc.exe	127
PID 3076 wrote to memory of 2208	3076	DllCommonsvc.exe	127
PID 3076 wrote to memory of 1844	3076	DllCommonsvc.exe	130
PID 3076 wrote to memory of 1844	3076	DllCommonsvc.exe	130
PID 3076 wrote to memory of 2644	3076	DllCommonsvc.exe	133
PID 3076 wrote to memory of 2644	3076	DllCommonsvc.exe	133
PID 3076 wrote to memory of 2708	3076	DllCommonsvc.exe	132
PID 3076 wrote to memory of 2708	3076	DllCommonsvc.exe	132
PID 3076 wrote to memory of 968	3076	DllCommonsvc.exe	135
PID 3076 wrote to memory of 968	3076	DllCommonsvc.exe	135
PID 3076 wrote to memory of 3876	3076	DllCommonsvc.exe	140
PID 3076 wrote to memory of 3876	3076	DllCommonsvc.exe	140
PID 3076 wrote to memory of 4612	3076	DllCommonsvc.exe	137
PID 3076 wrote to memory of 4612	3076	DllCommonsvc.exe	137
PID 3076 wrote to memory of 1436	3076	DllCommonsvc.exe	142
PID 3076 wrote to memory of 1436	3076	DllCommonsvc.exe	142
PID 3076 wrote to memory of 2124	3076	DllCommonsvc.exe	145
PID 3076 wrote to memory of 2124	3076	DllCommonsvc.exe	145
PID 3076 wrote to memory of 3016	3076	DllCommonsvc.exe	146
PID 3076 wrote to memory of 3016	3076	DllCommonsvc.exe	146
PID 3076 wrote to memory of 4960	3076	DllCommonsvc.exe	147
PID 3076 wrote to memory of 4960	3076	DllCommonsvc.exe	147
PID 3076 wrote to memory of 4920	3076	DllCommonsvc.exe	148
PID 3076 wrote to memory of 4920	3076	DllCommonsvc.exe	148
PID 3076 wrote to memory of 2492	3076	DllCommonsvc.exe	149
PID 3076 wrote to memory of 2492	3076	DllCommonsvc.exe	149
PID 3076 wrote to memory of 3052	3076	DllCommonsvc.exe	150
PID 3076 wrote to memory of 3052	3076	DllCommonsvc.exe	150
PID 3076 wrote to memory of 4488	3076	DllCommonsvc.exe	155
PID 3076 wrote to memory of 4488	3076	DllCommonsvc.exe	155
PID 3076 wrote to memory of 4040	3076	DllCommonsvc.exe	157
PID 3076 wrote to memory of 4040	3076	DllCommonsvc.exe	157
PID 3076 wrote to memory of 3956	3076	DllCommonsvc.exe	158
PID 3076 wrote to memory of 3956	3076	DllCommonsvc.exe	158
PID 3076 wrote to memory of 3108	3076	DllCommonsvc.exe	163
PID 3076 wrote to memory of 3108	3076	DllCommonsvc.exe	163
PID 3108 wrote to memory of 308	3108	DllCommonsvc.exe	176
PID 3108 wrote to memory of 308	3108	DllCommonsvc.exe	176
PID 3108 wrote to memory of 2928	3108	DllCommonsvc.exe	177
PID 3108 wrote to memory of 2928	3108	DllCommonsvc.exe	177
PID 3108 wrote to memory of 212	3108	DllCommonsvc.exe	178
PID 3108 wrote to memory of 212	3108	DllCommonsvc.exe	178
PID 3108 wrote to memory of 4220	3108	DllCommonsvc.exe	183
PID 3108 wrote to memory of 4220	3108	DllCommonsvc.exe	183
PID 3108 wrote to memory of 4976	3108	DllCommonsvc.exe	179
PID 3108 wrote to memory of 4976	3108	DllCommonsvc.exe	179
PID 3108 wrote to memory of 5224	3108	DllCommonsvc.exe	186
PID 3108 wrote to memory of 5224	3108	DllCommonsvc.exe	186
PID 5224 wrote to memory of 5824	5224	powershell.exe	188
PID 5224 wrote to memory of 5824	5224	powershell.exe	188
PID 5824 wrote to memory of 5348	5824	cmd.exe	190
PID 5824 wrote to memory of 5348	5824	cmd.exe	190

C:\Users\Admin\AppData\Local\Temp\d5fe95aec7cfedf5c186a1eafe79507fded1a71a13c4ef403a8d90cce09e278c.exe
"C:\Users\Admin\AppData\Local\Temp\d5fe95aec7cfedf5c186a1eafe79507fded1a71a13c4ef403a8d90cce09e278c.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\MiracastView\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\ShellExperienceHost.exe'
        5⤵
        
        PID:2492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\it-IT\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3108
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:308
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\authman\powershell.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\conhost.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:212
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\powershell.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\en-US\powershell.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4220
      - C:\Users\Admin\powershell.exe
        
        "C:\Users\Admin\powershell.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eTpA0L9dlX.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:5348
        
        C:\Users\Admin\powershell.exe
        
        "C:\Users\Admin\powershell.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QSfwyRFOJU.bat"
        9⤵
        
        PID:5468
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:6112
        
        C:\Users\Admin\powershell.exe
        
        "C:\Users\Admin\powershell.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6x2cfOw3ED.bat"
        11⤵
        
        PID:2712
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4300
        
        C:\Users\Admin\powershell.exe
        
        "C:\Users\Admin\powershell.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat"
        13⤵
        
        PID:4940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:6128
        
        C:\Users\Admin\powershell.exe
        
        "C:\Users\Admin\powershell.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uItNEyebdJ.bat"
        15⤵
        
        PID:5988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2024
        
        C:\Users\Admin\powershell.exe
        
        "C:\Users\Admin\powershell.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat"
        17⤵
        
        PID:1808
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4832
        
        C:\Users\Admin\powershell.exe
        
        "C:\Users\Admin\powershell.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eKh6VzgSrU.bat"
        19⤵
        
        PID:5212
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:5664
        
        C:\Users\Admin\powershell.exe
        
        "C:\Users\Admin\powershell.exe"
        20⤵
        Executes dropped EXE
        
        PID:5948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\MiracastView\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\MiracastView\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\MiracastView\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Panther\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Panther\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Windows\Tasks\ShellExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Windows\Tasks\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Windows\Tasks\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\Downloads\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Downloads\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Windows\Microsoft.NET\authman\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\authman\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Windows\Microsoft.NET\authman\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Java\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\en-US\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Admin\powershell.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\powershell.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
b4268d8ae66fdd920476b97a1776bf85

SHA1
f920de54f7467f0970eccc053d3c6c8dd181d49a

SHA256
61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879

SHA512
03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6ce9a0eb6859659cd1851ccc56f995c6

SHA1
166db32340ffe6687df95b35ecd0f2685abbebb7

SHA256
8ca1de7331e2f866b552aec99e0778f4125cc84c601e0201186a39908ac6824f

SHA512
9eee542e1dfc950a0356c052870af5ef57cc609d647dbcfcdf16973bdf1ab53a07319660e01201f8a0282caec19d6ffd4b72cab35b69d8bff938cc8397a9e741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
cc975d34a8ff2e8630fcb5b99202471c

SHA1
238e67cce7d3b398c6f2275aec9ff4f07d02e553

SHA256
a5e271749216c850c49ecea851eb0bf37656136e2b619ab3e26ef6f90db5a56e

SHA512
695d016612d13f7680e07d74dbbdd208c51b34b182735b272a1ce40ab12ebd40dc80346c2ebdaab421e592467a230cd82053d6de885ff0dbc521efeea5351f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b22ae807d7cac5d9b664dba7a5d68c67

SHA1
a8b8b945293c2dd94a524e97aaf6036ee4ea6154

SHA256
7e281029df2c36b98c70696f23c383f7837f5d94a3d4ef65766f8a152cb7b021

SHA512
587250e41db683813fc29a7ebcd9110f1c8e4724b4c85f4b93e92bcb3a72fe2ac3385e21e181c050b51240ee1470e19ec4837fa2ac6013bad859cd6503500efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a3be7278258e71562b209125f11aa97c

SHA1
0395bdf253e18519afd2feeb11821311eb07abc3

SHA256
c9adcf2368454e4a79360a8fd6e6b67b506be0d31ff0b21f7037ab39470030fa

SHA512
98fad7ed75d4937a5fd4cf6606a192c136ecd64b23877827232102b3c125e95b04217cabf7ee0730af360c2a74643b44939bcf740ae4db1db59377aa4e56add6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
28fcc55a308b1c57b6fd5532df91f140

SHA1
c5d8434512bac12cac14e9f5ea97fd19a9b6fbcb

SHA256
f927dc27ce7357b7b7469db15f6788efab6d5d044c0b46a9df43dff96f03e2d4

SHA512
f87a66c4f38783290d94c43f726b3f8e4f6e7b599a7fa931dd8d3be76d9a3ae3ddcf5c42499ea254184225d024c50d222322c5436511705ea8a64704bc0c8060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c2d99ca677bc0af143682932ca1af020

SHA1
78a9dd378817d94c2af2b8a093d250a53eb6215f

SHA256
9a1d49075d2502847e67e904dac13039dc1d85278aa920fc4715d6201cbff165

SHA512
7192a3cb9b7280decbdd3626562e10030666a5472d25f610e410860e4058f39a35fea7c297ef7f65e0a374c4a319a3c0a0b9cb566feee75b75ca51c60f28129e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c2d99ca677bc0af143682932ca1af020

SHA1
78a9dd378817d94c2af2b8a093d250a53eb6215f

SHA256
9a1d49075d2502847e67e904dac13039dc1d85278aa920fc4715d6201cbff165

SHA512
7192a3cb9b7280decbdd3626562e10030666a5472d25f610e410860e4058f39a35fea7c297ef7f65e0a374c4a319a3c0a0b9cb566feee75b75ca51c60f28129e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c2d99ca677bc0af143682932ca1af020

SHA1
78a9dd378817d94c2af2b8a093d250a53eb6215f

SHA256
9a1d49075d2502847e67e904dac13039dc1d85278aa920fc4715d6201cbff165

SHA512
7192a3cb9b7280decbdd3626562e10030666a5472d25f610e410860e4058f39a35fea7c297ef7f65e0a374c4a319a3c0a0b9cb566feee75b75ca51c60f28129e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fdf78077e96b38c1ca89dc57c47784c8

SHA1
abd056038daa03d04ce5924d052d219110f85f03

SHA256
a2db0770ecca356d57b2dedc7547d6b36c78866f406f989c238f058fc0f87d2a

SHA512
b6a7f3676438e38c8e91efea5b2f3f1a91517848be32e1f488d47e930987f92e54337733c614143c8a2da0419e01a0ce4ecee5269fd7ea0c7c13e18baac9b018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
66b6845bbb1b7bdf3133c95a935816d3

SHA1
ce650594f1f6e5e46e446bd046154ad6fab4b1c7

SHA256
76b3a5c2ac53853f21efe92af4ad6e19883b721d36c18b792ea6e2baccdf2f84

SHA512
9e433d9c83f8a60f7e5707a0286fba9c1b449d3a1e6adf739bd198d74e1d9fd4b3468e68598ccd9c8f9d6297445dfe2f4b6958b23f6bdb6701340ad1551eae5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ce3fa1741add4b9ebaad1b231ec8793e

SHA1
a8669a07f4be5af4bc3faba64d967cae08d9ca00

SHA256
6473ebcdd9c3731811cc1a0fb14ca01886e8d8c738736df3a32ed15b8c258ae8

SHA512
e1ab8b2903c3c2a8344a7402237945eed3872dba1817630c5feb6e5a9b9f68906a3c75753f6d255c069a06e9ea7d87d1c79a4a43d3d4442e9dd30df4d673e360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ce3fa1741add4b9ebaad1b231ec8793e

SHA1
a8669a07f4be5af4bc3faba64d967cae08d9ca00

SHA256
6473ebcdd9c3731811cc1a0fb14ca01886e8d8c738736df3a32ed15b8c258ae8

SHA512
e1ab8b2903c3c2a8344a7402237945eed3872dba1817630c5feb6e5a9b9f68906a3c75753f6d255c069a06e9ea7d87d1c79a4a43d3d4442e9dd30df4d673e360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c40422ca762a587237e6d8b99871b178

SHA1
294e743ddfe775f4959bffa9b13a577b6554a366

SHA256
d0ba67a0c2c7a0de506a739b856d43b4c8ce789c9a6c1d19e0fd5560e286c3dd

SHA512
92473b4fdf1986930da1ccd3443fb61d2df1a109397bf75ab6306505a380fec30ffc94d82cc7c40fdf2912c73d9c31af141e38c4560b9fbc3a3987254532b195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
48e39cea9d4a71f48a6f2a5143815d38

SHA1
32e2fb2e2d792eb8ffa56a8bfef805bcbf234c9a

SHA256
f76d12e4e430e4243f3119cc70d417cce1d64fd97f6003c3efaead805e66b799

SHA512
56975e192a874e07083dd2f1fa4586d67e34ca9cdbddef1f1b1c2b8244469940fb27f44686b67c20a9b44d8eb7881979e08ade4d1cbeba6ac662de0092800623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
49af5ea213546d22b48df45e10ed3696

SHA1
f2c4d5d3582954728a5c5ff39944ab52a2282120

SHA256
3a58001ddb9526e72a96655e30aea2dcd293c150f0fa9a41ce7bb34f543c034d

SHA512
a54e1a85bf1de06b6dd1368f55994289941d2e747a622cc89ddc4a5f7aacb733adff8c97c267eff9cf5617aceeca8b0563a3c0453445947f1d8236b39a985a7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
49af5ea213546d22b48df45e10ed3696

SHA1
f2c4d5d3582954728a5c5ff39944ab52a2282120

SHA256
3a58001ddb9526e72a96655e30aea2dcd293c150f0fa9a41ce7bb34f543c034d

SHA512
a54e1a85bf1de06b6dd1368f55994289941d2e747a622cc89ddc4a5f7aacb733adff8c97c267eff9cf5617aceeca8b0563a3c0453445947f1d8236b39a985a7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
49f3dd0e98c860cb5f8f803134cfa8f0

SHA1
f17fb54081f329bb6c243cdaa3f6114b56aa0e1c

SHA256
e4a70b8c857b108ac09b9f2031752b63409d70fe913ba0024a061d0dd103264c

SHA512
e5ec7209a7b267491b74c1d06bd000c4ee4de7acdf54e39aea310928a4a2cfa8420f0f6ed8d40b152267f87c993fad494794c684fc1f620a33290162285f0efb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7bf5e538e9f63f92f7028b22ee070ec6

SHA1
348735543b366d60f02f537dafc581905b0e1c84

SHA256
7f417088f56aed169c28627357f045cc3fae3b577134911568b6aeed616c8d73

SHA512
7dc9f94399fbfd248a848b6bd56b5c01b89c4a04f3577513f8628a61e4094583b0a87320d7880b32075dc269e083dbea8ecdbe82048275386a9a7614c2f6860e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f6cc298675a4b299d84f94208f004635

SHA1
30d4d47f6c5cdabd3006bc81e2dae6d1e4b37bff

SHA256
3fc9d2c4977066150d555344ba1e1089bc257f338263dac2fa96645e1da4a654

SHA512
03ac6c8257942c981ebd75516c73ad04a0ed72456b9d15fe2069172d948101c9e48de92dc44bb4494dc1c8eab09bcbb737e5c7915bfcd6a7704b6e8dd57bb6d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f6cc298675a4b299d84f94208f004635

SHA1
30d4d47f6c5cdabd3006bc81e2dae6d1e4b37bff

SHA256
3fc9d2c4977066150d555344ba1e1089bc257f338263dac2fa96645e1da4a654

SHA512
03ac6c8257942c981ebd75516c73ad04a0ed72456b9d15fe2069172d948101c9e48de92dc44bb4494dc1c8eab09bcbb737e5c7915bfcd6a7704b6e8dd57bb6d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
af6fe93b07d7853e4fae1b19fda9fa69

SHA1
93af71b8752a0192aa1a577260932ea3cd9983c4

SHA256
ee978025463bafa2ba2f0b786246be2dc82a79d2ab394089e8ec9f5d2fbac475

SHA512
51b670f93f55df3c5b5871e89ae4fbd8c04f9b0118a36e5727a38237e09359ea30b7c5fd1b41690d18e427fe1ac9600b7ef73f3ff9647d9471aa56cf85231615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
af6fe93b07d7853e4fae1b19fda9fa69

SHA1
93af71b8752a0192aa1a577260932ea3cd9983c4

SHA256
ee978025463bafa2ba2f0b786246be2dc82a79d2ab394089e8ec9f5d2fbac475

SHA512
51b670f93f55df3c5b5871e89ae4fbd8c04f9b0118a36e5727a38237e09359ea30b7c5fd1b41690d18e427fe1ac9600b7ef73f3ff9647d9471aa56cf85231615

Download Submit
C:\Users\Admin\AppData\Local\Temp\15yWIDpGaf.bat

Filesize
194B

MD5
8f0894315a6cdbc02bc89066f8f166b2

SHA1
f1df20b067b928321d6155a98c7df3b049bac222

SHA256
063aa6c9d8e3ad97d38cf71d90b77dbeca746b1772e5d94b841182a9232156e1

SHA512
2d4bf8d29d38d3aec5a5a5c2f9c882ac8f8e48033a6f090dd72129cd16134909923fc828384630255853d504d1b36e36a7553471aad8738da1aa928b8a375700

Download Submit
C:\Users\Admin\AppData\Local\Temp\6x2cfOw3ED.bat

Filesize
194B

MD5
79c061030bea989e487b6cdb33cc18a2

SHA1
67be820dceb2bc6a469211f0f19977b81b6e2955

SHA256
35e99d719452ff8356beb18d802de6981dc95e112c46ba820e54b9a722b89b83

SHA512
225e7c69dd3ef43351bbcaa32ccb0a37071c2c2d269e9092fc96cea0fcf96c27231cf85a45e9f7db20d6868a919f8b8a1a4e316402c8ed9f68cf9e6aeeb04e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ph8sa6VtQm.bat

Filesize
194B

MD5
e38fa616fe6b06fabdf2954819f0764f

SHA1
8bd5d6abf207b9997aea23e3b733c345411ecb94

SHA256
fae386551a5a719b28cdadb30267d6a57a95a398cc1085a7a64c2ea69f48d1d2

SHA512
14f07313d160b454eeb679a78c49bd3ed382e2e220752a26ab47f004d02ecece1ea40cef3e5ee7117c0a8f1faa0f90fe10a741f2d06c3724c3828b95dc18c247

Download Submit
C:\Users\Admin\AppData\Local\Temp\QSfwyRFOJU.bat

Filesize
194B

MD5
6e54af32053d1396fe3250f1abbc03d9

SHA1
0ad9148ecf904cd5226eae6862b4d06b70d77f20

SHA256
5c7b4744d246742d585845306c0dc1cab4703aa1502f50dfcbaf4aee99684e49

SHA512
044aab40fc68ced714ac22311f0eec0f527df4569e0c842a38af26ef8a258ccf535f274eabbc3685cad92291a3804beaa1ab44fb202b9219eead96faae2ccb60

Download Submit
C:\Users\Admin\AppData\Local\Temp\eKh6VzgSrU.bat

Filesize
194B

MD5
22025e58b2724b0339fb635f5e965efb

SHA1
67c46c104f037a581f1668a803e737982562c8b6

SHA256
051d35ad50522c8ea0f8d845c15c2942541ac1f427237fa5f7833a2b03086610

SHA512
b64514c2610cd2cea74f4931d72ad0e65baaafdc25e49fd4cebe98da21dfca0cfc5293413cc8a3b1827aa562f5891fcf785bcb7b5da1586bf12248a59b838d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\eTpA0L9dlX.bat

Filesize
194B

MD5
d0812625cb2f3798439d512a3f2a9343

SHA1
97ada5b3dae44844522996842554a65641b4aa40

SHA256
74affdd419833f6dc3fc6c0a41a5dfe63466065c21090ea0439143b8e876e733

SHA512
90bbe8fd8e4ea6d3b741bc7e85ab884070f4f0001818d4b8099883afe4fd67da95489c134e33e206665cf286c011a688253db0f7c6867dfe9e31439d36eaf536

Download Submit
C:\Users\Admin\AppData\Local\Temp\uItNEyebdJ.bat

Filesize
194B

MD5
656788ee233ad6f632447ca4a9eef3b0

SHA1
d421f8b8b8f470f106b650310877eeaf8cea1373

SHA256
79a7f613e79c9ce8e7527a03e2263a70827e9aa5e067ad93fd9247f1061efc99

SHA512
4ae12caffdfa7401212f5b1a5d138b90a854c5b4a4cd5f8f953eebbfde0cb4fc2052aefdabff1a26e02631e6a19e858984071731613b5ec94003985ed9ce6987

Download Submit
C:\Users\Admin\powershell.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\powershell.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\powershell.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\powershell.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\powershell.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\powershell.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\powershell.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\powershell.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\powershell.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/252-1163-0x00000000013B0000-0x00000000013C2000-memory.dmp

Filesize
72KB

Download
memory/400-1157-0x00000000013C0000-0x00000000013D2000-memory.dmp

Filesize
72KB

Download
memory/2124-165-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-163-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-180-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-181-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-182-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-183-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-121-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-122-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-123-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-178-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-177-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-125-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-126-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-176-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-175-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-128-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-129-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-130-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-131-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-132-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-133-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-134-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-136-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-135-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-174-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-173-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-137-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-138-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-172-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-139-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-140-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-141-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-142-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-143-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-144-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-145-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-146-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-147-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-148-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-171-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-149-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-150-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-151-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-170-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-152-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-153-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-154-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-169-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-155-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-168-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-167-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-166-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-156-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-120-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-157-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-158-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-164-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-179-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-159-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-160-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-162-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-161-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3076-289-0x0000000002780000-0x000000000278C000-memory.dmp

Filesize
48KB

Download
memory/3076-287-0x0000000002760000-0x0000000002772000-memory.dmp

Filesize
72KB

Download
memory/3076-286-0x00000000005F0000-0x0000000000700000-memory.dmp

Filesize
1.1MB

Download
memory/3076-288-0x0000000002770000-0x000000000277C000-memory.dmp

Filesize
48KB

Download
memory/3076-290-0x0000000002790000-0x000000000279C000-memory.dmp

Filesize
48KB

Download
memory/3108-386-0x00000000017D0000-0x00000000017E2000-memory.dmp

Filesize
72KB

Download
memory/3864-370-0x000002394AB00000-0x000002394AB22000-memory.dmp

Filesize
136KB

Download
memory/4488-390-0x0000020EA4A70000-0x0000020EA4AE6000-memory.dmp

Filesize
472KB

Download
memory/4620-1064-0x00000000009F0000-0x0000000000A02000-memory.dmp

Filesize
72KB

Download
memory/4868-185-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/4868-186-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/5660-1018-0x0000000002E40000-0x0000000002E52000-memory.dmp

Filesize
72KB

Download
memory/5972-1081-0x0000000001870000-0x0000000001882000-memory.dmp

Filesize
72KB

Download