dcrat | c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
03/11/2022, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe
Size

1.3MB
MD5

ba66a82f7fdf3d053ee98f72e02c5eb8
SHA1

19d2b3161a4d3bf0fedece59ef89ce6ae9373332
SHA256

c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b
SHA512

251bb335defd83c9f79728b9b12516d5941faf8a1b3741e48f93b98d5a902dbd450771c07d6b9e81636f5c370f2fc358f89a067df8d47bf1a2f223d147a84f58
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	504	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	420	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	96	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	188	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	4292	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	4292	schtasks.exe	70

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000700000001ac2e-280.dat	dcrat
behavioral1/files/0x000700000001ac2e-281.dat	dcrat
behavioral1/memory/2280-282-0x00000000007F0000-0x0000000000900000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac37-843.dat	dcrat
behavioral1/files/0x000600000001ac37-844.dat	dcrat
behavioral1/files/0x000600000001ac37-879.dat	dcrat
behavioral1/files/0x000600000001ac37-884.dat	dcrat
behavioral1/files/0x000600000001ac37-890.dat	dcrat
behavioral1/files/0x000600000001ac37-896.dat	dcrat
behavioral1/files/0x000600000001ac37-902.dat	dcrat
behavioral1/files/0x000600000001ac37-907.dat	dcrat
behavioral1/files/0x000600000001ac37-913.dat	dcrat
behavioral1/files/0x000600000001ac37-918.dat	dcrat
behavioral1/files/0x000600000001ac37-923.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
2280	DllCommonsvc.exe
5164	DllCommonsvc.exe
5484	DllCommonsvc.exe
5664	DllCommonsvc.exe
5844	DllCommonsvc.exe
6024	DllCommonsvc.exe
1652	DllCommonsvc.exe
196	DllCommonsvc.exe
2400	DllCommonsvc.exe
4844	DllCommonsvc.exe
1792	DllCommonsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\a76d7bf15d8370	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Windows\ImmersiveControlPanel\ja-JP\sihost.exe	DllCommonsvc.exe
File created	C:\Windows\INF\wininit.exe	DllCommonsvc.exe
File created	C:\Windows\INF\56085415360792	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\dwm.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3744	schtasks.exe
2984	schtasks.exe
4692	schtasks.exe
4668	schtasks.exe
188	schtasks.exe
1820	schtasks.exe
4764	schtasks.exe
1800	schtasks.exe
3116	schtasks.exe
3272	schtasks.exe
4680	schtasks.exe
3172	schtasks.exe
3288	schtasks.exe
3572	schtasks.exe
4756	schtasks.exe
4572	schtasks.exe
1792	schtasks.exe
1036	schtasks.exe
5044	schtasks.exe
208	schtasks.exe
2128	schtasks.exe
5092	schtasks.exe
4488	schtasks.exe
4652	schtasks.exe
504	schtasks.exe
1332	schtasks.exe
760	schtasks.exe
4792	schtasks.exe
420	schtasks.exe
96	schtasks.exe
2252	schtasks.exe
496	schtasks.exe
640	schtasks.exe
4436	schtasks.exe
3244	schtasks.exe
4304	schtasks.exe
2932	schtasks.exe
4796	schtasks.exe
4804	schtasks.exe
1636	schtasks.exe
1184	schtasks.exe
3016	schtasks.exe
688	schtasks.exe
2020	schtasks.exe
580	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
2280	DllCommonsvc.exe
68	powershell.exe
68	powershell.exe
868	powershell.exe
868	powershell.exe
768	powershell.exe
768	powershell.exe
2512	powershell.exe
2512	powershell.exe
2640	powershell.exe
2640	powershell.exe
3840	powershell.exe
3840	powershell.exe
2516	powershell.exe
2516	powershell.exe
3496	powershell.exe
3496	powershell.exe
4612	powershell.exe
4612	powershell.exe
4852	powershell.exe
4852	powershell.exe
4936	powershell.exe
4936	powershell.exe
2500	powershell.exe
2500	powershell.exe
4312	powershell.exe
4312	powershell.exe
4092	powershell.exe
4092	powershell.exe
3496	powershell.exe
4536	powershell.exe
4536	powershell.exe
3732	powershell.exe
3732	powershell.exe
4312	powershell.exe
4536	powershell.exe
4312	powershell.exe
68	powershell.exe
68	powershell.exe
868	powershell.exe
868	powershell.exe
768	powershell.exe
2640	powershell.exe
2512	powershell.exe
4612	powershell.exe
3496	powershell.exe
3840	powershell.exe
2516	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	DllCommonsvc.exe
Token: SeDebugPrivilege	68	powershell.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeIncreaseQuotaPrivilege	4312	powershell.exe
Token: SeSecurityPrivilege	4312	powershell.exe
Token: SeTakeOwnershipPrivilege	4312	powershell.exe
Token: SeLoadDriverPrivilege	4312	powershell.exe
Token: SeSystemProfilePrivilege	4312	powershell.exe
Token: SeSystemtimePrivilege	4312	powershell.exe
Token: SeProfSingleProcessPrivilege	4312	powershell.exe
Token: SeIncBasePriorityPrivilege	4312	powershell.exe
Token: SeCreatePagefilePrivilege	4312	powershell.exe
Token: SeBackupPrivilege	4312	powershell.exe
Token: SeRestorePrivilege	4312	powershell.exe
Token: SeShutdownPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeSystemEnvironmentPrivilege	4312	powershell.exe
Token: SeRemoteShutdownPrivilege	4312	powershell.exe
Token: SeUndockPrivilege	4312	powershell.exe
Token: SeManageVolumePrivilege	4312	powershell.exe
Token: 33	4312	powershell.exe
Token: 34	4312	powershell.exe
Token: 35	4312	powershell.exe
Token: 36	4312	powershell.exe
Token: SeIncreaseQuotaPrivilege	3496	powershell.exe
Token: SeSecurityPrivilege	3496	powershell.exe
Token: SeTakeOwnershipPrivilege	3496	powershell.exe
Token: SeLoadDriverPrivilege	3496	powershell.exe
Token: SeSystemProfilePrivilege	3496	powershell.exe
Token: SeSystemtimePrivilege	3496	powershell.exe
Token: SeProfSingleProcessPrivilege	3496	powershell.exe
Token: SeIncBasePriorityPrivilege	3496	powershell.exe
Token: SeCreatePagefilePrivilege	3496	powershell.exe
Token: SeBackupPrivilege	3496	powershell.exe
Token: SeRestorePrivilege	3496	powershell.exe
Token: SeShutdownPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeSystemEnvironmentPrivilege	3496	powershell.exe
Token: SeRemoteShutdownPrivilege	3496	powershell.exe
Token: SeUndockPrivilege	3496	powershell.exe
Token: SeManageVolumePrivilege	3496	powershell.exe
Token: 33	3496	powershell.exe
Token: 34	3496	powershell.exe
Token: 35	3496	powershell.exe
Token: 36	3496	powershell.exe
Token: SeIncreaseQuotaPrivilege	4536	powershell.exe
Token: SeSecurityPrivilege	4536	powershell.exe
Token: SeTakeOwnershipPrivilege	4536	powershell.exe
Token: SeLoadDriverPrivilege	4536	powershell.exe
Token: SeSystemProfilePrivilege	4536	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 4376	2976	c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe	66
PID 2976 wrote to memory of 4376	2976	c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe	66
PID 2976 wrote to memory of 4376	2976	c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe	66
PID 4376 wrote to memory of 3968	4376	WScript.exe	67
PID 4376 wrote to memory of 3968	4376	WScript.exe	67
PID 4376 wrote to memory of 3968	4376	WScript.exe	67
PID 3968 wrote to memory of 2280	3968	cmd.exe	69
PID 3968 wrote to memory of 2280	3968	cmd.exe	69
PID 2280 wrote to memory of 68	2280	DllCommonsvc.exe	116
PID 2280 wrote to memory of 68	2280	DllCommonsvc.exe	116
PID 2280 wrote to memory of 868	2280	DllCommonsvc.exe	127
PID 2280 wrote to memory of 868	2280	DllCommonsvc.exe	127
PID 2280 wrote to memory of 768	2280	DllCommonsvc.exe	118
PID 2280 wrote to memory of 768	2280	DllCommonsvc.exe	118
PID 2280 wrote to memory of 2640	2280	DllCommonsvc.exe	119
PID 2280 wrote to memory of 2640	2280	DllCommonsvc.exe	119
PID 2280 wrote to memory of 2512	2280	DllCommonsvc.exe	124
PID 2280 wrote to memory of 2512	2280	DllCommonsvc.exe	124
PID 2280 wrote to memory of 2516	2280	DllCommonsvc.exe	120
PID 2280 wrote to memory of 2516	2280	DllCommonsvc.exe	120
PID 2280 wrote to memory of 3840	2280	DllCommonsvc.exe	121
PID 2280 wrote to memory of 3840	2280	DllCommonsvc.exe	121
PID 2280 wrote to memory of 3496	2280	DllCommonsvc.exe	148
PID 2280 wrote to memory of 3496	2280	DllCommonsvc.exe	148
PID 2280 wrote to memory of 4852	2280	DllCommonsvc.exe	147
PID 2280 wrote to memory of 4852	2280	DllCommonsvc.exe	147
PID 2280 wrote to memory of 4612	2280	DllCommonsvc.exe	129
PID 2280 wrote to memory of 4612	2280	DllCommonsvc.exe	129
PID 2280 wrote to memory of 2500	2280	DllCommonsvc.exe	144
PID 2280 wrote to memory of 2500	2280	DllCommonsvc.exe	144
PID 2280 wrote to memory of 4936	2280	DllCommonsvc.exe	130
PID 2280 wrote to memory of 4936	2280	DllCommonsvc.exe	130
PID 2280 wrote to memory of 4092	2280	DllCommonsvc.exe	142
PID 2280 wrote to memory of 4092	2280	DllCommonsvc.exe	142
PID 2280 wrote to memory of 4312	2280	DllCommonsvc.exe	141
PID 2280 wrote to memory of 4312	2280	DllCommonsvc.exe	141
PID 2280 wrote to memory of 4536	2280	DllCommonsvc.exe	138
PID 2280 wrote to memory of 4536	2280	DllCommonsvc.exe	138
PID 2280 wrote to memory of 3732	2280	DllCommonsvc.exe	133
PID 2280 wrote to memory of 3732	2280	DllCommonsvc.exe	133
PID 2280 wrote to memory of 4780	2280	DllCommonsvc.exe	137
PID 2280 wrote to memory of 4780	2280	DllCommonsvc.exe	137
PID 4780 wrote to memory of 4940	4780	cmd.exe	150
PID 4780 wrote to memory of 4940	4780	cmd.exe	150
PID 4780 wrote to memory of 5164	4780	cmd.exe	152
PID 4780 wrote to memory of 5164	4780	cmd.exe	152
PID 5164 wrote to memory of 5408	5164	DllCommonsvc.exe	153
PID 5164 wrote to memory of 5408	5164	DllCommonsvc.exe	153
PID 5408 wrote to memory of 5464	5408	cmd.exe	155
PID 5408 wrote to memory of 5464	5408	cmd.exe	155
PID 5408 wrote to memory of 5484	5408	cmd.exe	156
PID 5408 wrote to memory of 5484	5408	cmd.exe	156
PID 5484 wrote to memory of 5588	5484	DllCommonsvc.exe	157
PID 5484 wrote to memory of 5588	5484	DllCommonsvc.exe	157
PID 5588 wrote to memory of 5644	5588	cmd.exe	159
PID 5588 wrote to memory of 5644	5588	cmd.exe	159
PID 5588 wrote to memory of 5664	5588	cmd.exe	160
PID 5588 wrote to memory of 5664	5588	cmd.exe	160
PID 5664 wrote to memory of 5768	5664	DllCommonsvc.exe	161
PID 5664 wrote to memory of 5768	5664	DllCommonsvc.exe	161
PID 5768 wrote to memory of 5824	5768	cmd.exe	163
PID 5768 wrote to memory of 5824	5768	cmd.exe	163
PID 5768 wrote to memory of 5844	5768	cmd.exe	164
PID 5768 wrote to memory of 5844	5768	cmd.exe	164

C:\Users\Admin\AppData\Local\Temp\c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe
"C:\Users\Admin\AppData\Local\Temp\c5878aa98b5144b0af9fa20e6255986b3ee6b6289311f4f5a8b48a34d837019b.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2280
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:68
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kM739AVLL2.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4780
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4940
      - C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\38GCmEMl12.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:5464
        
        C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zHC6P4FzNT.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:5644
        
        C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5768
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:5824
        
        C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rcE1qBYVKA.bat"
        13⤵
        
        PID:5948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:6004
        
        C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat"
        15⤵
        
        PID:6128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2656
        
        C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1652
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sNl5EWIzDs.bat"
        17⤵
        
        PID:4336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3464
        
        C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat"
        19⤵
        
        PID:3988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:648
        
        C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2400
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jddtUB3Qwl.bat"
        21⤵
        
        PID:3296
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:5124
        
        C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3HNGHapxv4.bat"
        23⤵
        
        PID:4968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2356
        
        C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe
        
        "C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"
        25⤵
        
        PID:1664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Start Menu\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Start Menu\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\INF\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\INF\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\INF\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:96

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\odt\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Portable Devices\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
b4268d8ae66fdd920476b97a1776bf85

SHA1
f920de54f7467f0970eccc053d3c6c8dd181d49a

SHA256
61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879

SHA512
03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f42672d2cfc54ba70fa0542d5743843a

SHA1
5bf3a7521f2ec605de70aa3f3ab410c8c800cc9d

SHA256
3e8c707725c53855be98cc864d3581fdf2ac5b3ad3aaf1ffecb9886ef0f0ce56

SHA512
794ed957dbaf4904a2dbe1691052c9464b2184567f1915d441d46e89e03b97765101e046a31c83757c10233262cc77a23a9a763be01e4adc10d432eebb475f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
68de62fe66f9b492e94e98ced7737bf4

SHA1
6681849abb88363f3e0cedaec84535faea0221bd

SHA256
da45781ef0aad5448310a4a4d5ad8cedb4c72eddba621fd2e111ad8be953c32e

SHA512
aec608aa0ef68da637cd021d970b54aa76e071c1441e4ab0239bd7085f2290f10b3e5bc5c0b533e5b06717c5ee307f46c07625ed0398428b9fecbca7ce20186a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b9105535614bcc8e6b0467dbee18fdcc

SHA1
04963aede8462ec0236f6bac81f87912a4d309f9

SHA256
a4344e0dc1af70a964d819a2e181dedae2c0539ee3111ca3acc97e9110f6bb34

SHA512
c3e98ee9fb4f2881aa62b8edb202b31e48faca65b352d563f43b81440279490e50114b07cb557ef75171bbb738ab2ef8170ab297e4286e808e80005918dcd5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
edb6d13ebb9d0829280d4e4f597fd8f9

SHA1
1ef5eaaa6ab6444fb2f121355d0ffe586609580e

SHA256
9ab5072aaf0c58d5ec25adcb39591ea0e9be71b8ab8fc335035d1e2e039a9d2c

SHA512
de8b58e06b02da74ff8e10641fe9d08e55d4a391bffc4f271259b5a7d16f00f7d71be7dce9e47b0e7edffead388cde30c7edbc45fb8ab982afffc3db17722377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0c2709cb9970c0cf43ca4ce2e057139a

SHA1
d91a16f847cc7adb46c0542aa67974c7d5c14b00

SHA256
5247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17

SHA512
5edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2701eb1c330a8391ec6e9902a187a6ae

SHA1
36fd17e7f4df322a5ed547983864df0ddd8f3030

SHA256
5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

SHA512
ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0c2709cb9970c0cf43ca4ce2e057139a

SHA1
d91a16f847cc7adb46c0542aa67974c7d5c14b00

SHA256
5247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17

SHA512
5edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2701eb1c330a8391ec6e9902a187a6ae

SHA1
36fd17e7f4df322a5ed547983864df0ddd8f3030

SHA256
5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

SHA512
ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2701eb1c330a8391ec6e9902a187a6ae

SHA1
36fd17e7f4df322a5ed547983864df0ddd8f3030

SHA256
5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

SHA512
ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0c2709cb9970c0cf43ca4ce2e057139a

SHA1
d91a16f847cc7adb46c0542aa67974c7d5c14b00

SHA256
5247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17

SHA512
5edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2701eb1c330a8391ec6e9902a187a6ae

SHA1
36fd17e7f4df322a5ed547983864df0ddd8f3030

SHA256
5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

SHA512
ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2701eb1c330a8391ec6e9902a187a6ae

SHA1
36fd17e7f4df322a5ed547983864df0ddd8f3030

SHA256
5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

SHA512
ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2701eb1c330a8391ec6e9902a187a6ae

SHA1
36fd17e7f4df322a5ed547983864df0ddd8f3030

SHA256
5eae755eb59841874ae98080ffe949a0804eb62d634bb43e424f2f774120b025

SHA512
ada5b2af9dab82795684bd424f0d61b62d739c85bac664126fe2962f2388bae4f832537806a3fe3c97fe492080b9ddb8ee9da1ba79818da290d05658c62c3af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0c2709cb9970c0cf43ca4ce2e057139a

SHA1
d91a16f847cc7adb46c0542aa67974c7d5c14b00

SHA256
5247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17

SHA512
5edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0c2709cb9970c0cf43ca4ce2e057139a

SHA1
d91a16f847cc7adb46c0542aa67974c7d5c14b00

SHA256
5247b7cfa79c50a2f3b35ad2a15c726b8a74665795e9c785122adf1cf0fa9b17

SHA512
5edc45bcd17e1a5fae1cf5a3dbe76226531fc1021c8c947a8466946c5d1b679027539cef8373d8bdca6a79ad579ec5f695a6c0af6a96ae467e5d971571777672

Download Submit
C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat

Filesize
229B

MD5
9d7abfda6d83a2f0a1407900d41708b9

SHA1
cb82ff17d4769d3d853f4d463b11631d67e11927

SHA256
c87a8c7325a495d9edc181d0e192b20a415bd47e6f3de47f523c10eeb87e3486

SHA512
ebd7e3976dbeac1bc70c4b88194e8c52c8f57684008e86244466a92ef7908fa37b0f91e21a2a01f07d72e9a99529416a4d9cdece524300c99a7b401371891566

Download Submit
C:\Users\Admin\AppData\Local\Temp\38GCmEMl12.bat

Filesize
229B

MD5
bb153da09d97d3bb91c49d7207ef3a54

SHA1
89f2ba1a23be07736b98fd32728bec0e2c1ff9ac

SHA256
91c7e540e468824224414d5547bceb863465eae55aa486e2ebbe71d11ef89458

SHA512
51fbbae84fab4d7feb74a4d754057e6b29cc2f5181115a727c52b918e70c1d93a293b9a0b76ab2b903f82632216507edcd745b46e67b0a1c0d4cac22a4cb0d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\3HNGHapxv4.bat

Filesize
229B

MD5
6ebbe7e4597ee1ac63aa8098c854871e

SHA1
28edd3da39939f3d72b57bca3b1eedee366bb19f

SHA256
6181236d6b9f59fbe9e723704c538cb9ccded99381564a1e3dea97443d124eca

SHA512
ba3e7fe314e94d2496a61e5442b16f299a3dfe55d1be073c791677d580703bf96a60d5771cc7a172c71e0212bd4af06c44b8d6176f2dd421296fc786eb9ec833

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat

Filesize
229B

MD5
f6d0df28ab710107eec630554477f870

SHA1
f474882f9e5f6af2d07f8ef1d1a7249baa79b619

SHA256
ac9d179975e449326f036c8cc97c08f2c5d091e8e53ed3ec1074f0e308d55a28

SHA512
fe171f580b6a761faf8bac7e7ee44c2e39c4bafaf817ee058cb0e2cbee0c00fc9fcf4ca917094dc6fcd08311fd5a1f3436931068e25efb71cbc80a637d74b683

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ys8lvSze9b.bat

Filesize
229B

MD5
f6d0df28ab710107eec630554477f870

SHA1
f474882f9e5f6af2d07f8ef1d1a7249baa79b619

SHA256
ac9d179975e449326f036c8cc97c08f2c5d091e8e53ed3ec1074f0e308d55a28

SHA512
fe171f580b6a761faf8bac7e7ee44c2e39c4bafaf817ee058cb0e2cbee0c00fc9fcf4ca917094dc6fcd08311fd5a1f3436931068e25efb71cbc80a637d74b683

Download Submit
C:\Users\Admin\AppData\Local\Temp\jddtUB3Qwl.bat

Filesize
229B

MD5
c6125cca99ca190feaa89096df41104f

SHA1
84900d87d80e262acbc0944c6d531fa5d6d2819a

SHA256
a958fed4ed5491a642f90033e158ed6cc62471120e1bf495db310325364d6ae9

SHA512
c046c9bfa7b7db51c605fb31d3f8bcb4eb130cbd0d9965f9dcf9301d969741759efd0f13198742b8c4bb1234358c7378f7cb628921923f33110fd10ff4a4d966

Download Submit
C:\Users\Admin\AppData\Local\Temp\kM739AVLL2.bat

Filesize
229B

MD5
5d1f40bd75b95662611c31c9151a4c77

SHA1
bba9c766c26e012ba5b5bb73f8d585cdb578484f

SHA256
4b6a073fa16546ca44acdc485f3eda842dbc96abf453de3cf33d0fb808e9dbed

SHA512
dfa145187d6d2b2fdfdc969c2a0a4524b360fff213acbd93c03e032f4422c374f263f164bdb62656ac0c4c4669c9024a95f54bbc563529fbbf1edefb9f9253b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat

Filesize
229B

MD5
d09466e0285b6cd414ceed5343a74bef

SHA1
8a34ac5a318e5b6515e7d919b32e7f18be68d41a

SHA256
d2f4f4ab3f5469e342c634e50a55972fc84907be4c50561edab9b22a30dd7b87

SHA512
31146707acd22a0e5ed492836c0517900bee8d22751e7faede086abc748ec3ec5235afccaa2dad8d3323b05cb83d3314d523b1708359fb17f3e782c08f9d76aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\rcE1qBYVKA.bat

Filesize
229B

MD5
bf87696a02769a7afa8f027a246e6feb

SHA1
ba9f71d3a81edf2031114fa1980233db897ba683

SHA256
7c3199ad0ea51e46fd7f6a6da5d739c29eac0fb8c8a881694e3d98213582e996

SHA512
298ba7c04c9955a653521102311e0311600b1684bae6d43254d4343fcd54a24e5b2688f1fd44defc59fa64e71603f518a657ab57e8dce16523c35cae235b1687

Download Submit
C:\Users\Admin\AppData\Local\Temp\sNl5EWIzDs.bat

Filesize
229B

MD5
6159ade6e45602a0c7011b2083dd4cb5

SHA1
51337c8bace666de3acbf7c65890fe0d7fe21c74

SHA256
11c2933963a071ea4d0300b89d73f93a4619cbacb3144b6a5ef4aa511aa4b520

SHA512
5d323f78c67b872dcec905f15808b0b47c134c86bada6d44fb95332f6e1c879b1fd04de77a174a7d6832f77d0a4da5d67174a70e3e4fbcd884b6c039e767ab05

Download Submit
C:\Users\Admin\AppData\Local\Temp\zHC6P4FzNT.bat

Filesize
229B

MD5
24a3cb63391658481deff807d7c689da

SHA1
e6ad32080416eb47cb9f227dd49106d672a37d1b

SHA256
08083a5534dfc5c046c99ce2b024d35fe850c14c80601c56d1c421f8ec79f0b8

SHA512
0ac618b3457616d95bc39e13383d0bb680951f5d66c7140e4408463e60a379e9147889a956aad2d9a0b4f67e06b287218924a1c38863117fa2eb81171d066f3d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/68-366-0x000001D51B780000-0x000001D51B7A2000-memory.dmp

Filesize
136KB

Download
memory/196-908-0x0000000001550000-0x0000000001562000-memory.dmp

Filesize
72KB

Download
memory/2280-282-0x00000000007F0000-0x0000000000900000-memory.dmp

Filesize
1.1MB

Download
memory/2280-286-0x00000000010D0000-0x00000000010DC000-memory.dmp

Filesize
48KB

Download
memory/2280-285-0x00000000010C0000-0x00000000010CC000-memory.dmp

Filesize
48KB

Download
memory/2280-284-0x00000000010E0000-0x00000000010EC000-memory.dmp

Filesize
48KB

Download
memory/2280-283-0x00000000010B0000-0x00000000010C2000-memory.dmp

Filesize
72KB

Download
memory/2976-155-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-150-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-167-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-165-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-164-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-166-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-168-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-169-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-170-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-171-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-163-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-162-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-179-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-178-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-161-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-117-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-118-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-173-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-160-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-116-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-177-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-119-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-159-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-176-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-158-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-157-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-175-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-156-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-121-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-172-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-154-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-153-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-152-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-174-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-151-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-122-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-149-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-148-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-147-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-146-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-145-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-144-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-143-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-142-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-141-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-140-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-139-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-138-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-137-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-136-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-135-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-134-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-133-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-132-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-124-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-131-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-130-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-129-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-128-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-127-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-126-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2976-125-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4312-387-0x0000020766BF0000-0x0000020766C66000-memory.dmp

Filesize
472KB

Download
memory/4376-181-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4376-182-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/5664-885-0x0000000000930000-0x0000000000942000-memory.dmp

Filesize
72KB

Download
memory/5844-891-0x00000000012B0000-0x00000000012C2000-memory.dmp

Filesize
72KB

Download
memory/6024-897-0x0000000001620000-0x0000000001632000-memory.dmp

Filesize
72KB

Download