dcrat | e19bb77e380f8dad4bc97f3d0577ff60297e3b6f4d4de9d00c149da1ce820045

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b42f3c8a832b8130b60169553c013b0.exe
Size

1.3MB
MD5

1b42f3c8a832b8130b60169553c013b0
SHA1

de90d2a3cf23c243b24ec31c51e5599ff9094da0
SHA256

e19bb77e380f8dad4bc97f3d0577ff60297e3b6f4d4de9d00c149da1ce820045
SHA512

b79a3999a74ebbf9097889f978890031cce799eb7173cb1efed09798d471378383d131aed955cfe622e88149272feec95ac229adfce67219c5ccf32e85f63e65
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3696	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	3800	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	3800	schtasks.exe

DCRat payload 12 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral2/memory/2140-139-0x0000000000950000-0x0000000000A60000-memory.dmp	dcrat
C:\Program Files\Microsoft Office\Office16\winlogon.exe	dcrat
C:\Program Files\Microsoft Office\Office16\winlogon.exe	dcrat
C:\Program Files\Microsoft Office\Office16\winlogon.exe	dcrat
C:\Program Files\Microsoft Office\Office16\winlogon.exe	dcrat
C:\Program Files\Microsoft Office\Office16\winlogon.exe	dcrat
C:\Program Files\Microsoft Office\Office16\winlogon.exe	dcrat
C:\Program Files\Microsoft Office\Office16\winlogon.exe	dcrat
C:\Program Files\Microsoft Office\Office16\winlogon.exe	dcrat
C:\Program Files\Microsoft Office\Office16\winlogon.exe	dcrat

Executes dropped EXE 9 IoCs

Processes:

DllCommonsvc.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

pid	process
2140	DllCommonsvc.exe
952	winlogon.exe
1176	winlogon.exe
2428	winlogon.exe
4944	winlogon.exe
2728	winlogon.exe
3392	winlogon.exe
3708	winlogon.exe
4140	winlogon.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exeWScript.exeDllCommonsvc.exewinlogon.exewinlogon.exewinlogon.exe1b42f3c8a832b8130b60169553c013b0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1b42f3c8a832b8130b60169553c013b0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 16 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\Office16\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\Office16\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\66fc9ff0ee96c2	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\e1ef82546f0b02	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\System.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\27d1bcfc3c54e0	DllCommonsvc.exe

Drops file in Windows directory 1 IoCs

Processes:

DllCommonsvc.exe

description ioc process

File created C:\Windows\ServiceState\taskhostw.exe DllCommonsvc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\ServiceState\taskhostw.exe	DllCommonsvc.exe

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4084	schtasks.exe
4004	schtasks.exe
2876	schtasks.exe
3476	schtasks.exe
1868	schtasks.exe
1812	schtasks.exe
3716	schtasks.exe
3312	schtasks.exe
3916	schtasks.exe
4496	schtasks.exe
1700	schtasks.exe
3148	schtasks.exe
4420	schtasks.exe
4644	schtasks.exe
5104	schtasks.exe
4336	schtasks.exe
2124	schtasks.exe
348	schtasks.exe
1372	schtasks.exe
4324	schtasks.exe
1084	schtasks.exe
4840	schtasks.exe
5024	schtasks.exe
3680	schtasks.exe
4932	schtasks.exe
4824	schtasks.exe
1036	schtasks.exe
3500	schtasks.exe
4360	schtasks.exe
860	schtasks.exe
1392	schtasks.exe
3580	schtasks.exe
5052	schtasks.exe
1776	schtasks.exe
1056	schtasks.exe
116	schtasks.exe
2840	schtasks.exe
4000	schtasks.exe
4924	schtasks.exe
5072	schtasks.exe
2344	schtasks.exe
3748	schtasks.exe
2356	schtasks.exe
3172	schtasks.exe
1764	schtasks.exe
1116	schtasks.exe
4292	schtasks.exe
3388	schtasks.exe
3696	schtasks.exe
1712	schtasks.exe
3912	schtasks.exe

Modifies registry class 10 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exe1b42f3c8a832b8130b60169553c013b0.exeDllCommonsvc.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	1b42f3c8a832b8130b60169553c013b0.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	winlogon.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2140	DllCommonsvc.exe
2140	DllCommonsvc.exe
2140	DllCommonsvc.exe
2140	DllCommonsvc.exe
2140	DllCommonsvc.exe
2140	DllCommonsvc.exe
2140	DllCommonsvc.exe
3576	powershell.exe
3576	powershell.exe
3648	powershell.exe
3648	powershell.exe
2196	powershell.exe
2196	powershell.exe
868	powershell.exe
868	powershell.exe
5088	powershell.exe
5088	powershell.exe
4664	powershell.exe
4664	powershell.exe
1096	powershell.exe
1096	powershell.exe
2660	powershell.exe
2660	powershell.exe
5108	powershell.exe
5108	powershell.exe
4488	powershell.exe
4488	powershell.exe
1472	powershell.exe
1472	powershell.exe
3248	powershell.exe
3248	powershell.exe
4060	powershell.exe
4060	powershell.exe
4516	powershell.exe
4516	powershell.exe
3992	powershell.exe
3992	powershell.exe
2920	powershell.exe
2920	powershell.exe
4308	powershell.exe
4308	powershell.exe
2472	powershell.exe
2472	powershell.exe
3576	powershell.exe
3576	powershell.exe
3648	powershell.exe
3648	powershell.exe
2196	powershell.exe
2196	powershell.exe
868	powershell.exe
868	powershell.exe
5088	powershell.exe
5088	powershell.exe
4664	powershell.exe
2660	powershell.exe
5108	powershell.exe
1096	powershell.exe
4488	powershell.exe
1472	powershell.exe
3248	powershell.exe
2472	powershell.exe
4060	powershell.exe
4516	powershell.exe
3992	powershell.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2140	DllCommonsvc.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	3992	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	952	winlogon.exe
Token: SeDebugPrivilege	1176	winlogon.exe
Token: SeDebugPrivilege	2428	winlogon.exe
Token: SeDebugPrivilege	4944	winlogon.exe
Token: SeDebugPrivilege	2728	winlogon.exe
Token: SeDebugPrivilege	3392	winlogon.exe
Token: SeDebugPrivilege	3708	winlogon.exe
Token: SeDebugPrivilege	4140	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1b42f3c8a832b8130b60169553c013b0.exeWScript.execmd.exeDllCommonsvc.execmd.exewinlogon.execmd.exewinlogon.execmd.exewinlogon.exe

description	pid	process	target process
PID 4888 wrote to memory of 1016	4888	1b42f3c8a832b8130b60169553c013b0.exe	WScript.exe
PID 4888 wrote to memory of 1016	4888	1b42f3c8a832b8130b60169553c013b0.exe	WScript.exe
PID 4888 wrote to memory of 1016	4888	1b42f3c8a832b8130b60169553c013b0.exe	WScript.exe
PID 1016 wrote to memory of 1932	1016	WScript.exe	cmd.exe
PID 1016 wrote to memory of 1932	1016	WScript.exe	cmd.exe
PID 1016 wrote to memory of 1932	1016	WScript.exe	cmd.exe
PID 1932 wrote to memory of 2140	1932	cmd.exe	DllCommonsvc.exe
PID 1932 wrote to memory of 2140	1932	cmd.exe	DllCommonsvc.exe
PID 2140 wrote to memory of 5108	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 5108	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 3576	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 3576	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 2196	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 2196	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 3648	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 3648	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 5088	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 5088	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 868	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 868	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 1096	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 1096	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 4664	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 4664	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 2660	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 2660	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 4488	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 4488	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 1472	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 1472	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 4060	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 4060	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 3248	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 3248	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 4516	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 4516	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 3992	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 3992	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 4308	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 4308	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 2472	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 2472	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 2920	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 2920	2140	DllCommonsvc.exe	powershell.exe
PID 2140 wrote to memory of 5004	2140	DllCommonsvc.exe	cmd.exe
PID 2140 wrote to memory of 5004	2140	DllCommonsvc.exe	cmd.exe
PID 5004 wrote to memory of 3092	5004	cmd.exe	w32tm.exe
PID 5004 wrote to memory of 3092	5004	cmd.exe	w32tm.exe
PID 5004 wrote to memory of 952	5004	cmd.exe	winlogon.exe
PID 5004 wrote to memory of 952	5004	cmd.exe	winlogon.exe
PID 952 wrote to memory of 3236	952	winlogon.exe	cmd.exe
PID 952 wrote to memory of 3236	952	winlogon.exe	cmd.exe
PID 3236 wrote to memory of 3916	3236	cmd.exe	w32tm.exe
PID 3236 wrote to memory of 3916	3236	cmd.exe	w32tm.exe
PID 3236 wrote to memory of 1176	3236	cmd.exe	winlogon.exe
PID 3236 wrote to memory of 1176	3236	cmd.exe	winlogon.exe
PID 1176 wrote to memory of 208	1176	winlogon.exe	cmd.exe
PID 1176 wrote to memory of 208	1176	winlogon.exe	cmd.exe
PID 208 wrote to memory of 3004	208	cmd.exe	w32tm.exe
PID 208 wrote to memory of 3004	208	cmd.exe	w32tm.exe
PID 208 wrote to memory of 2428	208	cmd.exe	winlogon.exe
PID 208 wrote to memory of 2428	208	cmd.exe	winlogon.exe
PID 2428 wrote to memory of 2220	2428	winlogon.exe	cmd.exe
PID 2428 wrote to memory of 2220	2428	winlogon.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1b42f3c8a832b8130b60169553c013b0.exe
"C:\Users\Admin\AppData\Local\Temp\1b42f3c8a832b8130b60169553c013b0.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\de-DE\cmd.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SearchApp.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office16\winlogon.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\System.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\dllhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\3D Objects\conhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SppExtComObj.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\lua\sd\System.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\cmd.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CyxGcg3L6d.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:3092

C:\Program Files\Microsoft Office\Office16\winlogon.exe
"C:\Program Files\Microsoft Office\Office16\winlogon.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LnIbptgF5R.bat"
7⤵
- Suspicious use of WriteProcessMemory
PID:3236

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:3916

C:\Program Files\Microsoft Office\Office16\winlogon.exe
"C:\Program Files\Microsoft Office\Office16\winlogon.exe"
8⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AsgPmp9HNF.bat"
9⤵
- Suspicious use of WriteProcessMemory
PID:208

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
10⤵
PID:3004

C:\Program Files\Microsoft Office\Office16\winlogon.exe
"C:\Program Files\Microsoft Office\Office16\winlogon.exe"
10⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\989MOUOnUX.bat"
11⤵
PID:2220

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
12⤵
PID:1140

C:\Program Files\Microsoft Office\Office16\winlogon.exe
"C:\Program Files\Microsoft Office\Office16\winlogon.exe"
12⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bbMo3XBCxD.bat"
13⤵
PID:1532

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
14⤵
PID:4408

C:\Program Files\Microsoft Office\Office16\winlogon.exe
"C:\Program Files\Microsoft Office\Office16\winlogon.exe"
14⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fcYyv3mAUp.bat"
15⤵
PID:4884

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
16⤵
PID:3148

C:\Program Files\Microsoft Office\Office16\winlogon.exe
"C:\Program Files\Microsoft Office\Office16\winlogon.exe"
16⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oS12nhm3yC.bat"
17⤵
PID:1536

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
18⤵
PID:724

C:\Program Files\Microsoft Office\Office16\winlogon.exe
"C:\Program Files\Microsoft Office\Office16\winlogon.exe"
18⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat"
19⤵
PID:4188

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
20⤵
PID:2384

C:\Program Files\Microsoft Office\Office16\winlogon.exe
"C:\Program Files\Microsoft Office\Office16\winlogon.exe"
20⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QqrgVo7Q94.bat"
21⤵
PID:2236

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
22⤵
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\odt\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Office16\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office16\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Sidebar\Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\3D Objects\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\3D Objects\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\3D Objects\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\CrashReports\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\lua\sd\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\sd\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\lua\sd\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\Office16\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\Microsoft Office\Office16\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\Microsoft Office\Office16\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\Microsoft Office\Office16\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\Microsoft Office\Office16\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\Microsoft Office\Office16\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\Microsoft Office\Office16\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\Microsoft Office\Office16\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\Microsoft Office\Office16\winlogon.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
101c3b86ef1c02c62b7d862c2a47363b

SHA1
3c5e8d309610e5ba41b6b9788bfb826e45864b46

SHA256
9174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c

SHA512
d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\989MOUOnUX.bat

Filesize
220B

MD5
a39a511b167adeeb79a5a8fe4e0cef6d

SHA1
0f00fd8dcc46b0c88930f38a706db26e0262055c

SHA256
03ff83c4106abf8b8297591ee42edc221fe39190f6d8a8513028155881967602

SHA512
62ad7cb277ce8615257a646fcc060e6ebab951a544f39e23f1ba89565a37791406a9a59177bbce41a9ef7d83bb67d63183e49fa8c06eb13308bc70e0d406137a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AsgPmp9HNF.bat

Filesize
220B

MD5
996f5645830a411c4e2ec9895d5152cf

SHA1
252fb160dc67ce2b088ebd01feea47ecb2f6f7a9

SHA256
5e6eb4f90efeae82fd11001bcd000aa61f707498d9723f49623abbe3955c58a3

SHA512
9d14cdc8bf0baaa85394009bee42bf72c923120f50e9fd8f21d04eb5a60b49bf29368546db2c55ecc23fb7a61c0aeb64ae69dae23520e125e415246c14ddf5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CyxGcg3L6d.bat

Filesize
220B

MD5
5516358ce2a2296216f13645b8c4b879

SHA1
0a585b368e0a786da7d0c60e767dc7e6e17f2a4e

SHA256
31d4d0cd09daa8c15eb32f6d1c2532075eb9888c9e8c024f5980dde69ed9e53d

SHA512
7370fe47c2e459cb737e139769f882841dbc08349a8e2f0c66ecfeb846b02fa501f1d29747f262a2d1485b57995ae32c3e8d60d67694d2062b234a310ea337d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\LnIbptgF5R.bat

Filesize
220B

MD5
ab8c5f9b3836fa29d4b95ce8d1051e59

SHA1
13763f06c907cf9c869ed8c9cb2362997f491f96

SHA256
b1799d42bab4698ec29c64d2a0257806f7aef8fb1c5b5764431a34c9496934f2

SHA512
7c87571c70ae7e54fb9fc3365f9e1cb429bed7405cc80f440180a46f6038e4b04cfe8bfb1e1550b7048420ba93048ff4b7f6bcfa4616a731bb767b46356f0b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\QqrgVo7Q94.bat

Filesize
220B

MD5
d449183c04581bdf49657db0fb1ee4a6

SHA1
f79307d7cc3073704c043388a7a923fefb00725e

SHA256
e0669d72116823a2db91953a06d77af3218e1dc041e886bd09f96fe3bdf00e5d

SHA512
948cdb132243950fe6b3b16068f7e50ff08cae05544fb5a6d96bec0a5388d3806e19003d5acc1888519ec77d5f1320d496cf0c454bd7f63fa4280cf5de830981

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rhkc0SdEF2.bat

Filesize
220B

MD5
9d4f09662711344f33fc2e1c52e6e620

SHA1
238799100b179333fdb524c2c0eb7bada8293053

SHA256
cda287ea1c6cea99759c045d3ce3e14bed13569641c512c9f81061f40bf99195

SHA512
35d1f8f4de34b2b8fbcee5dd0f4164a01c1ea416f122f04fd93d3f55cdc5d913bbc345b40be6c60cd0f244adb9a0349aa6be9783ce9fbeaf95da54ee116240c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbMo3XBCxD.bat

Filesize
220B

MD5
db4ce21e3e2ee4db139db80d9a3259c8

SHA1
1f8be805e78309fade8a261054d6b26005f16908

SHA256
455ceafe5936c167a41ba72017309055ee6516953df45d660c40b8de79c91eb2

SHA512
8c69bfb9d06ac1d587af32a8599a2ecdc03bcdd906bc1fc2c67bfeab7ade77b534bb1b696198ea81ce2dd07cf101633001d3ea4332d81e95d91d5581c57b027b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fcYyv3mAUp.bat

Filesize
220B

MD5
1a3827bb0c93200f68b53872e57e202a

SHA1
e0fb54cf16aebef60954e0ec01e4d139d95968bf

SHA256
d73969955ee9cf4402dfd25f29665d7c98f7b388efac68d65728632d70d29556

SHA512
fa118f78691389ad0590aa2c342ca622354723620753a3c236dfa81b15ac51736da114704cd22ad320fe90b6da7a86244c6727328bd216f347eb6c4507e7b4ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\oS12nhm3yC.bat

Filesize
220B

MD5
7e717155958809f989478c8cb9e9c36a

SHA1
36766aeb0c8aa291817cc263e67550b9bb4c29b0

SHA256
f62e203f93070fd4e324f100e3d34145565132cad400ea1ed8dc7b241ee07c65

SHA512
9fd2d5561ac6f0d472c3d6b073f510f42da7b8cd1009c3d34ddd8778862bbd2bbbcc7a5d2b5c06a44edccc20cf024ab1ba6f48f1839a8bb814d22192135cbba2

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/208-230-0x0000000000000000-mapping.dmp

Download
memory/724-260-0x0000000000000000-mapping.dmp

Download
memory/868-177-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/868-199-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/868-146-0x0000000000000000-mapping.dmp

Download
memory/952-225-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/952-221-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/952-218-0x0000000000000000-mapping.dmp

Download
memory/1016-132-0x0000000000000000-mapping.dmp

Download
memory/1096-147-0x0000000000000000-mapping.dmp

Download
memory/1096-165-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/1096-197-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/1140-239-0x0000000000000000-mapping.dmp

Download
memory/1176-226-0x0000000000000000-mapping.dmp

Download
memory/1176-229-0x00007FFAD9AA0000-0x00007FFADA561000-memory.dmp

Filesize
10.8MB

Download
memory/1176-233-0x00007FFAD9AA0000-0x00007FFADA561000-memory.dmp

Filesize
10.8MB

Download
memory/1472-207-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/1472-170-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/1472-151-0x0000000000000000-mapping.dmp

Download
memory/1532-244-0x0000000000000000-mapping.dmp

Download
memory/1536-258-0x0000000000000000-mapping.dmp

Download
memory/1596-274-0x0000000000000000-mapping.dmp

Download
memory/1932-135-0x0000000000000000-mapping.dmp

Download
memory/2140-136-0x0000000000000000-mapping.dmp

Download
memory/2140-139-0x0000000000950000-0x0000000000A60000-memory.dmp

Filesize
1.1MB

Download
memory/2140-140-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2140-167-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2196-190-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2196-143-0x0000000000000000-mapping.dmp

Download
memory/2196-161-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2220-237-0x0000000000000000-mapping.dmp

Download
memory/2236-272-0x0000000000000000-mapping.dmp

Download
memory/2384-267-0x0000000000000000-mapping.dmp

Download
memory/2428-236-0x00007FFAD9B10000-0x00007FFADA5D1000-memory.dmp

Filesize
10.8MB

Download
memory/2428-234-0x0000000000000000-mapping.dmp

Download
memory/2428-240-0x00007FFAD9B10000-0x00007FFADA5D1000-memory.dmp

Filesize
10.8MB

Download
memory/2472-158-0x0000000000000000-mapping.dmp

Download
memory/2472-181-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2472-217-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2660-179-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2660-149-0x0000000000000000-mapping.dmp

Download
memory/2660-205-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2728-248-0x0000000000000000-mapping.dmp

Download
memory/2728-250-0x00007FFAD9B10000-0x00007FFADA5D1000-memory.dmp

Filesize
10.8MB

Download
memory/2728-254-0x00007FFAD9B10000-0x00007FFADA5D1000-memory.dmp

Filesize
10.8MB

Download
memory/2920-175-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2920-215-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2920-160-0x0000000000000000-mapping.dmp

Download
memory/3004-232-0x0000000000000000-mapping.dmp

Download
memory/3092-176-0x0000000000000000-mapping.dmp

Download
memory/3148-253-0x0000000000000000-mapping.dmp

Download
memory/3236-222-0x0000000000000000-mapping.dmp

Download
memory/3248-153-0x0000000000000000-mapping.dmp

Download
memory/3248-171-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/3248-210-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/3392-261-0x00007FFAD9B10000-0x00007FFADA5D1000-memory.dmp

Filesize
10.8MB

Download
memory/3392-255-0x0000000000000000-mapping.dmp

Download
memory/3392-257-0x00007FFAD9B10000-0x00007FFADA5D1000-memory.dmp

Filesize
10.8MB

Download
memory/3576-155-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/3576-182-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/3576-142-0x0000000000000000-mapping.dmp

Download
memory/3648-185-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/3648-164-0x000002239F140000-0x000002239F162000-memory.dmp

Filesize
136KB

Download
memory/3648-144-0x0000000000000000-mapping.dmp

Download
memory/3648-159-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/3708-264-0x00007FFAD9BC0000-0x00007FFADA681000-memory.dmp

Filesize
10.8MB

Download
memory/3708-268-0x00007FFAD9BC0000-0x00007FFADA681000-memory.dmp

Filesize
10.8MB

Download
memory/3708-262-0x0000000000000000-mapping.dmp

Download
memory/3916-224-0x0000000000000000-mapping.dmp

Download
memory/3992-213-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/3992-180-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/3992-156-0x0000000000000000-mapping.dmp

Download
memory/4060-169-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4060-152-0x0000000000000000-mapping.dmp

Download
memory/4060-206-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4140-269-0x0000000000000000-mapping.dmp

Download
memory/4140-271-0x00007FFAD9BC0000-0x00007FFADA681000-memory.dmp

Filesize
10.8MB

Download
memory/4140-275-0x00007FFAD9BC0000-0x00007FFADA681000-memory.dmp

Filesize
10.8MB

Download
memory/4188-265-0x0000000000000000-mapping.dmp

Download
memory/4308-173-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4308-212-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4308-157-0x0000000000000000-mapping.dmp

Download
memory/4408-246-0x0000000000000000-mapping.dmp

Download
memory/4488-203-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4488-150-0x0000000000000000-mapping.dmp

Download
memory/4488-168-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4516-201-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4516-154-0x0000000000000000-mapping.dmp

Download
memory/4516-172-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4664-148-0x0000000000000000-mapping.dmp

Download
memory/4664-178-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4664-200-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4884-251-0x0000000000000000-mapping.dmp

Download
memory/4944-247-0x00007FFAD9B10000-0x00007FFADA5D1000-memory.dmp

Filesize
10.8MB

Download
memory/4944-243-0x00007FFAD9B10000-0x00007FFADA5D1000-memory.dmp

Filesize
10.8MB

Download
memory/4944-241-0x0000000000000000-mapping.dmp

Download
memory/5004-162-0x0000000000000000-mapping.dmp

Download
memory/5088-145-0x0000000000000000-mapping.dmp

Download
memory/5088-163-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/5088-198-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/5108-141-0x0000000000000000-mapping.dmp

Download
memory/5108-166-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/5108-193-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download