dcrat | 81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exe
Size

1.3MB
MD5

5ea9e2accea28d13b4799740edb521b9
SHA1

96f2f3ae06ad161b3a1afaae60c40b163d45b3a7
SHA256

81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7
SHA512

a067beb564ff9950a3a24786507f139ef9e33680b1f39f755580de34661e8dec02e7ddf351e6c0180c4ab6930c1b96d0eec5d24f96776aeed36c450258a1adc9
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	4460	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	4460	schtasks.exe

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral1/memory/2772-139-0x0000000000BA0000-0x0000000000CB0000-memory.dmp	dcrat
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	dcrat
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	dcrat
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	dcrat
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	dcrat
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	dcrat
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	dcrat
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	dcrat
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	dcrat
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	dcrat
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	dcrat

Executes dropped EXE 10 IoCs

Processes:

DllCommonsvc.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exe

pid	process
2772	DllCommonsvc.exe
1780	taskhostw.exe
6020	taskhostw.exe
4236	taskhostw.exe
5148	taskhostw.exe
1496	taskhostw.exe
4768	taskhostw.exe
2456	taskhostw.exe
3148	taskhostw.exe
5384	taskhostw.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exetaskhostw.exetaskhostw.exetaskhostw.exeWScript.exeDllCommonsvc.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 13 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Portable Devices\dllhost.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\MSBuild\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\Registry.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\ee2ad38f3d4382	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\smss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\5940a34987c991	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\upfc.exe	DllCommonsvc.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ea1d8f6d871115	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4348	schtasks.exe
4400	schtasks.exe
4608	schtasks.exe
4480	schtasks.exe
2844	schtasks.exe
4556	schtasks.exe
4196	schtasks.exe
4040	schtasks.exe
2176	schtasks.exe
4260	schtasks.exe
3616	schtasks.exe
4384	schtasks.exe
2320	schtasks.exe
3476	schtasks.exe
1212	schtasks.exe
1228	schtasks.exe
1396	schtasks.exe
4884	schtasks.exe
3820	schtasks.exe
3772	schtasks.exe
3608	schtasks.exe
2472	schtasks.exe
4368	schtasks.exe
4140	schtasks.exe
4660	schtasks.exe
1700	schtasks.exe
3256	schtasks.exe
5056	schtasks.exe
5080	schtasks.exe
3500	schtasks.exe
4024	schtasks.exe
3216	schtasks.exe
3416	schtasks.exe
3172	schtasks.exe
3652	schtasks.exe
4940	schtasks.exe
1788	schtasks.exe
4520	schtasks.exe
1368	schtasks.exe
376	schtasks.exe
1816	schtasks.exe
2076	schtasks.exe
1500	schtasks.exe
4172	schtasks.exe
3668	schtasks.exe

Modifies registry class 10 IoCs

Processes:

taskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exe81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exetaskhostw.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	taskhostw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetaskhostw.exe

pid	process
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
2772	DllCommonsvc.exe
5072	powershell.exe
5072	powershell.exe
2460	powershell.exe
2460	powershell.exe
4356	powershell.exe
4356	powershell.exe
4872	powershell.exe
4872	powershell.exe
3464	powershell.exe
3464	powershell.exe
2172	powershell.exe
2172	powershell.exe
4676	powershell.exe
4676	powershell.exe
4708	powershell.exe
4708	powershell.exe
4796	powershell.exe
4796	powershell.exe
3136	powershell.exe
3136	powershell.exe
1032	powershell.exe
1032	powershell.exe
792	powershell.exe
792	powershell.exe
4864	powershell.exe
4864	powershell.exe
4344	powershell.exe
4344	powershell.exe
4280	powershell.exe
4280	powershell.exe
1700	powershell.exe
1700	powershell.exe
1780	taskhostw.exe
1780	taskhostw.exe
5072	powershell.exe
5072	powershell.exe
2460	powershell.exe
2460	powershell.exe
4356	powershell.exe
4356	powershell.exe
1700	powershell.exe
2172	powershell.exe
2172	powershell.exe
4872	powershell.exe
4872	powershell.exe
4676	powershell.exe
4676	powershell.exe
3464	powershell.exe
3464	powershell.exe
4708	powershell.exe
4796	powershell.exe
1032	powershell.exe
3136	powershell.exe
792	powershell.exe
4864	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2772	DllCommonsvc.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	1780	taskhostw.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	6020	taskhostw.exe
Token: SeDebugPrivilege	4236	taskhostw.exe
Token: SeDebugPrivilege	5148	taskhostw.exe
Token: SeDebugPrivilege	1496	taskhostw.exe
Token: SeDebugPrivilege	4768	taskhostw.exe
Token: SeDebugPrivilege	2456	taskhostw.exe
Token: SeDebugPrivilege	3148	taskhostw.exe
Token: SeDebugPrivilege	5384	taskhostw.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exeWScript.execmd.exeDllCommonsvc.exetaskhostw.execmd.exetaskhostw.execmd.exetaskhostw.execmd.exetaskhostw.execmd.exe

description	pid	process	target process
PID 448 wrote to memory of 4776	448	81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exe	WScript.exe
PID 448 wrote to memory of 4776	448	81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exe	WScript.exe
PID 448 wrote to memory of 4776	448	81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exe	WScript.exe
PID 4776 wrote to memory of 4060	4776	WScript.exe	cmd.exe
PID 4776 wrote to memory of 4060	4776	WScript.exe	cmd.exe
PID 4776 wrote to memory of 4060	4776	WScript.exe	cmd.exe
PID 4060 wrote to memory of 2772	4060	cmd.exe	DllCommonsvc.exe
PID 4060 wrote to memory of 2772	4060	cmd.exe	DllCommonsvc.exe
PID 2772 wrote to memory of 5072	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 5072	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 2460	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 2460	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4356	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4356	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 3464	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 3464	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4872	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4872	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 2172	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 2172	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4676	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4676	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4708	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4708	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4796	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4796	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 3136	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 3136	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 792	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 792	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4864	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4864	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 1032	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 1032	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4344	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4344	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 1700	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 1700	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4280	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 4280	2772	DllCommonsvc.exe	powershell.exe
PID 2772 wrote to memory of 1780	2772	DllCommonsvc.exe	taskhostw.exe
PID 2772 wrote to memory of 1780	2772	DllCommonsvc.exe	taskhostw.exe
PID 1780 wrote to memory of 5920	1780	taskhostw.exe	cmd.exe
PID 1780 wrote to memory of 5920	1780	taskhostw.exe	cmd.exe
PID 5920 wrote to memory of 5984	5920	cmd.exe	w32tm.exe
PID 5920 wrote to memory of 5984	5920	cmd.exe	w32tm.exe
PID 5920 wrote to memory of 6020	5920	cmd.exe	taskhostw.exe
PID 5920 wrote to memory of 6020	5920	cmd.exe	taskhostw.exe
PID 6020 wrote to memory of 6132	6020	taskhostw.exe	cmd.exe
PID 6020 wrote to memory of 6132	6020	taskhostw.exe	cmd.exe
PID 6132 wrote to memory of 3436	6132	cmd.exe	w32tm.exe
PID 6132 wrote to memory of 3436	6132	cmd.exe	w32tm.exe
PID 6132 wrote to memory of 4236	6132	cmd.exe	taskhostw.exe
PID 6132 wrote to memory of 4236	6132	cmd.exe	taskhostw.exe
PID 4236 wrote to memory of 5472	4236	taskhostw.exe	cmd.exe
PID 4236 wrote to memory of 5472	4236	taskhostw.exe	cmd.exe
PID 5472 wrote to memory of 1940	5472	cmd.exe	w32tm.exe
PID 5472 wrote to memory of 1940	5472	cmd.exe	w32tm.exe
PID 5472 wrote to memory of 5148	5472	cmd.exe	taskhostw.exe
PID 5472 wrote to memory of 5148	5472	cmd.exe	taskhostw.exe
PID 5148 wrote to memory of 1692	5148	taskhostw.exe	cmd.exe
PID 5148 wrote to memory of 1692	5148	taskhostw.exe	cmd.exe
PID 1692 wrote to memory of 4408	1692	cmd.exe	w32tm.exe
PID 1692 wrote to memory of 4408	1692	cmd.exe	w32tm.exe

C:\Users\Admin\AppData\Local\Temp\81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exe
"C:\Users\Admin\AppData\Local\Temp\81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:448

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:4060

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dwm.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\explorer.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\RuntimeBroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sihost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\upfc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\smss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\Registry.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\spoolsv.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WSSqGJyhfL.bat"
6⤵
- Suspicious use of WriteProcessMemory
PID:5920

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:5984

C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat"
8⤵
- Suspicious use of WriteProcessMemory
PID:6132

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:3436

C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe"
9⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat"
10⤵
- Suspicious use of WriteProcessMemory
PID:5472

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
11⤵
PID:1940

C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe"
11⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5148

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat"
12⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
13⤵
PID:4408

C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe"
13⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UWQnaEvoMY.bat"
14⤵
PID:2460

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
15⤵
PID:4744

C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe"
15⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TfYr4aOzGb.bat"
16⤵
PID:4000

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
17⤵
PID:1268

C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe"
17⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WSSqGJyhfL.bat"
18⤵
PID:5272

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
19⤵
PID:4908

C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe"
19⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat"
20⤵
PID:4372

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
21⤵
PID:2328

C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe"
21⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\38MS6cfT7h.bat"
22⤵
PID:3608

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
23⤵
PID:5516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\odt\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\providercommon\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\odt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\odt\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\taskhostw.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log
Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
28d4235aa2e6d782751f980ceb6e5021

SHA1
f5d82d56acd642b9fc4b963f684fd6b78f25a140

SHA256
8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

SHA512
dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
28d4235aa2e6d782751f980ceb6e5021

SHA1
f5d82d56acd642b9fc4b963f684fd6b78f25a140

SHA256
8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

SHA512
dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Temp\38MS6cfT7h.bat
Filesize
231B

MD5
30eaf1b7128f33b1f04711f03d29500f

SHA1
071abd4e5697792298d7cdb87ae31ccd5e6f9ce5

SHA256
62b98f53143d956e319810ce157cde4dc8ad7ecc6177ac166a9b6fff69051012

SHA512
210ce455c3e5dd9d07779fef95b25fec544fd91166a3626a1acc4d589b1c61a037b71839a60c2b77fce21890adb5dedca4dcbaf54bcee02dd8671ddb918d0277

Download Submit
C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat
Filesize
231B

MD5
1285594c8f2c95e8ed18fdf58625071e

SHA1
0fa520f32ba3f27e5f647a0e5c60b5d134f753ac

SHA256
70d0908e116cbe0091b40a6ed9fdbcfc217d1beac74add1783211f1f0a66a556

SHA512
67577ed3210f1929d2bf59a87e37cf906c681e4e57f2a1f285c47a514971b3289505e6b73399c4dd0cdabd18dd7db9f2fcb8cfc4a338e481e120fc6227803383

Download Submit
C:\Users\Admin\AppData\Local\Temp\TfYr4aOzGb.bat
Filesize
231B

MD5
bc66e7e6ec42bc50b939ef2a6c22a9ef

SHA1
84f4a5c36249fa845af3f50403ab1d125d29f872

SHA256
dd492516a7d25dc8b8a71ba7c53d3c65405b6169999a7eb8e344530236724aa3

SHA512
645e54c4109489b800615aa8d83d6dc5fbc8d12c59ea2795ea3b5a6348a974ecd4079b9f17aa0059973e56b3d372b3d15635bcde8f9a5a98f9b1be7cb6dd37d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\UWQnaEvoMY.bat
Filesize
231B

MD5
28035560913cf020a6d42a0bf9f31b57

SHA1
6eb66815bbc2b3dc33d360d09cefe4a21a74c1fd

SHA256
bf41986d5215b458f71a67d3b24671e29681b74743b651962820dfdaeda4978f

SHA512
269c1a7b3335c7f74511064857d52332e518ffea06a5c8e62f7deb9d25d6353a8e5014147c3b7640ddf5ad00ecbf038821d5b2d2c6a3184157315980193c0324

Download Submit
C:\Users\Admin\AppData\Local\Temp\WM6x9zCNT5.bat
Filesize
231B

MD5
4e0d461d73cedfe3038df00b097375d5

SHA1
de4000de71bb22e4e270af581e673c19debf34cf

SHA256
3495a9e49ba66adc491c5aaafb6ddb6353aa3f6afb55680d38fa72146087dd5b

SHA512
ded5de13f5fa91c3ad42b5630a5a329e6bf4334614778aa0dbe821f4e47d33ce03a98b74ab1f4bc24525974fea1ecd3d5e41f48527254212ae5bfd8a8a3b7ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WSSqGJyhfL.bat
Filesize
231B

MD5
837dc15b93bafbc9ea56209c51ba1010

SHA1
bac0c80d7063b66b2a923d366aab3a001acea65f

SHA256
98e9bc1556a0124aec5af80e618753f6cec0adc6a98b45b50a28dd17e05460b4

SHA512
f4f8ab790447083c6cdc48e59ef20362d774fe2c2a483837b1bb0fb3d1fdb71e6d187991971f35ce3bab1fb36a2a80d43f7da56eef07a0525e2cced6975ef1e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\WSSqGJyhfL.bat
Filesize
231B

MD5
837dc15b93bafbc9ea56209c51ba1010

SHA1
bac0c80d7063b66b2a923d366aab3a001acea65f

SHA256
98e9bc1556a0124aec5af80e618753f6cec0adc6a98b45b50a28dd17e05460b4

SHA512
f4f8ab790447083c6cdc48e59ef20362d774fe2c2a483837b1bb0fb3d1fdb71e6d187991971f35ce3bab1fb36a2a80d43f7da56eef07a0525e2cced6975ef1e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nAABNdhKLs.bat
Filesize
231B

MD5
07bb233e3d4a9f8f950917bd1819fee4

SHA1
e9375c3a617edc8f7b838f26c89999cbd44647c9

SHA256
28e8fb9305de40db7162a238b13102cd1fcb958d74dd6eb13b3ce1cfc404db63

SHA512
19d7ac08fbb5f4fac7fca3b4d37cbc623f3916bcb490d9e7f33d698359d92338f1896220febbd6a786f9cf853ca3e751eb6fcf103a89e4bc94023c0e1c8cb163

Download Submit
C:\Users\Admin\AppData\Local\Temp\tDjG3X7WPV.bat
Filesize
231B

MD5
a145dd30fbc887fa58a0733518383aeb

SHA1
d884b39511682245cf90964f52603eed14526cdd

SHA256
f261928662de51631ac619ae523d5dd78a38041b513c10932fb2d4a120be1cd6

SHA512
03c0de0b776475313ccda5e2e34961c7f261e8875af6caa88bc73a5d2ad52664b69d295d390e8ff2d71957a856c3eb39ddafe114b3010c11f55b81da7c741c8c

Download Submit
C:\providercommon\1zu9dW.bat
Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/792-202-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/792-170-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/792-151-0x0000000000000000-mapping.dmp

Download
memory/1032-203-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/1032-171-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/1032-153-0x0000000000000000-mapping.dmp

Download
memory/1268-249-0x0000000000000000-mapping.dmp

Download
memory/1496-237-0x0000000000000000-mapping.dmp

Download
memory/1496-243-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/1496-239-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/1692-233-0x0000000000000000-mapping.dmp

Download
memory/1700-178-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/1700-191-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/1700-155-0x0000000000000000-mapping.dmp

Download
memory/1780-160-0x0000000000000000-mapping.dmp

Download
memory/1780-212-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/1780-173-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/1940-228-0x0000000000000000-mapping.dmp

Download
memory/2172-146-0x0000000000000000-mapping.dmp

Download
memory/2172-193-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/2172-167-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/2328-263-0x0000000000000000-mapping.dmp

Download
memory/2456-253-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/2456-257-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/2456-251-0x0000000000000000-mapping.dmp

Download
memory/2460-240-0x0000000000000000-mapping.dmp

Download
memory/2460-142-0x0000000000000000-mapping.dmp

Download
memory/2460-184-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/2460-159-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/2772-164-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/2772-139-0x0000000000BA0000-0x0000000000CB0000-memory.dmp

Filesize
1.1MB

Download
memory/2772-136-0x0000000000000000-mapping.dmp

Download
memory/2772-140-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/3136-150-0x0000000000000000-mapping.dmp

Download
memory/3136-204-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/3136-176-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/3148-258-0x0000000000000000-mapping.dmp

Download
memory/3148-264-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/3148-260-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/3436-221-0x0000000000000000-mapping.dmp

Download
memory/3464-144-0x0000000000000000-mapping.dmp

Download
memory/3464-166-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/3464-199-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/3608-268-0x0000000000000000-mapping.dmp

Download
memory/4000-247-0x0000000000000000-mapping.dmp

Download
memory/4060-135-0x0000000000000000-mapping.dmp

Download
memory/4236-223-0x0000000000000000-mapping.dmp

Download
memory/4236-229-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4236-225-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4280-157-0x0000000000000000-mapping.dmp

Download
memory/4280-210-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4280-174-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4344-154-0x0000000000000000-mapping.dmp

Download
memory/4344-172-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4344-209-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4356-143-0x0000000000000000-mapping.dmp

Download
memory/4356-165-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4356-181-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4372-261-0x0000000000000000-mapping.dmp

Download
memory/4408-235-0x0000000000000000-mapping.dmp

Download
memory/4676-168-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4676-192-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4676-147-0x0000000000000000-mapping.dmp

Download
memory/4708-175-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4708-197-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4708-148-0x0000000000000000-mapping.dmp

Download
memory/4744-242-0x0000000000000000-mapping.dmp

Download
memory/4768-250-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4768-244-0x0000000000000000-mapping.dmp

Download
memory/4768-246-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4776-132-0x0000000000000000-mapping.dmp

Download
memory/4796-149-0x0000000000000000-mapping.dmp

Download
memory/4796-169-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4796-196-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4864-152-0x0000000000000000-mapping.dmp

Download
memory/4864-206-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4864-177-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4872-145-0x0000000000000000-mapping.dmp

Download
memory/4872-189-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4872-161-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/4908-256-0x0000000000000000-mapping.dmp

Download
memory/5072-141-0x0000000000000000-mapping.dmp

Download
memory/5072-156-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/5072-183-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/5072-158-0x000001A27FE30000-0x000001A27FE52000-memory.dmp

Filesize
136KB

Download
memory/5148-232-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/5148-236-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/5148-230-0x0000000000000000-mapping.dmp

Download
memory/5272-254-0x0000000000000000-mapping.dmp

Download
memory/5384-271-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/5384-265-0x0000000000000000-mapping.dmp

Download
memory/5384-267-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/5472-226-0x0000000000000000-mapping.dmp

Download
memory/5516-270-0x0000000000000000-mapping.dmp

Download
memory/5920-211-0x0000000000000000-mapping.dmp

Download
memory/5984-214-0x0000000000000000-mapping.dmp

Download
memory/6020-222-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/6020-215-0x0000000000000000-mapping.dmp

Download
memory/6020-218-0x00007FFC42D80000-0x00007FFC43841000-memory.dmp

Filesize
10.8MB

Download
memory/6132-219-0x0000000000000000-mapping.dmp

Download