dcrat | 90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exe
Size

1.3MB
MD5

fb1d95832c729062efbd85c63670d637
SHA1

064b5692e2b08b209aa08975248891814de4c9f5
SHA256

90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef
SHA512

cf2025467b0bac100e5802fccc3fdb47688db22fedc2e27d9b8c3ce1500e0355c4548d728638feecd08265533a294e42b6f2c50b65cec53497a7be8e1ee40318
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	2336	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	2336	schtasks.exe

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral1/memory/1464-139-0x0000000000340000-0x0000000000450000-memory.dmp	dcrat
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	dcrat
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	dcrat
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	dcrat
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	dcrat
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	dcrat
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	dcrat
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	dcrat
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	dcrat
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	dcrat
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	dcrat

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

StartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exe90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeWScript.exeDllCommonsvc.exeStartMenuExperienceHost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe

Executes dropped EXE 10 IoCs

Processes:

DllCommonsvc.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exe

pid	process
1464	DllCommonsvc.exe
3548	StartMenuExperienceHost.exe
4660	StartMenuExperienceHost.exe
2748	StartMenuExperienceHost.exe
2872	StartMenuExperienceHost.exe
2408	StartMenuExperienceHost.exe
4072	StartMenuExperienceHost.exe
3548	StartMenuExperienceHost.exe
736	StartMenuExperienceHost.exe
3720	StartMenuExperienceHost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 14 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files\Windows NT\TableTextService\en-US\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\55b276f4edf653	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Google\Chrome\Application\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files\Java\jre1.8.0_66\66fc9ff0ee96c2	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\e1ef82546f0b02	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\images\eddb19405b7ce1	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\images\backgroundTaskHost.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jre1.8.0_66\sihost.exe	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\Vss\Writers\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\Vss\Writers\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\it-IT\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Windows\it-IT\55b276f4edf653	DllCommonsvc.exe
File created	C:\Windows\Help\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\Help\7a0fd90576e088	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
3656	schtasks.exe
2080	schtasks.exe
4396	schtasks.exe
3688	schtasks.exe
3108	schtasks.exe
544	schtasks.exe
4260	schtasks.exe
224	schtasks.exe
4528	schtasks.exe
1316	schtasks.exe
2872	schtasks.exe
4588	schtasks.exe
2264	schtasks.exe
3584	schtasks.exe
3548	schtasks.exe
5080	schtasks.exe
3396	schtasks.exe
968	schtasks.exe
3660	schtasks.exe
3612	schtasks.exe
4328	schtasks.exe
5100	schtasks.exe
3576	schtasks.exe
3348	schtasks.exe
3176	schtasks.exe
1048	schtasks.exe
2136	schtasks.exe
2968	schtasks.exe
1696	schtasks.exe
2328	schtasks.exe
2504	schtasks.exe
4600	schtasks.exe
3352	schtasks.exe
4080	schtasks.exe
2228	schtasks.exe
2644	schtasks.exe
1808	schtasks.exe
2568	schtasks.exe
3588	schtasks.exe
2072	schtasks.exe
4548	schtasks.exe
2736	schtasks.exe
1532	schtasks.exe
4616	schtasks.exe
4648	schtasks.exe

Modifies registry class 11 IoCs

Processes:

90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeDllCommonsvc.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pid	process
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
1464	DllCommonsvc.exe
3424	powershell.exe
3424	powershell.exe
4312	powershell.exe
4312	powershell.exe
1944	powershell.exe
1944	powershell.exe
2212	powershell.exe
2212	powershell.exe
1644	powershell.exe
1644	powershell.exe
4036	powershell.exe
4036	powershell.exe
328	powershell.exe
328	powershell.exe
4636	powershell.exe
4636	powershell.exe
2380	powershell.exe
2380	powershell.exe
3844	powershell.exe
3844	powershell.exe
2152	powershell.exe
2152	powershell.exe
476	powershell.exe
476	powershell.exe
4860	powershell.exe
4860	powershell.exe
3960	powershell.exe
3960	powershell.exe
1420	powershell.exe
1420	powershell.exe
2116	powershell.exe
2116	powershell.exe
4312	powershell.exe
4312	powershell.exe
3424	powershell.exe
3424	powershell.exe
2212	powershell.exe
2212	powershell.exe
1644	powershell.exe
1644	powershell.exe
1944	powershell.exe
1944	powershell.exe
328	powershell.exe
4036	powershell.exe
2380	powershell.exe
3844	powershell.exe
4636	powershell.exe
2152	powershell.exe
3960	powershell.exe
1420	powershell.exe
4860	powershell.exe
476	powershell.exe
2116	powershell.exe
3548	StartMenuExperienceHost.exe
4660	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exe

description	pid	process
Token: SeDebugPrivilege	1464	DllCommonsvc.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	328	powershell.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	476	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	3548	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4660	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2748	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2872	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2408	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4072	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3548	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	736	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3720	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exeWScript.execmd.exeDllCommonsvc.execmd.exeStartMenuExperienceHost.execmd.exeStartMenuExperienceHost.execmd.exeStartMenuExperienceHost.execmd.exe

description	pid	process	target process
PID 1536 wrote to memory of 4416	1536	90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exe	WScript.exe
PID 1536 wrote to memory of 4416	1536	90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exe	WScript.exe
PID 1536 wrote to memory of 4416	1536	90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exe	WScript.exe
PID 4416 wrote to memory of 3308	4416	WScript.exe	cmd.exe
PID 4416 wrote to memory of 3308	4416	WScript.exe	cmd.exe
PID 4416 wrote to memory of 3308	4416	WScript.exe	cmd.exe
PID 3308 wrote to memory of 1464	3308	cmd.exe	DllCommonsvc.exe
PID 3308 wrote to memory of 1464	3308	cmd.exe	DllCommonsvc.exe
PID 1464 wrote to memory of 4312	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 4312	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 3424	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 3424	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 2212	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 2212	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 4036	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 4036	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 1944	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 1944	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 1644	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 1644	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 2380	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 2380	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 4636	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 4636	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 328	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 328	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 3844	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 3844	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 476	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 476	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 4860	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 4860	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 2152	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 2152	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 3960	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 3960	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 1420	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 1420	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 2116	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 2116	1464	DllCommonsvc.exe	powershell.exe
PID 1464 wrote to memory of 4080	1464	DllCommonsvc.exe	cmd.exe
PID 1464 wrote to memory of 4080	1464	DllCommonsvc.exe	cmd.exe
PID 4080 wrote to memory of 4008	4080	cmd.exe	w32tm.exe
PID 4080 wrote to memory of 4008	4080	cmd.exe	w32tm.exe
PID 4080 wrote to memory of 3548	4080	cmd.exe	StartMenuExperienceHost.exe
PID 4080 wrote to memory of 3548	4080	cmd.exe	StartMenuExperienceHost.exe
PID 3548 wrote to memory of 4292	3548	StartMenuExperienceHost.exe	cmd.exe
PID 3548 wrote to memory of 4292	3548	StartMenuExperienceHost.exe	cmd.exe
PID 4292 wrote to memory of 756	4292	cmd.exe	w32tm.exe
PID 4292 wrote to memory of 756	4292	cmd.exe	w32tm.exe
PID 4292 wrote to memory of 4660	4292	cmd.exe	StartMenuExperienceHost.exe
PID 4292 wrote to memory of 4660	4292	cmd.exe	StartMenuExperienceHost.exe
PID 4660 wrote to memory of 4784	4660	StartMenuExperienceHost.exe	cmd.exe
PID 4660 wrote to memory of 4784	4660	StartMenuExperienceHost.exe	cmd.exe
PID 4784 wrote to memory of 5036	4784	cmd.exe	w32tm.exe
PID 4784 wrote to memory of 5036	4784	cmd.exe	w32tm.exe
PID 4784 wrote to memory of 2748	4784	cmd.exe	StartMenuExperienceHost.exe
PID 4784 wrote to memory of 2748	4784	cmd.exe	StartMenuExperienceHost.exe
PID 2748 wrote to memory of 5004	2748	StartMenuExperienceHost.exe	cmd.exe
PID 2748 wrote to memory of 5004	2748	StartMenuExperienceHost.exe	cmd.exe
PID 5004 wrote to memory of 4952	5004	cmd.exe	w32tm.exe
PID 5004 wrote to memory of 4952	5004	cmd.exe	w32tm.exe
PID 5004 wrote to memory of 2872	5004	cmd.exe	StartMenuExperienceHost.exe
PID 5004 wrote to memory of 2872	5004	cmd.exe	StartMenuExperienceHost.exe

C:\Users\Admin\AppData\Local\Temp\90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exe
"C:\Users\Admin\AppData\Local\Temp\90437514fe93297ded6a550bcfc41ca7a8e8581a2654f981613b3f220e8f21ef.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:3308

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\explorer.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Oracle\Java\installcache_x64\lsass.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\conhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\en-US\explorer.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\RuntimeBroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\StartMenuExperienceHost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Start Menu\winlogon.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\backgroundTaskHost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\images\backgroundTaskHost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\fontdrvhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\fontdrvhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre1.8.0_66\sihost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xx1rvPQXwC.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2zdeBu3xOP.bat"
7⤵
- Suspicious use of WriteProcessMemory
PID:4292

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe"
8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z3bbUpz34c.bat"
9⤵
- Suspicious use of WriteProcessMemory
PID:4784

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
10⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe"
10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BfyeXCadxk.bat"
11⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
12⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe"
12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p8yPRkR6MR.bat"
13⤵
PID:3100

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
14⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe"
14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5mXdMdden9.bat"
15⤵
PID:4544

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
16⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe"
16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lHuJ4aKJis.bat"
17⤵
PID:3672

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
18⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe"
18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Dk8ljd7jBY.bat"
19⤵
PID:756

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
20⤵
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe"
20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JeZnuB4iL9.bat"
21⤵
PID:3784

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
22⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe"
22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Dk8ljd7jBY.bat"
23⤵
PID:3632

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
24⤵
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\Help\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Help\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Oracle\Java\installcache_x64\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\Java\installcache_x64\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Oracle\Java\installcache_x64\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\Vss\Writers\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\Vss\Writers\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\it-IT\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\it-IT\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Windows\it-IT\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Start Menu\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Start Menu\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\odt\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\images\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\Application\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre1.8.0_66\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Java\jre1.8.0_66\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jre1.8.0_66\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\StartMenuExperienceHost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2zdeBu3xOP.bat

Filesize
277B

MD5
7845703e6fd1f0cb758d70de1976fa5a

SHA1
829af71c7eb8223bf174084d5aa889c690f784a4

SHA256
7b180e4ed251ca00c27776e5cc4b09f5a08de4f03f3ce0468cdd23bc98a62f4a

SHA512
257dec824eeda1a0145d81cb787037686fdd8c4e61863a6923c6685718f2dbe5efeda99748d2686574577924afbc1ff27f08dbce498c5c4f440e41446ce619ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\5mXdMdden9.bat

Filesize
277B

MD5
67fc0e7c1c035948c97b87bc22536d82

SHA1
a8a2aea953de8088dd8f871c98da24c36f096436

SHA256
fbbfce269266b91b33d7faeb522698e9a755bafc64eba5a8c5bc1089d7373ef1

SHA512
a11afbf0a375e0145f956bea926945965a72586071bc4a4b4d0d219b8d7491bb363ed394a311864f6377303c7b317106e3838fc88c7ab274e6dd32166fc85dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\BfyeXCadxk.bat

Filesize
277B

MD5
5a6df22a3de617429659a36cd50e8f3e

SHA1
8563fecac692357a8c2a8b69446a0cc772049d23

SHA256
9944643a5d71b6bd1c7120dce101f00c4bb1f7a73ac169ed9061d353438134ac

SHA512
61e459e25bdfb08577d221549838309cb2c31846008d66cbe01189386410ec06f39b4d5c071e30b68405dfe74ab4e78565ebe787bf18a9551ff2aa0c247ccf1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dk8ljd7jBY.bat

Filesize
277B

MD5
4081ab5f3b43ba79f5df03ee760dff6f

SHA1
07ccb6cfc316f035908af7ca1a97c7ff71476833

SHA256
bb8fd77e8d6883f6ee7d1333fd605cc07bede149826363a27bae8a15aa669919

SHA512
97463129c1fd8175c19272393cc88947b4e4cef1adf846fe0b19a4b00028e26d66d13d751fc0095f4f47783e365fdc337c15c4405210dad2859050744629f4af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dk8ljd7jBY.bat

Filesize
277B

MD5
4081ab5f3b43ba79f5df03ee760dff6f

SHA1
07ccb6cfc316f035908af7ca1a97c7ff71476833

SHA256
bb8fd77e8d6883f6ee7d1333fd605cc07bede149826363a27bae8a15aa669919

SHA512
97463129c1fd8175c19272393cc88947b4e4cef1adf846fe0b19a4b00028e26d66d13d751fc0095f4f47783e365fdc337c15c4405210dad2859050744629f4af

Download Submit
C:\Users\Admin\AppData\Local\Temp\JeZnuB4iL9.bat

Filesize
277B

MD5
433f5c17827623c60842347916f9ce99

SHA1
93d45c7be2c94bbc0481f5596895c2461c2219c2

SHA256
d94dfd99887c2c658547434b5b9f57324af6f0f76c6fdb4cbf0d851f8bc85aab

SHA512
a56bfbdbca97e95e28d51f3a32a6c385c33b922832ca5b730f357e44715087d84874928e1d75dbf929ebe33e51c67f855ef6213602d3dd2d17584126210b7930

Download Submit
C:\Users\Admin\AppData\Local\Temp\lHuJ4aKJis.bat

Filesize
277B

MD5
9be74351576b6d268ae236277db8a7f3

SHA1
743bc3c7a61f82153176a98363cec818f542ef58

SHA256
8bdd907c1c65276898412a7a08ab237877bb13f8fc4fb8821e12f8bd081b72a8

SHA512
7201f6295010b0a032ec639adcf93d37e763db9094b24552c48dc41fedb9b0793a5e33063ee3a9b8c4721e9b41a4bbfbe9090fbca1da699c70e807f1816a860a

Download Submit
C:\Users\Admin\AppData\Local\Temp\p8yPRkR6MR.bat

Filesize
277B

MD5
af015d0bfc53d0d2da8f70652c03ba4a

SHA1
b928fd090b34c41552ff541c8210bf43ad6f2ec3

SHA256
7177c70afad154de7997ceb118bfb83ae1d4768b4a881966bde9b12fbdf6a050

SHA512
69918bc82274a16709f8a1474514224cdb6d797929459b7a922fb6b2a1c355e69b61ae8e93dd726fb2c7e21a0a8e21ec1bf22e5d2040b8c6d4fbc2eb4932dbc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\xx1rvPQXwC.bat

Filesize
277B

MD5
4d2c3e48263e7790b7a4cc59aae295a5

SHA1
07b745aa81b3b9934fed54b7684f1c8cff8f7f26

SHA256
470250c51e1e7a0bcf339b5d1844b7294404cd864d8694d97ec00b1d87a95381

SHA512
b6e55fab5288d45337e65d834162e49299f5210a37b2500c6db3b06c4b318f43e63e476027c3ec42f5ae70dd9b50b7bc0082a2b7d894e5af10b5f9736a07400e

Download Submit
C:\Users\Admin\AppData\Local\Temp\z3bbUpz34c.bat

Filesize
277B

MD5
921af56e917806debf507c70d2bf6297

SHA1
6893960d63e67d2fe3e3c7f579158373b1a4be31

SHA256
82549071e4e58b8b153c9c4439fab797b5c69631474545369e93f492d87231ae

SHA512
70b901837362cfeb50d371fdea1d6c177e6ba91e65367eb285b2135f4292c8be04639ce75a03cb655c6c37b9f054518d3612ac43ca6a49944e9a2323aeec74ed

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/328-183-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/328-170-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/328-149-0x0000000000000000-mapping.dmp

Download
memory/476-173-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/476-151-0x0000000000000000-mapping.dmp

Download
memory/476-206-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/736-263-0x00007FFED9B60000-0x00007FFEDA621000-memory.dmp

Filesize
10.8MB

Download
memory/736-267-0x00007FFED9B60000-0x00007FFEDA621000-memory.dmp

Filesize
10.8MB

Download
memory/736-261-0x0000000000000000-mapping.dmp

Download
memory/756-216-0x0000000000000000-mapping.dmp

Download
memory/756-257-0x0000000000000000-mapping.dmp

Download
memory/1288-273-0x0000000000000000-mapping.dmp

Download
memory/1420-205-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/1420-155-0x0000000000000000-mapping.dmp

Download
memory/1420-191-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/1464-139-0x0000000000340000-0x0000000000450000-memory.dmp

Filesize
1.1MB

Download
memory/1464-160-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/1464-136-0x0000000000000000-mapping.dmp

Download
memory/1464-140-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/1612-245-0x0000000000000000-mapping.dmp

Download
memory/1644-166-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/1644-189-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/1644-146-0x0000000000000000-mapping.dmp

Download
memory/1944-161-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/1944-145-0x0000000000000000-mapping.dmp

Download
memory/1944-184-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/2116-188-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/2116-156-0x0000000000000000-mapping.dmp

Download
memory/2116-208-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/2152-197-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/2152-153-0x0000000000000000-mapping.dmp

Download
memory/2152-172-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/2212-143-0x0000000000000000-mapping.dmp

Download
memory/2212-187-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/2212-164-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/2380-169-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/2380-147-0x0000000000000000-mapping.dmp

Download
memory/2380-195-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/2408-242-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/2408-246-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/2408-240-0x0000000000000000-mapping.dmp

Download
memory/2712-266-0x0000000000000000-mapping.dmp

Download
memory/2748-228-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/2748-226-0x0000000000000000-mapping.dmp

Download
memory/2748-232-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/2872-233-0x0000000000000000-mapping.dmp

Download
memory/2872-235-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/2872-239-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/3100-236-0x0000000000000000-mapping.dmp

Download
memory/3192-259-0x0000000000000000-mapping.dmp

Download
memory/3308-135-0x0000000000000000-mapping.dmp

Download
memory/3424-185-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/3424-162-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/3424-252-0x0000000000000000-mapping.dmp

Download
memory/3424-157-0x000002195D700000-0x000002195D722000-memory.dmp

Filesize
136KB

Download
memory/3424-142-0x0000000000000000-mapping.dmp

Download
memory/3548-256-0x00007FFED9B60000-0x00007FFEDA621000-memory.dmp

Filesize
10.8MB

Download
memory/3548-254-0x0000000000000000-mapping.dmp

Download
memory/3548-210-0x0000000000000000-mapping.dmp

Download
memory/3548-213-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/3548-260-0x00007FFED9B60000-0x00007FFEDA621000-memory.dmp

Filesize
10.8MB

Download
memory/3548-217-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/3632-271-0x0000000000000000-mapping.dmp

Download
memory/3672-250-0x0000000000000000-mapping.dmp

Download
memory/3720-274-0x00007FFED9B60000-0x00007FFEDA621000-memory.dmp

Filesize
10.8MB

Download
memory/3720-270-0x00007FFED9B60000-0x00007FFEDA621000-memory.dmp

Filesize
10.8MB

Download
memory/3720-268-0x0000000000000000-mapping.dmp

Download
memory/3784-264-0x0000000000000000-mapping.dmp

Download
memory/3844-171-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/3844-150-0x0000000000000000-mapping.dmp

Download
memory/3844-199-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/3960-204-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/3960-154-0x0000000000000000-mapping.dmp

Download
memory/3960-175-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/4008-168-0x0000000000000000-mapping.dmp

Download
memory/4036-190-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/4036-165-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/4036-144-0x0000000000000000-mapping.dmp

Download
memory/4072-247-0x0000000000000000-mapping.dmp

Download
memory/4072-249-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/4072-253-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/4080-158-0x0000000000000000-mapping.dmp

Download
memory/4292-214-0x0000000000000000-mapping.dmp

Download
memory/4312-159-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/4312-176-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/4312-141-0x0000000000000000-mapping.dmp

Download
memory/4416-132-0x0000000000000000-mapping.dmp

Download
memory/4544-243-0x0000000000000000-mapping.dmp

Download
memory/4636-167-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/4636-198-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/4636-148-0x0000000000000000-mapping.dmp

Download
memory/4660-221-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/4660-218-0x0000000000000000-mapping.dmp

Download
memory/4660-225-0x00007FFED97B0000-0x00007FFEDA271000-memory.dmp

Filesize
10.8MB

Download
memory/4784-222-0x0000000000000000-mapping.dmp

Download
memory/4816-238-0x0000000000000000-mapping.dmp

Download
memory/4860-152-0x0000000000000000-mapping.dmp

Download
memory/4860-209-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/4860-174-0x00007FFED97A0000-0x00007FFEDA261000-memory.dmp

Filesize
10.8MB

Download
memory/4952-231-0x0000000000000000-mapping.dmp

Download
memory/5004-229-0x0000000000000000-mapping.dmp

Download
memory/5036-224-0x0000000000000000-mapping.dmp

Download