dcrat | d0cf3fa264692d7506b8bc0218f35aa8d1f061826119bfc3df8243ba8fcb776d

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0cf3fa264692d7506b8bc0218f35aa8d1f061826119bfc3df8243ba8fcb776dN.exe
Size

1.3MB
MD5

b3de9c174771b39d49d63af31c8c24c0
SHA1

8d673fa53f1bc4c89434a20a2af6d6a873d82c19
SHA256

d0cf3fa264692d7506b8bc0218f35aa8d1f061826119bfc3df8243ba8fcb776d
SHA512

e3e78aae4253d160086d6175ba6929354c8593f42fdfc26f9b1962f94d21c2710926526983753153e6748d41c02bf669c8e31addf3717bc06f87b3ae8da7300e
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2412	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	2412	schtasks.exe	32

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000014510-9.dat	dcrat
behavioral1/memory/1448-13-0x0000000000AB0000-0x0000000000BC0000-memory.dmp	dcrat
behavioral1/memory/1544-153-0x0000000000190000-0x00000000002A0000-memory.dmp	dcrat
behavioral1/memory/1524-212-0x0000000000060000-0x0000000000170000-memory.dmp	dcrat
behavioral1/memory/2324-272-0x0000000001350000-0x0000000001460000-memory.dmp	dcrat
behavioral1/memory/2300-333-0x0000000000310000-0x0000000000420000-memory.dmp	dcrat
behavioral1/memory/1724-393-0x0000000000E60000-0x0000000000F70000-memory.dmp	dcrat
behavioral1/memory/2324-512-0x0000000000170000-0x0000000000280000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2032	powershell.exe
2508	powershell.exe
2952	powershell.exe
2892	powershell.exe
2960	powershell.exe
2564	powershell.exe
316	powershell.exe
2524	powershell.exe
2348	powershell.exe
2948	powershell.exe
2608	powershell.exe
2572	powershell.exe
320	powershell.exe
2596	powershell.exe
1532	powershell.exe
2568	powershell.exe
1680	powershell.exe
2140	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
1448	DllCommonsvc.exe
1544	services.exe
1524	services.exe
2324	services.exe
2300	services.exe
1724	services.exe
1856	services.exe
2324	services.exe

Loads dropped DLL 2 IoCs

pid	Process
2544	cmd.exe
2544	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\CrashReports\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\csrss.exe	DllCommonsvc.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\taskhost.exe	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\b75386f1303e64	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\services.exe	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\de-DE\smss.exe	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\DataStore\lsm.exe	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\fr-FR\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\de-DE\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\DataStore\101b941d020240	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\fr-FR\dllhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0cf3fa264692d7506b8bc0218f35aa8d1f061826119bfc3df8243ba8fcb776dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
768	schtasks.exe
1888	schtasks.exe
1712	schtasks.exe
1556	schtasks.exe
1976	schtasks.exe
2836	schtasks.exe
1704	schtasks.exe
2672	schtasks.exe
376	schtasks.exe
1568	schtasks.exe
2072	schtasks.exe
1428	schtasks.exe
2932	schtasks.exe
380	schtasks.exe
876	schtasks.exe
1316	schtasks.exe
3016	schtasks.exe
2904	schtasks.exe
820	schtasks.exe
2132	schtasks.exe
2764	schtasks.exe
1936	schtasks.exe
2280	schtasks.exe
1216	schtasks.exe
2128	schtasks.exe
2680	schtasks.exe
1200	schtasks.exe
2020	schtasks.exe
2992	schtasks.exe
2856	schtasks.exe
1592	schtasks.exe
1984	schtasks.exe
2964	schtasks.exe
1872	schtasks.exe
904	schtasks.exe
1436	schtasks.exe
1012	schtasks.exe
2684	schtasks.exe
2404	schtasks.exe
1192	schtasks.exe
2512	schtasks.exe
2252	schtasks.exe
2396	schtasks.exe
1500	schtasks.exe
2492	schtasks.exe
576	schtasks.exe
2816	schtasks.exe
2916	schtasks.exe
1248	schtasks.exe
3040	schtasks.exe
1452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1448	DllCommonsvc.exe
1532	powershell.exe
2568	powershell.exe
2948	powershell.exe
2952	powershell.exe
2892	powershell.exe
316	powershell.exe
2572	powershell.exe
2524	powershell.exe
2960	powershell.exe
2564	powershell.exe
2596	powershell.exe
2508	powershell.exe
2140	powershell.exe
2348	powershell.exe
2608	powershell.exe
1680	powershell.exe
2032	powershell.exe
320	powershell.exe
1544	services.exe
1524	services.exe
2324	services.exe
2300	services.exe
1724	services.exe
1856	services.exe
2324	services.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	DllCommonsvc.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	1544	services.exe
Token: SeDebugPrivilege	1524	services.exe
Token: SeDebugPrivilege	2324	services.exe
Token: SeDebugPrivilege	2300	services.exe
Token: SeDebugPrivilege	1724	services.exe
Token: SeDebugPrivilege	1856	services.exe
Token: SeDebugPrivilege	2324	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2524	2960	d0cf3fa264692d7506b8bc0218f35aa8d1f061826119bfc3df8243ba8fcb776dN.exe	28
PID 2960 wrote to memory of 2524	2960	d0cf3fa264692d7506b8bc0218f35aa8d1f061826119bfc3df8243ba8fcb776dN.exe	28
PID 2960 wrote to memory of 2524	2960	d0cf3fa264692d7506b8bc0218f35aa8d1f061826119bfc3df8243ba8fcb776dN.exe	28
PID 2960 wrote to memory of 2524	2960	d0cf3fa264692d7506b8bc0218f35aa8d1f061826119bfc3df8243ba8fcb776dN.exe	28
PID 2524 wrote to memory of 2544	2524	WScript.exe	29
PID 2524 wrote to memory of 2544	2524	WScript.exe	29
PID 2524 wrote to memory of 2544	2524	WScript.exe	29
PID 2524 wrote to memory of 2544	2524	WScript.exe	29
PID 2544 wrote to memory of 1448	2544	cmd.exe	31
PID 2544 wrote to memory of 1448	2544	cmd.exe	31
PID 2544 wrote to memory of 1448	2544	cmd.exe	31
PID 2544 wrote to memory of 1448	2544	cmd.exe	31
PID 1448 wrote to memory of 2948	1448	DllCommonsvc.exe	84
PID 1448 wrote to memory of 2948	1448	DllCommonsvc.exe	84
PID 1448 wrote to memory of 2948	1448	DllCommonsvc.exe	84
PID 1448 wrote to memory of 2952	1448	DllCommonsvc.exe	85
PID 1448 wrote to memory of 2952	1448	DllCommonsvc.exe	85
PID 1448 wrote to memory of 2952	1448	DllCommonsvc.exe	85
PID 1448 wrote to memory of 1532	1448	DllCommonsvc.exe	87
PID 1448 wrote to memory of 1532	1448	DllCommonsvc.exe	87
PID 1448 wrote to memory of 1532	1448	DllCommonsvc.exe	87
PID 1448 wrote to memory of 2348	1448	DllCommonsvc.exe	89
PID 1448 wrote to memory of 2348	1448	DllCommonsvc.exe	89
PID 1448 wrote to memory of 2348	1448	DllCommonsvc.exe	89
PID 1448 wrote to memory of 316	1448	DllCommonsvc.exe	90
PID 1448 wrote to memory of 316	1448	DllCommonsvc.exe	90
PID 1448 wrote to memory of 316	1448	DllCommonsvc.exe	90
PID 1448 wrote to memory of 1680	1448	DllCommonsvc.exe	91
PID 1448 wrote to memory of 1680	1448	DllCommonsvc.exe	91
PID 1448 wrote to memory of 1680	1448	DllCommonsvc.exe	91
PID 1448 wrote to memory of 2140	1448	DllCommonsvc.exe	92
PID 1448 wrote to memory of 2140	1448	DllCommonsvc.exe	92
PID 1448 wrote to memory of 2140	1448	DllCommonsvc.exe	92
PID 1448 wrote to memory of 2564	1448	DllCommonsvc.exe	93
PID 1448 wrote to memory of 2564	1448	DllCommonsvc.exe	93
PID 1448 wrote to memory of 2564	1448	DllCommonsvc.exe	93
PID 1448 wrote to memory of 2508	1448	DllCommonsvc.exe	94
PID 1448 wrote to memory of 2508	1448	DllCommonsvc.exe	94
PID 1448 wrote to memory of 2508	1448	DllCommonsvc.exe	94
PID 1448 wrote to memory of 2032	1448	DllCommonsvc.exe	95
PID 1448 wrote to memory of 2032	1448	DllCommonsvc.exe	95
PID 1448 wrote to memory of 2032	1448	DllCommonsvc.exe	95
PID 1448 wrote to memory of 2960	1448	DllCommonsvc.exe	96
PID 1448 wrote to memory of 2960	1448	DllCommonsvc.exe	96
PID 1448 wrote to memory of 2960	1448	DllCommonsvc.exe	96
PID 1448 wrote to memory of 2608	1448	DllCommonsvc.exe	97
PID 1448 wrote to memory of 2608	1448	DllCommonsvc.exe	97
PID 1448 wrote to memory of 2608	1448	DllCommonsvc.exe	97
PID 1448 wrote to memory of 2892	1448	DllCommonsvc.exe	98
PID 1448 wrote to memory of 2892	1448	DllCommonsvc.exe	98
PID 1448 wrote to memory of 2892	1448	DllCommonsvc.exe	98
PID 1448 wrote to memory of 2572	1448	DllCommonsvc.exe	99
PID 1448 wrote to memory of 2572	1448	DllCommonsvc.exe	99
PID 1448 wrote to memory of 2572	1448	DllCommonsvc.exe	99
PID 1448 wrote to memory of 2568	1448	DllCommonsvc.exe	100
PID 1448 wrote to memory of 2568	1448	DllCommonsvc.exe	100
PID 1448 wrote to memory of 2568	1448	DllCommonsvc.exe	100
PID 1448 wrote to memory of 2524	1448	DllCommonsvc.exe	102
PID 1448 wrote to memory of 2524	1448	DllCommonsvc.exe	102
PID 1448 wrote to memory of 2524	1448	DllCommonsvc.exe	102
PID 1448 wrote to memory of 320	1448	DllCommonsvc.exe	113
PID 1448 wrote to memory of 320	1448	DllCommonsvc.exe	113
PID 1448 wrote to memory of 320	1448	DllCommonsvc.exe	113
PID 1448 wrote to memory of 2596	1448	DllCommonsvc.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d0cf3fa264692d7506b8bc0218f35aa8d1f061826119bfc3df8243ba8fcb776dN.exe
"C:\Users\Admin\AppData\Local\Temp\d0cf3fa264692d7506b8bc0218f35aa8d1f061826119bfc3df8243ba8fcb776dN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\SendTo\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Start Menu\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\DataStore\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\fr-FR\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HwLG1J8NPK.bat"
        5⤵
        
        PID:1668
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2972
      - C:\Windows\Performance\WinSAT\services.exe
        
        "C:\Windows\Performance\WinSAT\services.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat"
        7⤵
        
        PID:1536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2092
        
        C:\Windows\Performance\WinSAT\services.exe
        
        "C:\Windows\Performance\WinSAT\services.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aTd08pZfDw.bat"
        9⤵
        
        PID:2424
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2588
        
        C:\Windows\Performance\WinSAT\services.exe
        
        "C:\Windows\Performance\WinSAT\services.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n7UEJyIAjk.bat"
        11⤵
        
        PID:2180
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1948
        
        C:\Windows\Performance\WinSAT\services.exe
        
        "C:\Windows\Performance\WinSAT\services.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dFeEewS5jL.bat"
        13⤵
        
        PID:1560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2900
        
        C:\Windows\Performance\WinSAT\services.exe
        
        "C:\Windows\Performance\WinSAT\services.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat"
        15⤵
        
        PID:2152
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2052
        
        C:\Windows\Performance\WinSAT\services.exe
        
        "C:\Windows\Performance\WinSAT\services.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GsZYO5BIqk.bat"
        17⤵
        
        PID:1624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2272
        
        C:\Windows\Performance\WinSAT\services.exe
        
        "C:\Windows\Performance\WinSAT\services.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\SendTo\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\SendTo\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\Performance\WinSAT\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\de-DE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\de-DE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\de-DE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\CrashReports\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\CrashReports\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Start Menu\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Start Menu\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\DataStore\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Windows\Performance\WinSAT\DataStore\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\DigitalLocker\fr-FR\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\WTR\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b93c7e53aaeae2dd50ff575f38569651

SHA1
f26732c7772f8949882edf394f8b9d03b57a978f

SHA256
c86d1f0c0a352c37cf2da441bb169735c3537bb7cc24be5e74bc08f7e3bff978

SHA512
d00782965c125a2099ef5f4bddee9c600a0e934e0d699cc6b6a1bfafa64ca6d622c96a1a67ea5215c0b6da61a500000c7ccd9baf512486035124078deb91fb3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05d29f1185d6d02a59a0c57a902eae68

SHA1
0034402dd802ce4832d6d64c4a45b94aa6c24100

SHA256
3dff00b40935c2643757fc49e24d321993010340385c996188f23f8b45394f9f

SHA512
473d62113449443bd34633d676c70cac51823419e2d5995d8555112a6db2d7c2f1d13fa9b209910f43b086bdc12293c4811dfe77f372414a80f5c99f944318f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c7be1ae7fb22feaff695c38df550e39

SHA1
fa434a032e09183c8b30e05337b5440c37dca0d0

SHA256
72a846595df8737cfa59fa209fb534cf2bb7dd332fa0a730e34785353735afd6

SHA512
7911ef2d94d164c550d07a3370c982cd74020afb5a9da22fff8bea79327af604c84e2c5170e95cc3d3d002755fe3f629c1371e3bbc9845a9fb1a252849f81ab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3340609f59fb466c63d39b917588b69

SHA1
9bc501cbf3645ff61fec0441b327a89edb5cfb4e

SHA256
7fd3054e9898f8237c655cbbc07adc0bd265cf4df2bb1cacff178948fc745cb4

SHA512
906f9a7ede1f3a6b83ab430e0a0666c5d5cb8fd368d7eb96bf4ffab9f215f794b0da0dd43646234137f75a35bcd4389e38343445af71e69677f7530a6d008b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb2482f6cd117e3a7609c65c8dcfec15

SHA1
f399d72c10a35c8d7d44c01a00f54ba36ee560f8

SHA256
62842eb242fb089d61818876f44303b07711f2dbc482d4e3def0e6c101cc3247

SHA512
756c1730e9182826e7a1092eb646769c8c4470785ee7a5418214aa9b6e800e460c2866af7c558166ed7e26816c0b8ff3bb5893efa9e0c5c59c758592026faac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC361.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GsZYO5BIqk.bat

Filesize
207B

MD5
8aeac1775621c7029053939917b0530f

SHA1
d22b213bb05089257ec118ca9bdcb30e4cd9201f

SHA256
62123a3e207f896aa10c64e0e9d7b3fbedf0ba7b248d03b8eea663881e84c10f

SHA512
769383685dfea78792976dd481e046e906e663ca7d7256b326157017ed5f0c088aef4a6b4a13054385e3bb670d4a5a996a657df1226ea56d09f69e06398fceb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\HwLG1J8NPK.bat

Filesize
207B

MD5
882faf5e940aebb41f92187e71dca70d

SHA1
378c829a557944c482b2f3267b7d042280fd89b4

SHA256
38c97ca3ac47f790069a91c5c2d12abf3fbf4b1d13baaeb5b1a9f41e84fd9f6c

SHA512
e1c396cd65e53caad73ecbedf5cbfe09d999b5bb90e1cad53773793958e767192e4fa1b99e9f260ab1cbc8dcec70881d8f86d8d1b8f38662e17f78dfa36e74a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC3B2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\aTd08pZfDw.bat

Filesize
207B

MD5
e584aeff9791dacd4a26d55f66909fe1

SHA1
aac994cf77a20f85a8807966c10d21f5da272cd6

SHA256
a9a12f0aa666c2233c1f76a762ce46e662f5cb095987045147fdb2f0d4f07ab1

SHA512
ebb9a7281f53489608d4d7021b2489ee30f2728b33c4c9e4882ebed00cdc4187d891b18e535e908ce74354c056768cb30c1a8398cf3ad3631fe1b0f269b02497

Download Submit
C:\Users\Admin\AppData\Local\Temp\dFeEewS5jL.bat

Filesize
207B

MD5
4dad30569ee11a5e2af0f0053cb9e504

SHA1
c4327f960c266fc1926c52bfd7e4a329814bcb94

SHA256
42d63b761d54510052f33177ebfc6d84378fcf31eeb4996cef1b3894e2db52f5

SHA512
b4f0c9d8a4986a6b9f4ecb81e57d84f3521a402f4c175d8f40c79a22adfd8b56aebaea8fe567cffe4ea9c98e26bbe3b64a5ef3ecbaf09cb43113f345f8604aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\n7UEJyIAjk.bat

Filesize
207B

MD5
adc807c90539fae1508d56b18ffc84b6

SHA1
03e0830c74b069785b89fb5353919c92c52f2578

SHA256
c6aaa787f0cdca49611cfed1caf4d3bcd775dcbd4fd89a769a23976e9853b3cf

SHA512
a8579eef678b9e7762635cbbbeed0c3d07109e6d5472cdca92803c639cc4ddf5f23408fa0e620e1c4451a901abf202d48cc5282b4dad5f1a0ad67c709b09280d

Download Submit
C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat

Filesize
207B

MD5
3e5db5574cd8c424ae07f6f0902036cb

SHA1
9b6d70983a345b92a6c0cfd9e9581cf99306f729

SHA256
2d3db3ff9bdd6d8de403eb5a3ea9d5358d0c113b23b4ac2f93e33821eef3abe9

SHA512
e3c274580f37a6cad1737390243aa8faa8492f825e2ce868045763abda1f2c34c5bf0d7a61f0b0c4934d55510e288c7491d24f658b9e8df065a4979436bc85fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\z7AIE64VZ5.bat

Filesize
207B

MD5
f4c8026a2b7bc58db0415f257b2626ce

SHA1
07785206a2c660ef72b43b9dbac6441970c5fb52

SHA256
15eb03493448f86ae6afa1274f54e3491cde5ed5be40ede3f2357a8ef818c6a2

SHA512
6b0da4dd303bcfc071f3927b8cf786550a679042479fea49cdeb31b90aad556f4265b177a8d77dd4d6601cbf527b8e07176c4e7c3169c83fdf792e25df936ff2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
30b0efeda150a990d7840e9fdf5fe18c

SHA1
9260c453967a392a28f6b61e1669088ae461e56c

SHA256
33f250c079c1d85fbd15c5c3c815b1aeced3a94a96b3bafc7363c945af0dc9c6

SHA512
4af0077d74a340e130ee9910d0a7330ce05aeb8c4fcf7bbc649f6b92101071525508fbfc7bd6a5119468b25ed78adc006ff527b244a299f29f403280d2c5a446

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1448-17-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/1448-16-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/1448-15-0x0000000000370000-0x000000000037C000-memory.dmp

Filesize
48KB

Download
memory/1448-14-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/1448-13-0x0000000000AB0000-0x0000000000BC0000-memory.dmp

Filesize
1.1MB

Download
memory/1524-212-0x0000000000060000-0x0000000000170000-memory.dmp

Filesize
1.1MB

Download
memory/1532-64-0x000000001B490000-0x000000001B772000-memory.dmp

Filesize
2.9MB

Download
memory/1532-71-0x00000000021C0000-0x00000000021C8000-memory.dmp

Filesize
32KB

Download
memory/1544-153-0x0000000000190000-0x00000000002A0000-memory.dmp

Filesize
1.1MB

Download
memory/1724-393-0x0000000000E60000-0x0000000000F70000-memory.dmp

Filesize
1.1MB

Download
memory/2300-333-0x0000000000310000-0x0000000000420000-memory.dmp

Filesize
1.1MB

Download
memory/2324-273-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2324-272-0x0000000001350000-0x0000000001460000-memory.dmp

Filesize
1.1MB

Download
memory/2324-512-0x0000000000170000-0x0000000000280000-memory.dmp

Filesize
1.1MB

Download