dcrat | b91e8b04d99020301229aa39b570ca8a3a251bdebe3fe768f5cc45e990ba3dbf

Analysis

max time kernel
152s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2022 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b91e8b04d99020301229aa39b570ca8a3a251bdebe3fe768f5cc45e990ba3dbf.exe
Size

1.3MB
MD5

1beee4c12afe60b5fbbd867cd11b4160
SHA1

1c4295d12a686fefddf61cc47304e75e49e9270a
SHA256

b91e8b04d99020301229aa39b570ca8a3a251bdebe3fe768f5cc45e990ba3dbf
SHA512

920ed7e0478454e9e9dfdc0e2fe94055c4653500ba49ccab8bf532c01664a6396b5eb3019ceb311c269c91c995d5ff763dec01707de43302b39c360c65356eaa
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	728	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1120	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	632	schtasks.exe	60
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	632	schtasks.exe	60

DCRat payload 11 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000022f6d-137.dat	dcrat
behavioral1/files/0x0006000000022f6d-138.dat	dcrat
behavioral1/memory/260-139-0x0000000000A40000-0x0000000000B50000-memory.dmp	dcrat
behavioral1/files/0x0006000000022f78-219.dat	dcrat
behavioral1/files/0x0006000000022f78-220.dat	dcrat
behavioral1/files/0x0006000000022f78-227.dat	dcrat
behavioral1/files/0x0006000000022f78-235.dat	dcrat
behavioral1/files/0x0006000000022f78-242.dat	dcrat
behavioral1/files/0x0006000000022f78-249.dat	dcrat
behavioral1/files/0x0006000000022f78-256.dat	dcrat
behavioral1/files/0x0006000000022f78-263.dat	dcrat

Executes dropped EXE 8 IoCs

pid	Process
260	DllCommonsvc.exe
4368	WmiPrvSE.exe
5344	WmiPrvSE.exe
1004	WmiPrvSE.exe
5888	WmiPrvSE.exe
2444	WmiPrvSE.exe
5308	WmiPrvSE.exe
4080	WmiPrvSE.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	b91e8b04d99020301229aa39b570ca8a3a251bdebe3fe768f5cc45e990ba3dbf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WmiPrvSE.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\55b276f4edf653	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\images\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\images\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\56085415360792	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\LiveKernelReports\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Pictures\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Pictures\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Windows\IME\es-ES\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\IME\es-ES\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\rescache\_merged\2899339121\lsass.exe	DllCommonsvc.exe
File created	C:\Windows\LiveKernelReports\RuntimeBroker.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2960	schtasks.exe
1768	schtasks.exe
1688	schtasks.exe
1728	schtasks.exe
812	schtasks.exe
3588	schtasks.exe
1952	schtasks.exe
3256	schtasks.exe
5012	schtasks.exe
2860	schtasks.exe
1752	schtasks.exe
1632	schtasks.exe
1292	schtasks.exe
2832	schtasks.exe
3088	schtasks.exe
4436	schtasks.exe
1120	schtasks.exe
4768	schtasks.exe
2880	schtasks.exe
4904	schtasks.exe
4912	schtasks.exe
3864	schtasks.exe
3460	schtasks.exe
2444	schtasks.exe
3036	schtasks.exe
3260	schtasks.exe
1412	schtasks.exe
2244	schtasks.exe
3160	schtasks.exe
2124	schtasks.exe
4672	schtasks.exe
1016	schtasks.exe
3772	schtasks.exe
3548	schtasks.exe
4708	schtasks.exe
1700	schtasks.exe
1792	schtasks.exe
4652	schtasks.exe
728	schtasks.exe
1576	schtasks.exe
3452	schtasks.exe
3804	schtasks.exe
1864	schtasks.exe
2768	schtasks.exe
3384	schtasks.exe
2236	schtasks.exe
1144	schtasks.exe
3632	schtasks.exe
4004	schtasks.exe
1988	schtasks.exe
4596	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	b91e8b04d99020301229aa39b570ca8a3a251bdebe3fe768f5cc45e990ba3dbf.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	WmiPrvSE.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
260	DllCommonsvc.exe
1060	powershell.exe
1060	powershell.exe
1960	powershell.exe
1960	powershell.exe
2856	powershell.exe
2856	powershell.exe
4696	powershell.exe
4696	powershell.exe
4532	powershell.exe
4532	powershell.exe
4396	powershell.exe
4396	powershell.exe
5088	powershell.exe
5088	powershell.exe
424	powershell.exe
424	powershell.exe
4072	powershell.exe
4072	powershell.exe
5084	powershell.exe
5084	powershell.exe
2284	powershell.exe
2284	powershell.exe
216	powershell.exe
216	powershell.exe
3668	powershell.exe
3668	powershell.exe
1768	powershell.exe
1768	powershell.exe
4844	powershell.exe
4844	powershell.exe
4672	powershell.exe
4672	powershell.exe
4524	powershell.exe
4524	powershell.exe
1908	powershell.exe
1908	powershell.exe
2856	powershell.exe
2856	powershell.exe
1060	powershell.exe
1060	powershell.exe
1960	powershell.exe
1960	powershell.exe
4532	powershell.exe
4532	powershell.exe
4696	powershell.exe
4696	powershell.exe
4396	powershell.exe
4396	powershell.exe
5084	powershell.exe
4072	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	260	DllCommonsvc.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	424	powershell.exe
Token: SeDebugPrivilege	4072	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	4368	WmiPrvSE.exe
Token: SeDebugPrivilege	5344	WmiPrvSE.exe
Token: SeDebugPrivilege	1004	WmiPrvSE.exe
Token: SeDebugPrivilege	5888	WmiPrvSE.exe
Token: SeDebugPrivilege	2444	WmiPrvSE.exe
Token: SeDebugPrivilege	5308	WmiPrvSE.exe
Token: SeDebugPrivilege	4080	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4344	3108	b91e8b04d99020301229aa39b570ca8a3a251bdebe3fe768f5cc45e990ba3dbf.exe	80
PID 3108 wrote to memory of 4344	3108	b91e8b04d99020301229aa39b570ca8a3a251bdebe3fe768f5cc45e990ba3dbf.exe	80
PID 3108 wrote to memory of 4344	3108	b91e8b04d99020301229aa39b570ca8a3a251bdebe3fe768f5cc45e990ba3dbf.exe	80
PID 4344 wrote to memory of 1652	4344	WScript.exe	84
PID 4344 wrote to memory of 1652	4344	WScript.exe	84
PID 4344 wrote to memory of 1652	4344	WScript.exe	84
PID 1652 wrote to memory of 260	1652	cmd.exe	86
PID 1652 wrote to memory of 260	1652	cmd.exe	86
PID 260 wrote to memory of 424	260	DllCommonsvc.exe	142
PID 260 wrote to memory of 424	260	DllCommonsvc.exe	142
PID 260 wrote to memory of 2856	260	DllCommonsvc.exe	143
PID 260 wrote to memory of 2856	260	DllCommonsvc.exe	143
PID 260 wrote to memory of 1060	260	DllCommonsvc.exe	144
PID 260 wrote to memory of 1060	260	DllCommonsvc.exe	144
PID 260 wrote to memory of 4696	260	DllCommonsvc.exe	146
PID 260 wrote to memory of 4696	260	DllCommonsvc.exe	146
PID 260 wrote to memory of 4532	260	DllCommonsvc.exe	147
PID 260 wrote to memory of 4532	260	DllCommonsvc.exe	147
PID 260 wrote to memory of 1960	260	DllCommonsvc.exe	151
PID 260 wrote to memory of 1960	260	DllCommonsvc.exe	151
PID 260 wrote to memory of 5088	260	DllCommonsvc.exe	153
PID 260 wrote to memory of 5088	260	DllCommonsvc.exe	153
PID 260 wrote to memory of 4396	260	DllCommonsvc.exe	160
PID 260 wrote to memory of 4396	260	DllCommonsvc.exe	160
PID 260 wrote to memory of 4072	260	DllCommonsvc.exe	155
PID 260 wrote to memory of 4072	260	DllCommonsvc.exe	155
PID 260 wrote to memory of 5084	260	DllCommonsvc.exe	159
PID 260 wrote to memory of 5084	260	DllCommonsvc.exe	159
PID 260 wrote to memory of 2284	260	DllCommonsvc.exe	161
PID 260 wrote to memory of 2284	260	DllCommonsvc.exe	161
PID 260 wrote to memory of 216	260	DllCommonsvc.exe	162
PID 260 wrote to memory of 216	260	DllCommonsvc.exe	162
PID 260 wrote to memory of 3668	260	DllCommonsvc.exe	165
PID 260 wrote to memory of 3668	260	DllCommonsvc.exe	165
PID 260 wrote to memory of 4844	260	DllCommonsvc.exe	168
PID 260 wrote to memory of 4844	260	DllCommonsvc.exe	168
PID 260 wrote to memory of 1768	260	DllCommonsvc.exe	169
PID 260 wrote to memory of 1768	260	DllCommonsvc.exe	169
PID 260 wrote to memory of 4672	260	DllCommonsvc.exe	171
PID 260 wrote to memory of 4672	260	DllCommonsvc.exe	171
PID 260 wrote to memory of 4524	260	DllCommonsvc.exe	173
PID 260 wrote to memory of 4524	260	DllCommonsvc.exe	173
PID 260 wrote to memory of 1908	260	DllCommonsvc.exe	175
PID 260 wrote to memory of 1908	260	DllCommonsvc.exe	175
PID 260 wrote to memory of 1528	260	DllCommonsvc.exe	178
PID 260 wrote to memory of 1528	260	DllCommonsvc.exe	178
PID 1528 wrote to memory of 5764	1528	cmd.exe	180
PID 1528 wrote to memory of 5764	1528	cmd.exe	180
PID 1528 wrote to memory of 4368	1528	cmd.exe	181
PID 1528 wrote to memory of 4368	1528	cmd.exe	181
PID 4368 wrote to memory of 5288	4368	WmiPrvSE.exe	182
PID 4368 wrote to memory of 5288	4368	WmiPrvSE.exe	182
PID 5288 wrote to memory of 1456	5288	cmd.exe	184
PID 5288 wrote to memory of 1456	5288	cmd.exe	184
PID 5288 wrote to memory of 5344	5288	cmd.exe	185
PID 5288 wrote to memory of 5344	5288	cmd.exe	185
PID 5344 wrote to memory of 5808	5344	WmiPrvSE.exe	186
PID 5344 wrote to memory of 5808	5344	WmiPrvSE.exe	186
PID 5808 wrote to memory of 5916	5808	cmd.exe	188
PID 5808 wrote to memory of 5916	5808	cmd.exe	188
PID 5808 wrote to memory of 1004	5808	cmd.exe	189
PID 5808 wrote to memory of 1004	5808	cmd.exe	189
PID 1004 wrote to memory of 5944	1004	WmiPrvSE.exe	190
PID 1004 wrote to memory of 5944	1004	WmiPrvSE.exe	190

C:\Users\Admin\AppData\Local\Temp\b91e8b04d99020301229aa39b570ca8a3a251bdebe3fe768f5cc45e990ba3dbf.exe
"C:\Users\Admin\AppData\Local\Temp\b91e8b04d99020301229aa39b570ca8a3a251bdebe3fe768f5cc45e990ba3dbf.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\StartMenuExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\ssh\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\Pictures\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\images\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\es-ES\conhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\de-DE\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\TrustedInstaller.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Kn3rQqKaK.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1528
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5764
      - C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z4XVup0LT1.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5288
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1456
        
        C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tiHtiEmsSK.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:5916
        
        C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe"
        10⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2Odt5WJZ2f.bat"
        11⤵
        
        PID:5944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:5472
        
        C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe"
        12⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nl4g9d70ax.bat"
        13⤵
        
        PID:4452
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:5072
        
        C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe"
        14⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nl4g9d70ax.bat"
        15⤵
        
        PID:1960
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1236
        
        C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe"
        16⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat"
        17⤵
        
        PID:4936
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3256
        
        C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe
        
        "C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe"
        18⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\P9uKrkSNlp.bat"
        19⤵
        
        PID:5152
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:5784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\LiveKernelReports\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Common Files\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\ssh\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\All Users\ssh\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\ssh\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\ServiceProfiles\NetworkService\Pictures\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\ServiceProfiles\NetworkService\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\images\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\images\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\images\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\es-ES\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\IME\es-ES\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\es-ES\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\odt\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Mail\WmiPrvSE.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WmiPrvSE.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c6c940df49fc678d1c74fea3c57a32f9

SHA1
79edd715358a82e6d29970998ff2e9b235ea4217

SHA256
4e50925adb70141467a7081cc905c76fd6dab841195400683f9f67fc2602aa0a

SHA512
3c1df9c18f1756ead841f68916dec03a066078b0705443d3f886fd990e2e42ebbffd46916be3f6fe39ea0505fc2c848fbdea56828fbd5aa5f24b329f8d979707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60804e808a88131a5452fed692914a8e

SHA1
fdb74669923b31d573787fe024dbd701fa21bb5b

SHA256
064fdd6e9e6e7f51da354604a56f66217f1edfc12d9bbbaf869a628915a86a61

SHA512
d4f2791433c0bacd8cad57b40fab4a807db4dd74f7c5357d2bce9aaa6544f97667497307d1e0704b98e2c99a94775fbb6ea676685a01578e4d0304f541c9854a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2Odt5WJZ2f.bat

Filesize
213B

MD5
80054a7fac417cd9e2f9b1cf76d926d1

SHA1
b87722bbd4d616c289c8f26049ed5ab2800e65f6

SHA256
07b51abef06d1ce8d50d950626db8b1caad7346912360286bb97c150c070ceac

SHA512
653c4708a671729f5bf1f4abf74c859c9b2ba1f7e47b4dc9949119122a413757549bb21511f124eb1613d24c21ec1a15d28b0065b14f6f2d88d16e18fcea0e1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Kn3rQqKaK.bat

Filesize
213B

MD5
6949c2450a6e537e4c7e06ccf31680ff

SHA1
e46325d075976d9443d52f321011c17716a0fe7a

SHA256
d4c8baf8c9793be3d092f74d516e5478012c493dd5ea785b7e31f41fb12719ab

SHA512
82e629ba503a983d82afa9bd29c8badf18731cffeeb43676d07f173777132077222d4b9008690a30b95d5533fc1e3707681bd43121dc55bb5dfde71fe2e3bcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\P9uKrkSNlp.bat

Filesize
213B

MD5
e4d382ae29b62fca0a420867055841ae

SHA1
59cb6c321138096cf5a7eb339b8031a27630895c

SHA256
6462f59c4bbde76513a516c67a53f4862493188faf179eb231205fd9d0103c6a

SHA512
22fb0b3fee2318538bb4c034e4a2b51bf45f07a549806a9581f0f11c1766458b25732d4f7e9397b8cb163583e0efa21cdfbdfd01d62fa67e78cb00dab6544980

Download Submit
C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat

Filesize
213B

MD5
1774d08297779f3264a118411c3fbf3d

SHA1
2fba85e4d3c7883ec36510f8214d0c1ecd3ceed1

SHA256
e872eb110f8e11c322757701d2c69e06f147dff49e9be3cd6ae770ba4c8b5466

SHA512
0acc4353e1c423b1384f4dd66254c26eeb5c49fd7897836d7bdf01b5183c771113167f00b2e171a41c1732c48eb5ccd9cd08de06e3a4adf4cd200e74a3143d88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z4XVup0LT1.bat

Filesize
213B

MD5
76089847755b274868267ded4149c04d

SHA1
b68361e8619c4ae62d12c454de86eaf90986e897

SHA256
e977a75c5436dd5bdd931250e6d372d8955c4fa867663d4dac19d6476e1d2e8c

SHA512
28624629ab3e44914b6c691b50d99c82806a1354235921aeb202a6e9f0e39666b4a8574462dd885457929577a9d6209f4801812581e6f5d5f15a923e376b0dfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nl4g9d70ax.bat

Filesize
213B

MD5
6e71a1c4c1db6488879ef5e2542eaa1a

SHA1
07c4e40a33329a0907af994a1ceffd818c3c00fd

SHA256
a836709aa6d3ac21546a31ca8fba662f49c9198390087d91aec58646359287d5

SHA512
4b751e84aa37b3afd4ab490f456ad05a5f34e961a31a84ea358f4e0414b3c317c23eeaa05e22f392d7ced7bdf82127abd454793707364ca38750710c2418bb10

Download Submit
C:\Users\Admin\AppData\Local\Temp\nl4g9d70ax.bat

Filesize
213B

MD5
6e71a1c4c1db6488879ef5e2542eaa1a

SHA1
07c4e40a33329a0907af994a1ceffd818c3c00fd

SHA256
a836709aa6d3ac21546a31ca8fba662f49c9198390087d91aec58646359287d5

SHA512
4b751e84aa37b3afd4ab490f456ad05a5f34e961a31a84ea358f4e0414b3c317c23eeaa05e22f392d7ced7bdf82127abd454793707364ca38750710c2418bb10

Download Submit
C:\Users\Admin\AppData\Local\Temp\tiHtiEmsSK.bat

Filesize
213B

MD5
4c58e8ccd4ad13474c52dfc1c6cbb970

SHA1
2f59b12dfc4820ad0bcaa610623921c2574b06c8

SHA256
c76fa2cddd4e441de6c2cb6a0198bb2aada39872d38bd03bda96584cd3af2c77

SHA512
e192f225c4e04212b73e3c2540df059627b40f9d287a1bd6e01bc87bdf514857a2d625f74934e07d296d629b0c328763b42935468343c99d109655ea6fb268bb

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/216-212-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/216-177-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/260-170-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/260-139-0x0000000000A40000-0x0000000000B50000-memory.dmp

Filesize
1.1MB

Download
memory/260-140-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/424-201-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/424-175-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/1004-236-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/1004-240-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/1060-162-0x000001814AFD0000-0x000001814AFF2000-memory.dmp

Filesize
136KB

Download
memory/1060-199-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/1060-160-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/1768-207-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/1768-172-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/1908-217-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/1908-173-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/1960-195-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/1960-163-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/2284-169-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/2284-204-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/2444-250-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/2444-254-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/2856-200-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/2856-155-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/3668-178-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/3668-210-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4072-198-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4072-168-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4080-268-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/4080-264-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/4368-225-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/4368-221-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/4396-167-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4396-193-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4524-180-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4524-215-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4532-192-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4532-164-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4672-179-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4672-213-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4696-194-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4696-158-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-171-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4844-211-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-197-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-176-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/5088-202-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/5088-166-0x00007FFED97F0000-0x00007FFEDA2B1000-memory.dmp

Filesize
10.8MB

Download
memory/5308-261-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/5308-257-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/5344-229-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/5344-233-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/5888-247-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download
memory/5888-243-0x00007FFED99E0000-0x00007FFEDA4A1000-memory.dmp

Filesize
10.8MB

Download