dcrat | 41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c.exe
Size

1.3MB
MD5

d3d89e4e34ffc48d4dcd06c67783d24b
SHA1

677a78c506146482dd98af932f49053a99ef5be0
SHA256

41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c
SHA512

f11414f019cb878779faf9b7628835e8936147aef3c4e0c4c440a647b80d8ee3d09483b73939e72327af021dba811d0c52c8d2ae8213ad2f5ab88a39989ea576
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4112	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	3344	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	3344	schtasks.exe	33

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0002000000022df6-137.dat	dcrat
behavioral1/files/0x0002000000022df6-138.dat	dcrat
behavioral1/memory/1008-139-0x00000000005C0000-0x00000000006D0000-memory.dmp	dcrat
behavioral1/files/0x0002000000022df6-163.dat	dcrat
behavioral1/files/0x0001000000022e23-211.dat	dcrat
behavioral1/files/0x0001000000022e23-212.dat	dcrat
behavioral1/files/0x0001000000022e23-219.dat	dcrat
behavioral1/files/0x0001000000022e23-227.dat	dcrat
behavioral1/files/0x0001000000022e23-234.dat	dcrat
behavioral1/files/0x0001000000022e23-241.dat	dcrat
behavioral1/files/0x0001000000022e23-248.dat	dcrat
behavioral1/files/0x0001000000022e23-255.dat	dcrat
behavioral1/files/0x0001000000022e23-262.dat	dcrat
behavioral1/files/0x0001000000022e23-269.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
1008	DllCommonsvc.exe
1556	DllCommonsvc.exe
5080	MoUsoCoreWorker.exe
1132	MoUsoCoreWorker.exe
860	MoUsoCoreWorker.exe
1248	MoUsoCoreWorker.exe
1604	MoUsoCoreWorker.exe
224	MoUsoCoreWorker.exe
5116	MoUsoCoreWorker.exe
1332	MoUsoCoreWorker.exe
3532	MoUsoCoreWorker.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MoUsoCoreWorker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\38384e6a620884	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\SppExtComObj.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\e1ef82546f0b02	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\tracing\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\tracing\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\Containers\serviced\MoUsoCoreWorker.exe	DllCommonsvc.exe
File created	C:\Windows\Containers\serviced\1f93f77a7f4778	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5060	schtasks.exe
2124	schtasks.exe
3408	schtasks.exe
2560	schtasks.exe
4200	schtasks.exe
1996	schtasks.exe
3004	schtasks.exe
4384	schtasks.exe
3968	schtasks.exe
3868	schtasks.exe
2760	schtasks.exe
388	schtasks.exe
396	schtasks.exe
3560	schtasks.exe
1060	schtasks.exe
4848	schtasks.exe
224	schtasks.exe
3772	schtasks.exe
1012	schtasks.exe
4152	schtasks.exe
4696	schtasks.exe
1416	schtasks.exe
1776	schtasks.exe
376	schtasks.exe
800	schtasks.exe
4964	schtasks.exe
3040	schtasks.exe
4052	schtasks.exe
3516	schtasks.exe
3188	schtasks.exe
2952	schtasks.exe
3824	schtasks.exe
3464	schtasks.exe
4112	schtasks.exe
860	schtasks.exe
4988	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	MoUsoCoreWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	MoUsoCoreWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	MoUsoCoreWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	MoUsoCoreWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	MoUsoCoreWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	MoUsoCoreWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	MoUsoCoreWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	MoUsoCoreWorker.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	MoUsoCoreWorker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1008	DllCommonsvc.exe
4776	powershell.exe
4668	powershell.exe
5032	powershell.exe
4488	powershell.exe
5032	powershell.exe
4776	powershell.exe
4668	powershell.exe
4488	powershell.exe
4488	powershell.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
1556	DllCommonsvc.exe
3264	powershell.exe
3264	powershell.exe
5052	powershell.exe
5052	powershell.exe
2040	powershell.exe
2040	powershell.exe
2128	powershell.exe
2128	powershell.exe
2044	powershell.exe
2044	powershell.exe
800	powershell.exe
800	powershell.exe
376	powershell.exe
376	powershell.exe
224	powershell.exe
224	powershell.exe
5100	powershell.exe
5100	powershell.exe
448	powershell.exe
448	powershell.exe
376	powershell.exe
3264	powershell.exe
2044	powershell.exe
5052	powershell.exe
2040	powershell.exe
2128	powershell.exe
800	powershell.exe
5100	powershell.exe
224	powershell.exe
448	powershell.exe
5080	MoUsoCoreWorker.exe
1132	MoUsoCoreWorker.exe
860	MoUsoCoreWorker.exe
1248	MoUsoCoreWorker.exe
1604	MoUsoCoreWorker.exe
224	MoUsoCoreWorker.exe
5116	MoUsoCoreWorker.exe
1332	MoUsoCoreWorker.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	DllCommonsvc.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	1556	DllCommonsvc.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	5080	MoUsoCoreWorker.exe
Token: SeDebugPrivilege	1132	MoUsoCoreWorker.exe
Token: SeDebugPrivilege	860	MoUsoCoreWorker.exe
Token: SeDebugPrivilege	1248	MoUsoCoreWorker.exe
Token: SeDebugPrivilege	1604	MoUsoCoreWorker.exe
Token: SeDebugPrivilege	224	MoUsoCoreWorker.exe
Token: SeDebugPrivilege	5116	MoUsoCoreWorker.exe
Token: SeDebugPrivilege	1332	MoUsoCoreWorker.exe
Token: SeDebugPrivilege	3532	MoUsoCoreWorker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 5072	2952	41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c.exe	81
PID 2952 wrote to memory of 5072	2952	41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c.exe	81
PID 2952 wrote to memory of 5072	2952	41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c.exe	81
PID 5072 wrote to memory of 2516	5072	WScript.exe	85
PID 5072 wrote to memory of 2516	5072	WScript.exe	85
PID 5072 wrote to memory of 2516	5072	WScript.exe	85
PID 2516 wrote to memory of 1008	2516	cmd.exe	87
PID 2516 wrote to memory of 1008	2516	cmd.exe	87
PID 1008 wrote to memory of 4776	1008	DllCommonsvc.exe	98
PID 1008 wrote to memory of 4776	1008	DllCommonsvc.exe	98
PID 1008 wrote to memory of 5032	1008	DllCommonsvc.exe	101
PID 1008 wrote to memory of 5032	1008	DllCommonsvc.exe	101
PID 1008 wrote to memory of 4668	1008	DllCommonsvc.exe	99
PID 1008 wrote to memory of 4668	1008	DllCommonsvc.exe	99
PID 1008 wrote to memory of 4488	1008	DllCommonsvc.exe	103
PID 1008 wrote to memory of 4488	1008	DllCommonsvc.exe	103
PID 1008 wrote to memory of 4276	1008	DllCommonsvc.exe	106
PID 1008 wrote to memory of 4276	1008	DllCommonsvc.exe	106
PID 4276 wrote to memory of 1456	4276	cmd.exe	108
PID 4276 wrote to memory of 1456	4276	cmd.exe	108
PID 4276 wrote to memory of 1556	4276	cmd.exe	111
PID 4276 wrote to memory of 1556	4276	cmd.exe	111
PID 1556 wrote to memory of 5052	1556	DllCommonsvc.exe	139
PID 1556 wrote to memory of 5052	1556	DllCommonsvc.exe	139
PID 1556 wrote to memory of 3264	1556	DllCommonsvc.exe	141
PID 1556 wrote to memory of 3264	1556	DllCommonsvc.exe	141
PID 1556 wrote to memory of 2044	1556	DllCommonsvc.exe	149
PID 1556 wrote to memory of 2044	1556	DllCommonsvc.exe	149
PID 1556 wrote to memory of 2128	1556	DllCommonsvc.exe	143
PID 1556 wrote to memory of 2128	1556	DllCommonsvc.exe	143
PID 1556 wrote to memory of 2040	1556	DllCommonsvc.exe	147
PID 1556 wrote to memory of 2040	1556	DllCommonsvc.exe	147
PID 1556 wrote to memory of 376	1556	DllCommonsvc.exe	145
PID 1556 wrote to memory of 376	1556	DllCommonsvc.exe	145
PID 1556 wrote to memory of 800	1556	DllCommonsvc.exe	150
PID 1556 wrote to memory of 800	1556	DllCommonsvc.exe	150
PID 1556 wrote to memory of 224	1556	DllCommonsvc.exe	155
PID 1556 wrote to memory of 224	1556	DllCommonsvc.exe	155
PID 1556 wrote to memory of 5100	1556	DllCommonsvc.exe	151
PID 1556 wrote to memory of 5100	1556	DllCommonsvc.exe	151
PID 1556 wrote to memory of 448	1556	DllCommonsvc.exe	152
PID 1556 wrote to memory of 448	1556	DllCommonsvc.exe	152
PID 1556 wrote to memory of 2248	1556	DllCommonsvc.exe	159
PID 1556 wrote to memory of 2248	1556	DllCommonsvc.exe	159
PID 2248 wrote to memory of 2736	2248	cmd.exe	161
PID 2248 wrote to memory of 2736	2248	cmd.exe	161
PID 2248 wrote to memory of 5080	2248	cmd.exe	163
PID 2248 wrote to memory of 5080	2248	cmd.exe	163
PID 5080 wrote to memory of 3956	5080	MoUsoCoreWorker.exe	164
PID 5080 wrote to memory of 3956	5080	MoUsoCoreWorker.exe	164
PID 3956 wrote to memory of 1988	3956	cmd.exe	166
PID 3956 wrote to memory of 1988	3956	cmd.exe	166
PID 3956 wrote to memory of 1132	3956	cmd.exe	167
PID 3956 wrote to memory of 1132	3956	cmd.exe	167
PID 1132 wrote to memory of 2216	1132	MoUsoCoreWorker.exe	168
PID 1132 wrote to memory of 2216	1132	MoUsoCoreWorker.exe	168
PID 2216 wrote to memory of 376	2216	cmd.exe	170
PID 2216 wrote to memory of 376	2216	cmd.exe	170
PID 2216 wrote to memory of 860	2216	cmd.exe	171
PID 2216 wrote to memory of 860	2216	cmd.exe	171
PID 860 wrote to memory of 1304	860	MoUsoCoreWorker.exe	172
PID 860 wrote to memory of 1304	860	MoUsoCoreWorker.exe	172
PID 1304 wrote to memory of 2592	1304	cmd.exe	174
PID 1304 wrote to memory of 2592	1304	cmd.exe	174

C:\Users\Admin\AppData\Local\Temp\41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c.exe
"C:\Users\Admin\AppData\Local\Temp\41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\SppExtComObj.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\tracing\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mqKWPsdws2.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4276
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1456
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\SppExtComObj.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\MoUsoCoreWorker.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\RuntimeBroker.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QUn8qtQ3eB.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2736
        
        C:\Windows\Containers\serviced\MoUsoCoreWorker.exe
        
        "C:\Windows\Containers\serviced\MoUsoCoreWorker.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\38MS6cfT7h.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1988
        
        C:\Windows\Containers\serviced\MoUsoCoreWorker.exe
        
        "C:\Windows\Containers\serviced\MoUsoCoreWorker.exe"
        10⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mJIFszAWFu.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:376
        
        C:\Windows\Containers\serviced\MoUsoCoreWorker.exe
        
        "C:\Windows\Containers\serviced\MoUsoCoreWorker.exe"
        12⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2592
        
        C:\Windows\Containers\serviced\MoUsoCoreWorker.exe
        
        "C:\Windows\Containers\serviced\MoUsoCoreWorker.exe"
        14⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CxpWyGgMb4.bat"
        15⤵
        
        PID:4196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:812
        
        C:\Windows\Containers\serviced\MoUsoCoreWorker.exe
        
        "C:\Windows\Containers\serviced\MoUsoCoreWorker.exe"
        16⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jlvf1Vq2YP.bat"
        17⤵
        
        PID:3260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4288
        
        C:\Windows\Containers\serviced\MoUsoCoreWorker.exe
        
        "C:\Windows\Containers\serviced\MoUsoCoreWorker.exe"
        18⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gy1gqmGK9f.bat"
        19⤵
        
        PID:3304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2040
        
        C:\Windows\Containers\serviced\MoUsoCoreWorker.exe
        
        "C:\Windows\Containers\serviced\MoUsoCoreWorker.exe"
        20⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p6CE4ikEee.bat"
        21⤵
        
        PID:1280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3184
        
        C:\Windows\Containers\serviced\MoUsoCoreWorker.exe
        
        "C:\Windows\Containers\serviced\MoUsoCoreWorker.exe"
        22⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zcl4dB2r8y.bat"
        23⤵
        
        PID:3076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:816
        
        C:\Windows\Containers\serviced\MoUsoCoreWorker.exe
        
        "C:\Windows\Containers\serviced\MoUsoCoreWorker.exe"
        24⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gWC6ojzqIZ.bat"
        25⤵
        
        PID:916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\Public\AccountPictures\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Users\Public\AccountPictures\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Windows\tracing\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\tracing\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Windows\tracing\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 13 /tr "'C:\Windows\Containers\serviced\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 8 /tr "'C:\Windows\Containers\serviced\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MoUsoCoreWorker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
64bd6b9cd961ecbab7b4879ef63b285e

SHA1
990d65d9f4509a3ef03e55355eda87e8a30325d0

SHA256
3b93e0887bec4c9becb9d0a235b6fbab86812fed1a365f1edfe9670255eeea86

SHA512
7c395824d1c4de1fef1fed15987f5654eb021f9c3335294811a0ea2f83cb751e518e494dd8a89ce8fefc6f7e6aaf77430090b45c46465b6b95343bfe347e0901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
eaf2949b53de8c4a84042633ab9545d4

SHA1
882fa652ca3ca05f93f383057b9937cf8bff704e

SHA256
42e02d0d8a7ea1446fadc3a43297652904bb326b3d2d961d83783fb0b47d3d50

SHA512
5da2d97fe178b9764c51599f1410f0bb41f5bd7dd37b027f00b378a5d12be57b72dcf9e4800e765384fbf17c784876b5783b08fa940d1db44cfb928ea391bb00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0d790585fb32ef9e26fcd347cfcc3723

SHA1
ca76772d3a4751188a23766cb0dfee16dad16e88

SHA256
fe4266d3c0b360984f5704d4d7633c535af0f3bf7cedd4235d4d98d92ffc9807

SHA512
6548dafdb1b1ed2c9d6f674e3401a160dc8a8208f952f5dfdd8dd6f23d27c7cf36e536c41b4ae0b2db529a8c5a27dfb021f4bd45f3bd57a7319748cbef6c3c57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0d790585fb32ef9e26fcd347cfcc3723

SHA1
ca76772d3a4751188a23766cb0dfee16dad16e88

SHA256
fe4266d3c0b360984f5704d4d7633c535af0f3bf7cedd4235d4d98d92ffc9807

SHA512
6548dafdb1b1ed2c9d6f674e3401a160dc8a8208f952f5dfdd8dd6f23d27c7cf36e536c41b4ae0b2db529a8c5a27dfb021f4bd45f3bd57a7319748cbef6c3c57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
65995df72c3e88a1d1d15c170b49d777

SHA1
fca702296954192da52b0f4bb51bca26bebe0e52

SHA256
3e74f281e83a0ce8b5d15d7cacae7e02e7773b1321ab53ad377437ef6ef78915

SHA512
5f8b488e3e12411f4db9e9c6f67bb384bd474065f659c4028fd12324c6db8440318a818716d83e589f8b7e10875df65348bac0e60ac7bb790b5430e94b746aae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8c8dac626a173014cf7951b9ddfd9a8f

SHA1
526c3bbee604116a9c0deceab407caec34f3d552

SHA256
8e4a00f2a4f734671e00233e626fc950da4f58240f3729470ef592fa00a454a9

SHA512
4a1705b19c25c6238c204d7793a1f550e53b14ecb2aae82c32a2dca3d4110f737275cbdfd3ce65db95caf84eeac506d20ece28c96c9114eb0c61e58467471474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8c8dac626a173014cf7951b9ddfd9a8f

SHA1
526c3bbee604116a9c0deceab407caec34f3d552

SHA256
8e4a00f2a4f734671e00233e626fc950da4f58240f3729470ef592fa00a454a9

SHA512
4a1705b19c25c6238c204d7793a1f550e53b14ecb2aae82c32a2dca3d4110f737275cbdfd3ce65db95caf84eeac506d20ece28c96c9114eb0c61e58467471474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8c8dac626a173014cf7951b9ddfd9a8f

SHA1
526c3bbee604116a9c0deceab407caec34f3d552

SHA256
8e4a00f2a4f734671e00233e626fc950da4f58240f3729470ef592fa00a454a9

SHA512
4a1705b19c25c6238c204d7793a1f550e53b14ecb2aae82c32a2dca3d4110f737275cbdfd3ce65db95caf84eeac506d20ece28c96c9114eb0c61e58467471474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4822327741294722927d46423be14304

SHA1
3049826ae49ca304bd4a84a21b8ccb6a9499c39e

SHA256
b6ed5510a3376ce391d154b219c2d70cebb62e6fdef97022ad2bc305c5137a74

SHA512
c7607f4bab5688baaeab93bc92a2546d60f9f77b52614ad718133e4313674ae3bdbd497282220c399b2cd97c45a09adbecf1997ac82cab9e221129fa3ac83c8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\38MS6cfT7h.bat

Filesize
215B

MD5
43e93905f60a4faf7463249d79f41fc5

SHA1
4f5db00f347e07310ff2cde6ee5d941c6c916ead

SHA256
fa8f8d44c44fa831d4877fe12838a767e9435b181208702115d146ff700b3744

SHA512
c6916e2de76973bd3cc536f4a407f1957bddff53e8f6c9f0b2e664efe02671b638a34c167ee4ff678e04af4314976c7fde90945ee336785848890b5e565eeb13

Download Submit
C:\Users\Admin\AppData\Local\Temp\CxpWyGgMb4.bat

Filesize
215B

MD5
8df34a30c516445677a68d316ecce3fc

SHA1
de098cf0f1f6f40d73792605708e702ac6006a37

SHA256
85adadb55069086ff50c6e365a43459986d2602631ba4f87a7bdba8d68f4449b

SHA512
1da656a6609d344ffda47d82c92a6459316c00566e0b0851f7bd901df453272e82efe7d7f2eb2fa5b52e3da47739a7cf27bc0fb0ef845888f7ea81d44ed518e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gy1gqmGK9f.bat

Filesize
215B

MD5
e8efa604e0bb8b26d45fee62f3a87743

SHA1
450e09a84538916daae3f8e331fc80eb3206daf9

SHA256
d0349e700b660347fbf719d8144707f23e0f49c3ec006cf37b83cca08bf6ef73

SHA512
456c61b532d95f0ad623314e08a991303b8c4211e9091ebb15a10a3c569603113b00dbe26758895af35833b5b12763ca4436b824f7aad4f09e90805155199211

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jlvf1Vq2YP.bat

Filesize
215B

MD5
71419880ba402e0f3bb62a30371854d2

SHA1
4bad6e6ceb717a2da8e7da3d824bbbdac655cb3d

SHA256
2a9a9cef5a1a612db0aa29fcbdeb99e66406922b23e965cad151e8118a4aace8

SHA512
6b8364dc5fa832cf4736466971bf9ad97084fdb05d06af143147d3b9609b12cdea6638b67be15758cd951eb68aed7d7700110b742906e60b2e1beb512599cab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kq4mDwN7mD.bat

Filesize
215B

MD5
a0ed8de5d17aa9bb841253d4d78760f1

SHA1
6edd752072b11a8dfc92f5a3053707b8f3dbb916

SHA256
4b13639cadd84c56412b56e69547a36605446192ee4af834971360b66b53cd46

SHA512
d75fb1681003cfea08b2b13e3855f72594b359b7be323ab4c83e46d17cdd936d40793fc58af978700787f508e164580a6c684934c2b86d8b23285996a352616a

Download Submit
C:\Users\Admin\AppData\Local\Temp\QUn8qtQ3eB.bat

Filesize
215B

MD5
ee1d3876ce8d68e93b34e1224d10cbc1

SHA1
d1ad4953b5e1206afd25f934f91657abdb83575c

SHA256
9470a02679c0f74fc40ea8df8992760f5c2bc060aefebeafe7f1335dbaf6c874

SHA512
3ffc429ce7e53e791a2cfde24328bddbe4334c5ec62840852479016f73403a6882bcbd3470cea4a4991aad91548cd7d11c1463d6ecdf405e4aed8f556e682c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zcl4dB2r8y.bat

Filesize
215B

MD5
d5eed6a9e65ad59db5b58e8d567f8bd2

SHA1
cf5bd788acbebf7c89425e36539b4a8401616382

SHA256
eb9eabbb66a61e738d533425e101a071f19679f7dc8ad78a1eb2b743df84f23f

SHA512
2742be700e9c9cb08e3d33f8ab37ed6e5387b8458b38c6ddc0b3e670fdd3b2c1216d983d2c710b2b43fc766ed0df8087e6eaba08588d8cdbdbaec40e466295d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\gWC6ojzqIZ.bat

Filesize
215B

MD5
b9fde4620575ee6140950cde9881c8fc

SHA1
7c6600ffcadcae044164091df014650c2c0e994d

SHA256
317296e0c12e8185f237d73a2d44204de8be7b3d82e9f1550c1d757665319593

SHA512
45de2c03a740851d944b8c0ce1705f85461cfc5b367ca349401bbd9f763993a8a7e2c091fde4d326c7338054308fdc01f7578e70ac4b2f67804649d8ec4fae7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mJIFszAWFu.bat

Filesize
215B

MD5
9c7487f8fdc3f2110d6694f7f5368372

SHA1
0a459b61ffa4c5848fbff32a8c7f580796fb9f65

SHA256
f0f87e9c31346387ffd7ebdc4c11235df9f630e12914c3b567606b395b43bf4b

SHA512
fc44693f68d89f2da3ddab919967ffcd96185d43d26963b273036b51f96159f65171a0707c6ab04e83a591ae0ea81269aa50737887009bacf16f5fce8a063770

Download Submit
C:\Users\Admin\AppData\Local\Temp\mqKWPsdws2.bat

Filesize
199B

MD5
9bc80f842bdfdee5b63e1319a06a03d4

SHA1
c49bf9e1949fcc6c78e00c90c23842e8b000ca02

SHA256
a6d3ef08cc021e58bc857f3231a25806657034b45d8a6b7038bb6208278e9bba

SHA512
5fd168e8d98361c600e6c88cc614d851630adfca365fc8cb69a8369ae27c140a4428fd26130b2a2a176f1ffd164f3b486f0a0c43a3eb6ef94284931d8c07dd0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\p6CE4ikEee.bat

Filesize
215B

MD5
488c9b6ceb93ac0f6c04457a6d609481

SHA1
4c72bff3b0d5bb4151b1be2040145dcaa1942de2

SHA256
cbb76746668c69790dc032d0544bcec4466bcc31620af40eeee912bf10a79170

SHA512
f25aff6fdf8f3d36a451c03be047660f9f1f2dc3795d0608077c89c136bb5f033d31811483492c6b5514198fc3361c5618cb4704d2cffb80b9e5efa7098b8fe1

Download Submit
C:\Windows\Containers\serviced\MoUsoCoreWorker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\MoUsoCoreWorker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\MoUsoCoreWorker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\MoUsoCoreWorker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\MoUsoCoreWorker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\MoUsoCoreWorker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\MoUsoCoreWorker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\MoUsoCoreWorker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\MoUsoCoreWorker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\Containers\serviced\MoUsoCoreWorker.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/224-253-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/224-249-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/224-205-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/224-184-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/376-189-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/376-191-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/448-209-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/448-186-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/800-190-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/800-206-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/860-232-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/860-228-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/1008-149-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/1008-140-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/1008-139-0x00000000005C0000-0x00000000006D0000-memory.dmp

Filesize
1.1MB

Download
memory/1132-221-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/1132-225-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/1248-239-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/1248-235-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/1332-267-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/1332-263-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/1556-165-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/1556-181-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/1604-242-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/1604-246-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/2040-199-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/2040-183-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/2044-180-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/2044-202-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/2128-179-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/2128-200-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/3264-176-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/3264-194-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/3532-270-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/3532-274-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/4488-161-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/4488-151-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/4668-150-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/4668-159-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/4776-156-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/4776-145-0x00000215F8BD0000-0x00000215F8BF2000-memory.dmp

Filesize
136KB

Download
memory/4776-147-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/5032-158-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/5032-148-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/5052-198-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/5052-177-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/5080-213-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/5080-217-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/5100-185-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/5100-207-0x00007FFE18910000-0x00007FFE193D1000-memory.dmp

Filesize
10.8MB

Download
memory/5116-256-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download
memory/5116-260-0x00007FFE189C0000-0x00007FFE19481000-memory.dmp

Filesize
10.8MB

Download