dcrat | bdc03300f10128529e44bb7bb813e464c79297845f6072371d6b12316a72a8bd

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 19:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bdc03300f10128529e44bb7bb813e464c79297845f6072371d6b12316a72a8bd.exe
Size

1.3MB
MD5

b27331a27cf2143438f81ce856fb6a50
SHA1

cc7901890643969c87b9f36c6f2312be15243ed2
SHA256

bdc03300f10128529e44bb7bb813e464c79297845f6072371d6b12316a72a8bd
SHA512

23d6de67cb3d083a1ce06ac0778a134b8f54bb10ec9b1f4d201fe3532d721486dbbe8bbda157b82939b79c06eea0be0f716d3786c437966004e9566badff1441
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3316	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2936	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	2936	schtasks.exe	38

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0003000000022e07-137.dat	dcrat
behavioral1/files/0x0003000000022e07-138.dat	dcrat
behavioral1/memory/2128-139-0x00000000001E0000-0x00000000002F0000-memory.dmp	dcrat
behavioral1/files/0x0002000000022e15-165.dat	dcrat
behavioral1/files/0x0002000000022e15-164.dat	dcrat
behavioral1/files/0x0002000000022e15-218.dat	dcrat
behavioral1/files/0x0002000000022e15-227.dat	dcrat
behavioral1/files/0x0002000000022e15-234.dat	dcrat
behavioral1/files/0x0002000000022e15-241.dat	dcrat
behavioral1/files/0x0002000000022e15-248.dat	dcrat
behavioral1/files/0x0002000000022e15-255.dat	dcrat
behavioral1/files/0x0002000000022e15-262.dat	dcrat
behavioral1/files/0x0002000000022e15-269.dat	dcrat
behavioral1/files/0x0002000000022e15-276.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
2128	DllCommonsvc.exe
3232	dllhost.exe
2464	dllhost.exe
5428	dllhost.exe
4488	dllhost.exe
3596	dllhost.exe
3420	dllhost.exe
2952	dllhost.exe
3460	dllhost.exe
5088	dllhost.exe
5556	dllhost.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	bdc03300f10128529e44bb7bb813e464c79297845f6072371d6b12316a72a8bd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\ClientX64\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\WindowsApps\upfc.exe	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\AppReadiness\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\AppReadiness\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\rescache\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\24dbde2999530e	DllCommonsvc.exe
File created	C:\Windows\debug\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\debug\5940a34987c991	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
448	schtasks.exe
3488	schtasks.exe
1588	schtasks.exe
4396	schtasks.exe
4900	schtasks.exe
4732	schtasks.exe
1792	schtasks.exe
1108	schtasks.exe
1816	schtasks.exe
1744	schtasks.exe
432	schtasks.exe
3316	schtasks.exe
3088	schtasks.exe
212	schtasks.exe
3716	schtasks.exe
3456	schtasks.exe
1048	schtasks.exe
1652	schtasks.exe
3580	schtasks.exe
4464	schtasks.exe
2220	schtasks.exe
4228	schtasks.exe
672	schtasks.exe
4448	schtasks.exe
816	schtasks.exe
4512	schtasks.exe
3376	schtasks.exe
4872	schtasks.exe
3464	schtasks.exe
3428	schtasks.exe
2836	schtasks.exe
1088	schtasks.exe
4572	schtasks.exe
920	schtasks.exe
3472	schtasks.exe
2864	schtasks.exe
3108	schtasks.exe
2784	schtasks.exe
1412	schtasks.exe
4388	schtasks.exe
5028	schtasks.exe
4628	schtasks.exe
4716	schtasks.exe
2464	schtasks.exe
4200	schtasks.exe
3732	schtasks.exe
3588	schtasks.exe
1800	schtasks.exe
3560	schtasks.exe
4348	schtasks.exe
4652	schtasks.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	bdc03300f10128529e44bb7bb813e464c79297845f6072371d6b12316a72a8bd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	dllhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
2128	DllCommonsvc.exe
1316	powershell.exe
1128	powershell.exe
1316	powershell.exe
1128	powershell.exe
3764	powershell.exe
3764	powershell.exe
3836	powershell.exe
3836	powershell.exe
1468	powershell.exe
1468	powershell.exe
3636	powershell.exe
3636	powershell.exe
3760	powershell.exe
3760	powershell.exe
2164	powershell.exe
2164	powershell.exe
4892	powershell.exe
4892	powershell.exe
4108	powershell.exe
4108	powershell.exe
3784	powershell.exe
3784	powershell.exe
3136	powershell.exe
3136	powershell.exe
4952	powershell.exe
4952	powershell.exe
3940	powershell.exe
3940	powershell.exe
212	powershell.exe
212	powershell.exe
3428	powershell.exe
3428	powershell.exe
1872	powershell.exe
1872	powershell.exe
4504	powershell.exe
4504	powershell.exe
1468	powershell.exe
1468	powershell.exe
1316	powershell.exe
1316	powershell.exe
1128	powershell.exe
1128	powershell.exe
3836	powershell.exe
3836	powershell.exe
3232	dllhost.exe
3232	dllhost.exe
3764	powershell.exe
3764	powershell.exe
3636	powershell.exe
3636	powershell.exe
3760	powershell.exe
3760	powershell.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	DllCommonsvc.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	3232	dllhost.exe
Token: SeDebugPrivilege	2464	dllhost.exe
Token: SeDebugPrivilege	5428	dllhost.exe
Token: SeDebugPrivilege	4488	dllhost.exe
Token: SeDebugPrivilege	3596	dllhost.exe
Token: SeDebugPrivilege	3420	dllhost.exe
Token: SeDebugPrivilege	2952	dllhost.exe
Token: SeDebugPrivilege	3460	dllhost.exe
Token: SeDebugPrivilege	5088	dllhost.exe
Token: SeDebugPrivilege	5556	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4024	4816	bdc03300f10128529e44bb7bb813e464c79297845f6072371d6b12316a72a8bd.exe	81
PID 4816 wrote to memory of 4024	4816	bdc03300f10128529e44bb7bb813e464c79297845f6072371d6b12316a72a8bd.exe	81
PID 4816 wrote to memory of 4024	4816	bdc03300f10128529e44bb7bb813e464c79297845f6072371d6b12316a72a8bd.exe	81
PID 4024 wrote to memory of 1508	4024	WScript.exe	85
PID 4024 wrote to memory of 1508	4024	WScript.exe	85
PID 4024 wrote to memory of 1508	4024	WScript.exe	85
PID 1508 wrote to memory of 2128	1508	cmd.exe	87
PID 1508 wrote to memory of 2128	1508	cmd.exe	87
PID 2128 wrote to memory of 1316	2128	DllCommonsvc.exe	140
PID 2128 wrote to memory of 1316	2128	DllCommonsvc.exe	140
PID 2128 wrote to memory of 1128	2128	DllCommonsvc.exe	141
PID 2128 wrote to memory of 1128	2128	DllCommonsvc.exe	141
PID 2128 wrote to memory of 3764	2128	DllCommonsvc.exe	142
PID 2128 wrote to memory of 3764	2128	DllCommonsvc.exe	142
PID 2128 wrote to memory of 1468	2128	DllCommonsvc.exe	143
PID 2128 wrote to memory of 1468	2128	DllCommonsvc.exe	143
PID 2128 wrote to memory of 3836	2128	DllCommonsvc.exe	145
PID 2128 wrote to memory of 3836	2128	DllCommonsvc.exe	145
PID 2128 wrote to memory of 3636	2128	DllCommonsvc.exe	149
PID 2128 wrote to memory of 3636	2128	DllCommonsvc.exe	149
PID 2128 wrote to memory of 3760	2128	DllCommonsvc.exe	151
PID 2128 wrote to memory of 3760	2128	DllCommonsvc.exe	151
PID 2128 wrote to memory of 2164	2128	DllCommonsvc.exe	152
PID 2128 wrote to memory of 2164	2128	DllCommonsvc.exe	152
PID 2128 wrote to memory of 4892	2128	DllCommonsvc.exe	155
PID 2128 wrote to memory of 4892	2128	DllCommonsvc.exe	155
PID 2128 wrote to memory of 4108	2128	DllCommonsvc.exe	157
PID 2128 wrote to memory of 4108	2128	DllCommonsvc.exe	157
PID 2128 wrote to memory of 3784	2128	DllCommonsvc.exe	158
PID 2128 wrote to memory of 3784	2128	DllCommonsvc.exe	158
PID 2128 wrote to memory of 3136	2128	DllCommonsvc.exe	160
PID 2128 wrote to memory of 3136	2128	DllCommonsvc.exe	160
PID 2128 wrote to memory of 4952	2128	DllCommonsvc.exe	164
PID 2128 wrote to memory of 4952	2128	DllCommonsvc.exe	164
PID 2128 wrote to memory of 3940	2128	DllCommonsvc.exe	162
PID 2128 wrote to memory of 3940	2128	DllCommonsvc.exe	162
PID 2128 wrote to memory of 212	2128	DllCommonsvc.exe	173
PID 2128 wrote to memory of 212	2128	DllCommonsvc.exe	173
PID 2128 wrote to memory of 3428	2128	DllCommonsvc.exe	172
PID 2128 wrote to memory of 3428	2128	DllCommonsvc.exe	172
PID 2128 wrote to memory of 1872	2128	DllCommonsvc.exe	168
PID 2128 wrote to memory of 1872	2128	DllCommonsvc.exe	168
PID 2128 wrote to memory of 4504	2128	DllCommonsvc.exe	171
PID 2128 wrote to memory of 4504	2128	DllCommonsvc.exe	171
PID 2128 wrote to memory of 3232	2128	DllCommonsvc.exe	176
PID 2128 wrote to memory of 3232	2128	DllCommonsvc.exe	176
PID 3232 wrote to memory of 5928	3232	dllhost.exe	179
PID 3232 wrote to memory of 5928	3232	dllhost.exe	179
PID 5928 wrote to memory of 5988	5928	cmd.exe	180
PID 5928 wrote to memory of 5988	5928	cmd.exe	180
PID 5928 wrote to memory of 2464	5928	cmd.exe	183
PID 5928 wrote to memory of 2464	5928	cmd.exe	183
PID 2464 wrote to memory of 4828	2464	dllhost.exe	184
PID 2464 wrote to memory of 4828	2464	dllhost.exe	184
PID 4828 wrote to memory of 5356	4828	cmd.exe	186
PID 4828 wrote to memory of 5356	4828	cmd.exe	186
PID 4828 wrote to memory of 5428	4828	cmd.exe	187
PID 4828 wrote to memory of 5428	4828	cmd.exe	187
PID 5428 wrote to memory of 3688	5428	dllhost.exe	188
PID 5428 wrote to memory of 3688	5428	dllhost.exe	188
PID 3688 wrote to memory of 4468	3688	cmd.exe	190
PID 3688 wrote to memory of 4468	3688	cmd.exe	190
PID 3688 wrote to memory of 4488	3688	cmd.exe	191
PID 3688 wrote to memory of 4488	3688	cmd.exe	191

C:\Users\Admin\AppData\Local\Temp\bdc03300f10128529e44bb7bb813e464c79297845f6072371d6b12316a72a8bd.exe
"C:\Users\Admin\AppData\Local\Temp\bdc03300f10128529e44bb7bb813e464c79297845f6072371d6b12316a72a8bd.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\AppData\Roaming\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SearchApp.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppReadiness\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:212
    - - C:\Users\Default\AppData\Roaming\dllhost.exe
        
        "C:\Users\Default\AppData\Roaming\dllhost.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3232
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J6LEBq1ChC.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5988
        
        C:\Users\Default\AppData\Roaming\dllhost.exe
        
        "C:\Users\Default\AppData\Roaming\dllhost.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QLPJAVlmCt.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:5356
        
        C:\Users\Default\AppData\Roaming\dllhost.exe
        
        "C:\Users\Default\AppData\Roaming\dllhost.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8RCzlRjk6I.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4468
        
        C:\Users\Default\AppData\Roaming\dllhost.exe
        
        "C:\Users\Default\AppData\Roaming\dllhost.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L9j9zErPDE.bat"
        12⤵
        
        PID:1356
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:676
        
        C:\Users\Default\AppData\Roaming\dllhost.exe
        
        "C:\Users\Default\AppData\Roaming\dllhost.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AWL6wsGpK7.bat"
        14⤵
        
        PID:5176
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:4908
        
        C:\Users\Default\AppData\Roaming\dllhost.exe
        
        "C:\Users\Default\AppData\Roaming\dllhost.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qsbi9TUILn.bat"
        16⤵
        
        PID:5872
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3280
        
        C:\Users\Default\AppData\Roaming\dllhost.exe
        
        "C:\Users\Default\AppData\Roaming\dllhost.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ANE2RWndQ4.bat"
        18⤵
        
        PID:5372
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4196
        
        C:\Users\Default\AppData\Roaming\dllhost.exe
        
        "C:\Users\Default\AppData\Roaming\dllhost.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\owZfSNRP11.bat"
        20⤵
        
        PID:2232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:5780
        
        C:\Users\Default\AppData\Roaming\dllhost.exe
        
        "C:\Users\Default\AppData\Roaming\dllhost.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\P9uKrkSNlp.bat"
        22⤵
        
        PID:4116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2384
        
        C:\Users\Default\AppData\Roaming\dllhost.exe
        
        "C:\Users\Default\AppData\Roaming\dllhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Default\AppData\Roaming\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\AppData\Roaming\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\AppData\Roaming\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\odt\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\WTR\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Templates\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\Templates\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Templates\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\debug\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\debug\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\debug\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\odt\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Windows\AppReadiness\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\AppReadiness\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Windows\AppReadiness\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60804e808a88131a5452fed692914a8e

SHA1
fdb74669923b31d573787fe024dbd701fa21bb5b

SHA256
064fdd6e9e6e7f51da354604a56f66217f1edfc12d9bbbaf869a628915a86a61

SHA512
d4f2791433c0bacd8cad57b40fab4a807db4dd74f7c5357d2bce9aaa6544f97667497307d1e0704b98e2c99a94775fbb6ea676685a01578e4d0304f541c9854a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60804e808a88131a5452fed692914a8e

SHA1
fdb74669923b31d573787fe024dbd701fa21bb5b

SHA256
064fdd6e9e6e7f51da354604a56f66217f1edfc12d9bbbaf869a628915a86a61

SHA512
d4f2791433c0bacd8cad57b40fab4a807db4dd74f7c5357d2bce9aaa6544f97667497307d1e0704b98e2c99a94775fbb6ea676685a01578e4d0304f541c9854a

Download Submit
C:\Users\Admin\AppData\Local\Temp\8RCzlRjk6I.bat

Filesize
209B

MD5
83a19fb0358d75466b4dd660b45da542

SHA1
f3d14dadaa87784bec90b2bd988ddddebe806641

SHA256
b3f6ba4974847608d9420e3e2f33c2699d0bfe4f734cb91e338e2b397ab9fe68

SHA512
4139c511ebe57f78f6831a16f38510a7401ff52ae8565ab10ce063579e62610a5c8e97ce7c7891d5105ec9796bced47e2794215592062b131769ad014c7d46fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ANE2RWndQ4.bat

Filesize
209B

MD5
c9acd35132cadbea09ba3b5f77a8abf5

SHA1
d8e51f5c660725d1ea4f5ff8193216412f1dcc41

SHA256
37a08b32ea52882e3b8e4ba341ec33774e864eecf0e686f2ea2e83492d3ac01d

SHA512
3d2f0714752fc731d7f4051ba3a30fe9850b02e6e75da62b379f0e393dd57442354af2644566d432946ff8cafc5d344d42496652624ee2bbbce5061df5c9a873

Download Submit
C:\Users\Admin\AppData\Local\Temp\AWL6wsGpK7.bat

Filesize
209B

MD5
0779481270926b9037969fbd80ce3e9e

SHA1
966b77dca8ef92d04a68363e28d5bd1e511bbed0

SHA256
30c7a77e33fe0f07c95955ae1a14ca03fcfe93591ca1ed19667c8e3f12a4f1df

SHA512
b3347e05f12dd1c11f6b0fb4a34309ccd3c380b70aa84debce4244e32f51929f3cf7f3c14f70e678e168d7d100f06197148478052027d29959096e6b3aa5eb42

Download Submit
C:\Users\Admin\AppData\Local\Temp\J6LEBq1ChC.bat

Filesize
209B

MD5
1420b3b1e5b96c56353d48f652a767f8

SHA1
d3f3304a1295c3741f574ca63532b89f06c9e53b

SHA256
2669f968c8f471e5e635aaa7125595a259d709c7f196d6e276965394762d642f

SHA512
278b8b67b0e9900ddde87c0ed1b202976e442cb05f85097a8641e7606708bc75941349a89245c8c4d7a6ca6a5e5559440fd8252f7c38952383625aec94b903f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\L9j9zErPDE.bat

Filesize
209B

MD5
d3b90aa1340f41be8b125e1d679a5b61

SHA1
b85a3f144d9b971269a4a32a33034bab665f3696

SHA256
08595e80ae4b15ab00e756857801687e213b72ccd9cf8e0cbc58cc567426e2fe

SHA512
c42658a160bbabbdf9494b770873e1329a2ad5455b5552dca93ef8ce9cd2d3bfe63f1b992fed2bc93d98c365afc6735352b43505ac3a37f14d66e6d5ab141ead

Download Submit
C:\Users\Admin\AppData\Local\Temp\P9uKrkSNlp.bat

Filesize
209B

MD5
050703906986cd44d4bf3f00ac50392b

SHA1
c0bd6de10be7c08d9ccc77696b073835f07c52aa

SHA256
beddd8ea6141187f1c9961ccc72d16c2e2775137c520c2b569794e0d171ec673

SHA512
d1709f3a2c0f423cebfa684f349a10256f0a8afebff38ad4d1dbf316dee0742e6c86a84d0b51e67391861a9047ef6aaa7097e518e23fa496ac7320bb82d0ac6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\QLPJAVlmCt.bat

Filesize
209B

MD5
b0188a044e53f2737a5d13af8aea1d28

SHA1
b5445ca3335b12b6a2af7e05aac10e3c3726b416

SHA256
324e7dffaf4ef767045433e56297dc0b03de5bf874dcb6106a8e24b7caabecd4

SHA512
02575ad8d9124379e153e0eda896996ff8a3fa4ef603d4d7f44b02b7a11e3d654efe9f1872d22af33bab1884c64116be358fc588ab5bdb83363b102847c84ca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\owZfSNRP11.bat

Filesize
209B

MD5
6dc1c4e5bc4cf9fe32bd1cf091ac9cfc

SHA1
0d53a04a3b80c45b236be40fa24270fb88c0e19c

SHA256
ad4a75490dba73767711aba755298cb9189d70d4f7ddc02f77eb274b6ad3d7df

SHA512
5db735dfe619cf11e1e305bda068841ee8dd65c9abc7d5a20494a29de0d8deb62d435a9907ae84fa558cc29cdf2596f3d60b60af9a461dc8216c575b5559490a

Download Submit
C:\Users\Admin\AppData\Local\Temp\qsbi9TUILn.bat

Filesize
209B

MD5
2c98b616967694ce800676872f82854b

SHA1
76dd37210cf2cf7528da29a2750480a45669b323

SHA256
443e95dfd31ab9e1f4d347b6cdbdaf3850d277eba00152ff32e831c94f356e95

SHA512
c201c8e5218587014c9b425dda0ebc8df47652f763fdf30ef98b136d2876506b68fc657c27a20fa2e0eabba835b4d46a79fa6872bd0a98999c092513dcecade4

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Default\AppData\Roaming\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/212-181-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/212-214-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/1128-161-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/1128-188-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/1316-159-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/1316-189-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/1468-154-0x000001A77B920000-0x000001A77B942000-memory.dmp

Filesize
136KB

Download
memory/1468-166-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/1468-183-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/1872-216-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/1872-177-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/2128-140-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/2128-139-0x00000000001E0000-0x00000000002F0000-memory.dmp

Filesize
1.1MB

Download
memory/2128-168-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/2164-199-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/2164-171-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/2464-224-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/2464-220-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/2952-260-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/2952-256-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3136-211-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3136-179-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3232-178-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3232-210-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3420-249-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3420-253-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3428-215-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3428-176-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3460-267-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3460-263-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3596-246-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3596-242-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3636-169-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3636-193-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3760-170-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3760-196-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3764-225-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3764-162-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3784-201-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3784-174-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3836-167-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3836-191-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3940-180-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/3940-212-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/4108-202-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/4108-173-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/4488-235-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/4488-239-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/4504-213-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/4504-182-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/4892-172-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/4892-203-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/4952-175-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/4952-209-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/5088-274-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/5088-270-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/5428-228-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/5428-232-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download
memory/5556-277-0x00007FFC2DD90000-0x00007FFC2E851000-memory.dmp

Filesize
10.8MB

Download